# NERF

**New Experimental Research Foundation**

AI security engineering platform and autonomous coding agent. 1,543 techniques across 98 domains, 9 auto security modes, cross-session memory, RAG over 96 knowledge docs, compliance automation for 39 frameworks, and scanning pipelines. Built on [pi-mono](https://github.com/badlogic/pi-mono) for 26 LLM providers. Pure Node.js.

## Install

```bash
npm install -g @defconxt/nerf
```

All dependencies install automatically, including the LLM layer (26 providers).

```bash
nerf setup        # Configure LLM backend
nerf doctor       # Verify installation
```

## Usage

```bash
nerf scan https://example.com          # Vulnerability scan
nerf review ./src                       # Security code review
nerf compliance SOC2                    # Compliance assessment
nerf osint example.com                  # OSINT investigation
nerf "how do I detect Kerberoasting"    # Natural language query
```

### Modes

| Mode | Focus |
|------|-------|
| **RED** | Attack paths, exploitation, C2, lateral movement |
| **BLUE** | Detection engineering, Sigma/KQL/SPL rules, hardening |
| **PURPLE** | ATT&CK mapping, adversary emulation, gap analysis |
| **PRIVACY** | GDPR, CCPA, HIPAA, DPIAs, data flow analysis |
| **RECON** | OSINT, passive/active recon, asset discovery |
| **INCIDENT** | Triage, forensics, containment, timeline reconstruction |
| **ARCHITECT** | Zero trust, threat modeling, defense-in-depth |
| **BUILD** | Security tooling, automation, CI/CD security |
| **RESEARCHER** | Vulnerability research, CVE analysis, threat intel |

### Engagement Engine

```bash
nerf red --auto "pentest the target"    # Auto execution
nerf api                                # REST API (14 endpoints)
nerf mcp                                # MCP server (25 tools)
nerf bot                                # Signal bot
```

### Pi Extension

NERF also runs as a native [pi](https://github.com/badlogic/pi-mono) extension:

```bash
pi install @defconxt/nerf
```

## LLM Backends

All backends route through pi-mono. Configure one:

| Backend | Setup |
|---------|-------|
| **Claude** | `export ANTHROPIC_API_KEY=sk-ant-...` |
| **Ollama** (local, free) | [Install Ollama](https://ollama.ai), then `ollama serve` |
| **OpenAI** | `export OPENAI_API_KEY=sk-...` |
| **OpenRouter** | Configure in `~/.config/nerf/config.yaml` |

## Documentation

Full documentation, architecture details, and configuration reference: [github.com/defconxt/NERF](https://github.com/defconxt/NERF)

## License

[AGPL-3.0](https://github.com/defconxt/NERF/blob/main/LICENSE)

Copyright (c) 2026 defconxt. NERF is a trademark of [defconxt](https://github.com/defconxt).
