Skip to content
PhiloCyber logo

Open source / Self-hosted / AGPL-3.0

The counterweight to autonomous attacks.

Attackers now automate with AI, and most teams have no red team to answer with. Counterweight puts the same class of tooling on the defenders' side: agents that test your applications and review your code, with a person in command.

Get the source and install guideWhy it exists

Runs on your machines, with the model you choose. No hosted service, no telemetry, no licence fee.

Status
Available
Version
v0.1.0
Licence
AGPL-3.0
Repository
github.com/philocyber/counterweight

Why it exists

The scale is already tipped.

A serious attack used to be expensive. It took skilled people and patience, and that cost quietly protected everyone who was not worth the effort. That protection is gone, and the organizations least able to respond are paying for it.

Offense scales like software

80–90%
of a 2025 espionage campaign against about thirty organizations was carried out by an AI agent, with people stepping in at a handful of decision points.1
−7 days
is the mean time-to-exploit: exploitation now routinely begins before a fix exists.2
22 sec
is the median time for an intruder's access to be handed to the next criminal crew.2

Defense is still staffed by hand

96%
of ransomware victims in the 2026 Verizon DBIR were small organizations: the ones without a red team, a SOC or a pentest budget.3
43 days
is the median time to fully remediate an exploited vulnerability, and it has been growing.3,4
59%
of security teams report critical or significant skill gaps; 29% cannot afford to hire the skills they need.5

A counterweight is the mass that keeps a lopsided system from tipping over. It does not add force for its own sake. It restores balance.

Counterweight does not pretend to end the asymmetry. It puts a weight on the defenders' side that grows with the same technology attackers use, so a two-person IT team, a clinic, a school or a growing startup can test its own systems with evidence and fix what matters first.

Read the mission

Sources

  1. 01Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025.
  2. 02Google Cloud / Mandiant, M-Trends 2026, March 2026.
  3. 03Cyber Readiness Institute, Summary of the 2026 Verizon DBIR, June 2026.
  4. 04Help Net Security, Lessons from the Verizon 2026 DBIR, May 2026.
  5. 05ISC2, 2025 Cybersecurity Workforce Study, December 2025.

How it works

The whole loop on your side, not only the finding.

Point it at a web application, an API, a network or a source repository. A planner and parallel workers explore it step by step; you see every step, and nothing counts until it is proven.

Task / Exploration paths

Exploration graph of a code review: intents, facts and confirmed vulnerabilities linked from the starting point to the target.
Demo: a review of an intentionally vulnerable training app.

Trust

An army of agents, with a human in command.

A tool that runs commands against your systems has to earn its place. Every claim below points at the document that lets you check it yourself.

01/04

You approve the risky steps

Scope, deny rules and an approval gate hold a command until a person decides. A code review never executes the repository's code, and its agents have no shell or network tools at all.

How the approval gate works

02/04

Your data stays yours

No hosted service and no telemetry. Use a hosted model, a gateway, or a model on your own hardware; with a local model nothing leaves your network.

Choosing a model

03/04

Confined by default

Agent file access is limited to each task, stored credentials are encrypted and write-only, sessions are revocable, and a per-task budget stops runaway spend.

The security model

04/04

Honest about what is not proven

What was verified, how, and what was not is written down next to the code. AI output can be wrong: review the evidence before acting on a finding, and every fix before merging it.

Verification and limits

Use Counterweight only on systems and code you own or are explicitly authorized, in writing, to test. Responsible use

Who it is for

Built for the teams attackers expect to find unprepared.

Well-funded security teams can keep up. This is for everyone else: the people who carry security on top of another job.

  • Small teams

    No security hire, real exposure

    A two-person IT team, a clinic, a school, a nonprofit. Review the code you ship and the application you expose, and get a short list of what to fix first, with the fix attached.

  • Growing companies

    Releases outpace testing

    Run a review on every pull request, retest after each fix and hand auditors a report they can read. Not an annual audit that ages in a drawer, but a practice that repeats release after release.

  • Researchers and maintainers

    Work you can inspect

    Commands, approvals and every step an agent takes are recorded. Bring your own model, write your own skills, drive it from your coding agent, and study how each conclusion was reached.

Community

Maintained in the open, for whoever needs it.

Counterweight is free software under AGPL-3.0. Nobody can close it, and improvements made to a hosted copy must be published, so the weight stays on the defenders' side.

What the agents know lives in 76 skills written as plain Markdown: you can read exactly what they will try, correct it, and add what your stack needs. Defense improves when the people doing it share what works.

Star and follow on GitHub

Install

From clone to first assessment in minutes.

One installer, a first-run checklist and a guided model setup. The first build compiles from source and takes several minutes; later starts take seconds.

Install commands

git clone https://github.com/Philocyber/counterweight.git
cd counterweight
./install.sh
  1. 01/03

    Install with Docker

    Choose the all-in-Docker option. The installer checks Docker, creates a local HTTPS certificate, writes a private .env file and starts the stack.

  2. 02/03

    Claim the installation

    Open https://localhost:8787, paste the one-time setup token the installer printed and choose a password. Then connect a model: hosted, through a gateway, or running on your own hardware.

  3. 03/03

    Run a first assessment

    Review a GitHub repository, or add the hosts in scope and test a web application. The dashboard's Get started card walks you through it and ticks the steps off.

Prefer no containers? Two native options run with PostgreSQL only.

All installation pathsA complete example engagement

Limits

What it is not.

Trust starts with the limits. These are checkable against the repository.

  • Not a replacement for people. Findings, fixes and retest verdicts come from language models and can be wrong. A person reviews the evidence and decides.
  • Not validated at scale. The agent workflows were exercised end to end against one live model on small demo targets. Run the acceptance check on your own model before relying on them.
  • Not for systems you do not own. Test only systems and code you own or are explicitly authorized, in writing, to test.
  • Not every runtime is verified. Running the published Docker image and the Windows launcher is covered by packaging checks only.
Read the verification notes

Provenance and credits

Counterweight is a standalone derivative of ARTEX at upstream commit 160fe13, licensed AGPL-3.0. Agent capabilities use the norma SDK; asset sync draws on ScopeSentry.

Screenshots show demo assessments of intentionally vulnerable training targets in the English console, not scans of live systems.

Read the provenance record

Put a weight on your side of the scale.

Clone it, point it at something you own and read what it finds. If it helps, tell the next team.

Back to all resources
Open the repository
Counterweight | PhiloCyber