🎤 Accepted to Black Hat USA Arsenal 2026, SecTor Arsenal 2026, and SecTor 2026 Briefings.
APTL is a local purple-team lab where human operators and AI agents exercise red- and blue-team workflows against an intentionally vulnerable enterprise range. Scenario documents select and realize the target, attacker, and SOC topology; the CLI owns validation, startup, readiness, access discovery, teardown, and run records.
Use cases include autonomous cyber-operations research, purple-team training, and AI threat-actor assessment.
Active development. Not for production. Not hardened. APTL gives AI agents penetration-testing tools and starts intentionally vulnerable services. Use a dedicated, rebuildable host, keep unrelated credentials and workloads elsewhere, control the surrounding network, and operate only on systems you are authorized to test.
For stronger host and cross-seat isolation on Linux/KVM, use a disposable
aptl seat. A VM boundary reduces
risk but does not eliminate it; keep the host kernel and hypervisor current.
Install the released CLI and materialize its bundled lab assets. No source checkout is required:
pipx install aptl-labs
aptl lab init my-lab
cd my-lab
aptl lab start --scenario techvaultStartup validates the selected scenario, creates private project state, realizes the topology, waits for required readiness checks, and reports a structured outcome. Inspect the runtime-derived state and access information:
aptl lab status
aptl lab info
aptl container listURLs, host ports, available containers, usernames, and credential locations
belong to the realized project. Use aptl lab info; do not rely on static
values copied from documentation.
At the end of the session:
aptl lab stop # preserve project volumes
aptl lab stop -v # confirm and destroy project volume dataRead the first-lab guide for scenario selection, safe activity, result inspection, troubleshooting, and teardown.
- Python 3.11 or newer and pipx
- Docker Engine or Docker Desktop with Compose and Buildx
- OpenSSH client with
ssh-keygenonPATH - Node.js 20 or newer and npm for MCP artifact builds
- 20GB or more of free disk space
- Sufficient Docker memory for the selected scenario; the full acquired TechVault stack needs more than 20GB
See Prerequisites for platform-specific setup and verification.
- CLI is the primary lab control plane.
- MCP servers give authorized agents scenario-aware red- and blue-team tools through generated private client configuration.
- Web interface provides a loopback-first local operator UI and typed API.
The APTL operator UI, vulnerable target applications, and third-party SOC interfaces are separate surfaces. The selected scenario determines which ones exist.
The APTL startup catalog exposes the scenario selections supported by the installed release. Reusable environment-pack definitions and authoring support live in the companion OpenRAE/env-packs repository; APTL owns admission, realization, readiness, and operation of the selected scenario in the local lab.
The published site is the canonical user manual:
- Documentation home
- Installation
- Run your first lab
- Troubleshooting
- Architecture and historical records
- OpenSSF Best Practices assessment
The README is the GitHub and package-index gateway, not a second copy of the manual.
- Get support
- Contribute
- Report a vulnerability privately
- Review the OpenSSF Best Practices assessment
Do not report suspected vulnerabilities through a public issue. The security policy describes scope and the private fallback contact path.
APTL uses commodity services and standard security tooling. AI agents get Kali access; this public repository does not add red-team enhancements to their latent capabilities. You are responsible for following all applicable laws and for obtaining authorization before testing a system.
The repository contains intentional test credentials used only by lab fixtures. They are not production secrets. Runtime control-plane credentials are generated into private project files and must not be committed or shared.
MIT