OpenGhost

Use OpenGhost for structured, evidence-backed assessments of scoped web applications and supporting server surface. The agent reasons, automates, validates in a browser, and assembles reports; OpenGhost provides Docker-backed tool execution and engagement state.

OpenGhost is fully local and open source. It has no hosted control plane, account, API key, telemetry requirement, or managed authentication service. Any optional credential is for the authorized target application only.

Runtime

• Require Docker, bash, and host python3.
• Run security tools only through openghost; never run offensive tooling directly on the host.
• If an installed skill already exposes openghost, use it directly.
• For a repo checkout, add both launchers:

  export PATH="$PWD/skills:$PWD/skills/openghost-skill:$PATH"
  

• For a copied standalone skill package, add only the skill directory containing openghost if needed.
• Keep generated operational data under .openghost/, normally uncommitted.

Bounded Defensive Capability