Clearwing — Summary

Clearwing is an autonomous offensive-security CLI tool (binary: clearwing, PyPI package: clearwing) that runs network penetration testing, source-code vulnerability hunting, N-day exploit development, reverse engineering, and campaign orchestration using an LLM-backed ReAct loop with 63 bound tools. It is a direct open-source reimplementation of Anthropic's internal Glasswing tool, built by Eric Hartford at Lazarus AI using the genai-pyo3 Rust-backed LLM runtime. The source-code hunter pipeline is architecturally sophisticated: it fans out per-file hunter agents with a 4-axis validator (REAL / TRIGGERABLE / IMPACTFUL / GENERAL), uses ASan/UBSan crashes as ground truth, runs PoC stability checks across fresh containers, and emits SARIF/markdown/JSON reports with explicit evidence levels. Clearwing ships both a Textual TUI and a FastAPI/WebSocket web UI in addition to its CLI. The tool requires explicit authorization for authorized testing only and includes human-in-the-loop exploit approval guardrails.

Differs from seeds: No seed is architecturally similar — this is a security research platform, not a development workflow harness. The closest by distribution pattern is agent-os (bash-bundle, standalone-repo), but Clearwing is substantially more complex. Among seeds, claude-flow (Archetype 3: MCP-anchored multi-agent with a hive-mind) is most analogous in terms of multi-model routing and parallel agent fan-out, but Clearwing's domain is offensive security rather than code generation, and it has no Claude Code skill layer.

Clearwing — Origin, Philosophy, and Manifesto

Origin

Built by Eric Hartford (Lazarus AI) as an open-source reimplementation of Anthropic's internal Glasswing security research tool. The stated challenge in the README: "Produce similar results as Glasswing - using models everyone has access to."

Licensed MIT. Version 1.0.0. Python 3.10+, backed by genai-pyo3 — a Rust-native LLM runtime that speaks Anthropic, OpenAI, OpenRouter, Ollama, LM Studio, Together, Groq, DeepSeek, MiniMax, Gemini, and any OpenAI-compatible endpoint.

Philosophy

Clearwing takes a maximalist approach to autonomous security testing. The design philosophy is:

• Parallel fan-out over serial scanning: Files are ranked by an LLM ranker agent, then hunted in parallel by independent hunter agents — not sequentially.
• Multi-model routing by task: Different pipeline stages use different model sizes and capabilities (ranker = cheap/fast, hunter = capable, verifier = cheap/fast, exploiter = code-specialized).
• Ground truth from dynamic analysis: ASan/UBSan crashes, not just LLM suspicion, validate findings. PoC stability checks run across fresh Docker containers.
• Explicit evidence levels: Findings progress through named evidence rungs: suspicion → static_corroboration → crash_reproduced → root_cause_explained → exploit_demonstrated → patch_validated.

Authorized use philosophy

From README: "Authorized use only. Clearwing is a dual-use offensive-security tool. Run it only against targets you own or have explicit written authorization to test. Operators are responsible for scope, legal authorization, and disclosure."

Human-in-the-loop gating is built into the exploit development pipeline — exploits require human approval before execution attempts.

Comparison to Glasswing

Anthropic's Glasswing is closed-source and used internally. Clearwing uses publicly accessible model APIs to produce equivalent results. The explicit comparison to a closed Anthropic tool positions Clearwing as a democratization of AI-assisted vulnerability research.

Clearwing — Architecture, Distribution, and Installation

Distribution

• Python package installable via uv sync (preferred) or pip
• Source install from GitHub (no PyPI publish confirmed)
• Docker required for Kali container and sanitizer-image sandbox features

Installation

git clone https://github.com/Lazarus-AI/clearwing.git
cd clearwing
uv sync --all-extras
source .venv/bin/activate
clearwing setup     # interactive wizard
clearwing doctor    # environment check

Version analyzed: 1.0.0

Directory Tree

clearwing/
├── clearwing/           # Python package
│   ├── agent/           # ReAct agent loop
│   ├── analysis/        # static analysis
│   ├── bench/           # OSS-Fuzz benchmark
│   ├── capabilities.py  # 63-tool binding
│   ├── core/            # config + engine
│   ├── crypto/          # SHA-3 commitments
│   ├── data/            # knowledge graph
│   ├── eval/            # A/B test framework
│   ├── exploitation/    # exploit development
│   ├── findings/        # finding deduplication
│   ├── llm/             # AsyncLLMClient + native backend
│   │   └── native.py    # AsyncLLMClient (multi-stage routing)
│   ├── mcp/             # MCP integration (clearwing mcp cmd)
│   ├── observability/   # telemetry
│   ├── providers/       # provider adapters
│   ├── reporting/       # SARIF/markdown/JSON emitters
│   ├── runners/         # SourceHuntRunner, CampaignRunner
│   ├── safety/          # human-in-loop approval gating
│   ├── sandbox/         # Docker-based sandbox execution
│   ├── scanning/        # network scan
│   ├── sourcehunt/      # parallel file-hunter pipeline
│   ├── ui/
│   │   ├── cli.py        # argparse dispatcher
│   │   ├── commands/     # 20 subcommand modules
│   │   ├── tui/          # Textual TUI
│   │   └── web/          # FastAPI + WebSocket
├── docs/                # mkdocs documentation
├── tests/               # pytest test suite
├── pyproject.toml       # entry: clearwing = "clearwing:main"
└── Makefile

Subcommands (20)

bench, campaign, ci, config, disclose, doctor, eval, graph, history, interactive, mcp, operate, parallel, report, scan, sessions, setup, sourcehunt, webui (+ implicit help)

Required Runtime

• Python >= 3.10
• Docker (for Kali container, sanitizer sandbox, PoC stability checks)
• At least one LLM provider API key (Anthropic, OpenAI, OpenRouter, Ollama, etc.)
• Optional: Ghidra (for reverse engineering pipeline)

Target AI Tools

Clearwing IS the agent — it does not integrate with Claude Code or other coding agents as a skill. It uses LLM APIs directly.

Clearwing — Components

CLI Subcommands (20)

Pipeline Components

• LLM Ranker: ranks source files by vulnerability likelihood (uses smaller/cheaper model)
• Hunter agents: per-file LLM hunters (full-shell or constrained mode, parallel fan-out)
• 4-axis validator: checks REAL / TRIGGERABLE / IMPACTFUL / GENERAL — adversarial verification
• PoC stability checker: runs PoC across fresh Docker containers
• Exploit developer: multi-turn agentic exploit development with human-in-loop approval
• Patch validator: confirms fix works against patched version
• Root-cause deduplicator: shared findings pool with cross-subsystem dedup

UI Components

• Textual TUI: terminal UI (Python textual library)
• FastAPI web UI: launched by clearwing webui, WebSocket-connected

Models JSON

docs/providers.md — per-task routing documentation. SourceHuntRunner accepts separate ranker_llm, hunter_llm, verifier_llm, exploiter_llm as separate AsyncLLMClient instances.

Safety Component

clearwing/safety/ — human-in-the-loop exploit approval gating before execution attempts.

Clearwing — Uniqueness and Positioning

Differs from Seeds

No seed framework is architecturally similar — Clearwing is an offensive security research platform, not a development workflow harness. The closest architectural parallel is claude-flow (Archetype 3: parallel multi-agent with per-role model routing), but Clearwing's domain is vulnerability discovery rather than software development. Clearwing differs from all seeds by having: (a) domain-specific knowledge embedded in the pipeline (ASan/UBSan crash integration, CVE lookup, Ghidra decompilation), (b) Docker sandbox isolation for PoC testing, (c) an explicit evidence ladder with cryptographic commitments, and (d) legal/responsible disclosure tooling. It is the only framework in this batch that ships a FastAPI web UI, a Textual TUI, AND a CLI. Most distinct from agent-os and claude-conductor which are purely text-file harnesses.

Positioning

Clearwing is the democratized, open-source equivalent of Anthropic's internal Glasswing tool. It targets security researchers and red teams who want to apply LLM-driven vulnerability discovery at scale. Its differentiation from other LLM security tools (Nuclei-AI, etc.) is the full pipeline: from file ranking through crash-validated PoC through responsible disclosure.

The genai-pyo3 Rust backend is unique in this corpus — all other Python-based frameworks use pure Python LLM clients.

Observable Failure Modes

1. Docker dependency: The most interesting capabilities (sanitizer sandbox, Kali pentest) require Docker. Environments without Docker get degraded functionality.
2. Legal liability surface: Dual-use tool with broad capabilities. The README warning is minimal; operators bear full legal risk.
3. Budget blowup on large repos: The per-file fan-out at max_parallel=15 with capable models can be extremely expensive. budget_usd parameter is the only control.
4. Model availability coupling: The README examples use model names like gpt-5.3-codex and gpt-5.4-mini — if these models are deprecated or renamed, pipeline configuration breaks silently.
5. Single maintainer: 10 contributors but Eric Hartford appears to be the sole active maintainer. No governance structure visible.

Explicit Antipatterns

• Running against unauthorized targets
• Using without Docker for full pipeline functionality