CAIO — Cybersecurity AI Orchestrator

AI-assisted security assessment, investigation, and reporting from one dashboard.

What is CAIO?

CAIO is an open-source cybersecurity platform that combines AI with practical security workflows. It helps security professionals review source code, test authorized websites, analyze logs, perform reconnaissance, investigate threats, and generate reports without switching between many separate interfaces.

CAIO supports local models through Ollama and cloud models from OpenAI and Anthropic Claude.

Main capabilities

• Vulnerability Assessment — Review a local source repository, identify evidence-backed vulnerabilities, receive remediation guidance, and optionally apply verified fixes.
• Penetration Testing — Test an authorized deployed website without providing its source code. Supply a target URL and optional multiline hints such as API endpoints, parameters, or priority features.
• Reconnaissance — Discover domains, subdomains, DNS records, services, and related infrastructure.
• Log and incident analysis — Analyze security logs, indicators, attacker behavior, and MITRE ATT&CK techniques.
• Security operations — Generate SIEM rules, run incident-response playbooks, review CVEs, and create exportable reports.

Requirements

• Python 3.10 or newer
• Git, if cloning the repository
• At least one AI provider:
  • Ollama for local inference
  • OpenAI API key
  • Anthropic API key

Some reconnaissance features work best when their external command-line tools are installed and available on PATH.

Installation

Clone the project:

git clone https://github.com/Ronald-PH/caio-.git
cd caio

Create and activate a virtual environment.

Windows:

python -m venv venv
venv\Scripts\activate

Linux or macOS:

python3 -m venv venv
source venv/bin/activate

Install dependencies:

pip install -r requirements.txt

Create the environment configuration:

Windows:

copy .env.example .env

Linux or macOS:

cp .env.example .env

Edit .env, replace SECRET_KEY, and configure your preferred AI provider.

AI provider configuration

For Ollama, start the service and pull a model:

ollama serve
ollama pull qwen2.5:7b-instruct

Relevant .env settings:

SECRET_KEY=replace-with-a-random-secret
DEFAULT_PROVIDER=ollama

OLLAMA_ENDPOINT=http://localhost:11434
OLLAMA_MODEL=qwen2.5:7b-instruct

OPENAI_API_KEY=
ANTHROPIC_API_KEY=

Only configure the providers you intend to use. Additional optional settings for SMTP, webhooks, and external intelligence feeds are documented in .env.example.

Running CAIO

python app.py

Open http://127.0.0.1:5000 in your browser.

Basic usage

Vulnerability Assessment

1. Open Vulnerability Assessment.
2. Select the local repository folder.
3. Choose the review scope and describe what CAIO should inspect.
4. Enable Apply fixes to workspace only if CAIO is allowed to modify the repository.
5. Start the assessment and monitor the live agent activity.
6. Review or export the completed report.

Penetration Testing

1. Open Penetration Testing.

2. Enter the complete URL of a website you are authorized to test.

3. Optionally enter multiple hints, such as:

   /api/v1/users?id=1
   /graphql
   Prioritize login and password-reset flows
   

4. Confirm authorization.

5. Leave Enable controlled form testing off for passive and GET-based testing. Enable it only when bounded form submissions and inert text-file upload tests are explicitly permitted.

6. Start the test and monitor the live activity and final report.

Data and reports

• Scan history, activity, token usage, and reports are stored locally in SQLite.
• Reports can be exported as Markdown.
• Print-ready reports can be saved as PDF through the browser's print dialog.
• Penetration Testing does not request or expose the target website's source repository.

Do not commit .env, API keys, credentials, generated evidence, or sensitive reports to source control.

Security and authorization

CAIO is intended for defensive security work, education, and explicitly authorized testing.

• Test only systems you own or have written permission to assess.
• Prefer staging or isolated environments for active testing.
• Keep controlled form testing disabled unless its possible side effects are understood and authorized.
• Never use CAIO for credential attacks, persistence, denial-of-service, destructive actions, or unauthorized access.
• Review AI-generated findings and patches before relying on or deploying them.
• Follow applicable laws and responsible-disclosure requirements.

Contributing

Contributions are welcome:

1. Fork the repository.
2. Create a feature branch.
3. Add or update tests with your changes.
4. Submit a pull request.

Use GitHub Issues for bug reports and feature requests.

License

CAIO is released under the MIT License.

Links

• Repository
• Issues
• Discussions