# Rokkhe

> Rokkhe is an autonomous AI pentester. It maps a target's attack surface, writes and runs real exploits to confirm what is actually vulnerable, and opens the fix as a pull request — the whole engagement, without a human driving each step.

Rokkhe differs from a vulnerability scanner in one specific way: scanners flag
patterns, Rokkhe proves them. Every finding ships with a working
proof-of-concept executed against a sandboxed copy of the application, so the
output is a list of confirmed exploits rather than a queue of maybes.

- Targets: Git repositories, live URLs, and cloud environments.
- Method: agents enumerate routes, parameters, auth flows, dependencies and
  misconfigurations the way an adversary would, then attempt exploitation.
- Output: a CVSS-scored finding with a reproducible proof-of-concept, plus a
  remediation pull request.
- Isolation: agents and their tooling run in a Docker sandbox, and only the
  target you scope is touched.
- Deployment: hosted, or self-hosted on your own infrastructure so code and
  findings never leave it.
- Models: bring your own key — OpenAI, Anthropic, Google, and Z.ai (GLM) among
  others. Model spend stays on your account.

## Pages

- [Rokkhe](https://rokkhe.com/): what Rokkhe does, how it proves a finding, how
  it ships the fix, and the FAQ.

## Contact

- Email: contact@rokkhe.com

## Documentation

- https://rokkhe.com/docs/overview — what the platform does and the two loops it runs
- https://rokkhe.com/docs/quickstart — run the engine, then the full stack
- https://rokkhe.com/docs/cli — every CLI command and what it returns
- https://rokkhe.com/docs/agent — driving the SOC from a coding agent, read-only by design
- https://rokkhe.com/docs/collectors — native adapters for Splunk, Elastic, Sentinel, CrowdStrike, OCSF, AWS Security Hub, GuardDuty, Google SCC, and Wazuh
- https://rokkhe.com/docs/soc-pipeline — intake, correlation, cases, and approved response
- https://rokkhe.com/docs/self-hosting — running it inside your own boundary
- https://rokkhe.com/docs/security — sandboxing, signed execution profiles, and approval boundaries