🦄 Pownie
I vibe-hacked my way to Top #87 Global on Hack The Box. Hall of Fame. Built entirely on Claude Code.
Pownie is the harness that got me there, a Claude Code plugin that wires up persistent intel, lifecycle hooks, and multi-agent coordination for offensive security.
The model already knows how to hack. It doesn't need playbooks, it needs hands and legs that lets its knowledge compound over long engagements. That's what this is.
What it does:
- Hooks fire on every tool call — auto-extract credentials, log attempts, surface prior intel before the model repeats itself
- Neo4j intel graph stores everything the model discovers, outside the context window, where compaction can't reach it
- Attack class tracking kills entire categories of attack when evidence shows they're impossible on the target
- Multi-agent orchestration spawns parallel teammates after recon or shell access
- Context survival — PreCompact hook snapshots state to Neo4j before compaction wipes the window
It battle-tested across hundreds of HTB machines over 2 months. From #9000+ to Hall of Fame.
⚠️ Required MCP Servers
This plugin does not work standalone. It requires a specific MCP server stack to function. Don't worry, just run ./setup.sh and it builds and starts everything for you.
| MCP Server | Purpose | Required |
|---|
| mcp-kali | Kali Linux command execution, sessions, background tasks, proxy | Yes |
| neo4j-mcp | Knowledge graph for attack state, credentials, attempt tracking | Yes |
| playwright | Browser automation with headed Chromium + noVNC | Optional |
✨ What the Plugin Adds
| Component | What It Does |
|---|
| Intel Graph | Neo4j-backed knowledge graph — tracks targets, credentials, services, vulnerabilities, shells, and flags as structured data that survives context compaction |
| Pre/Post Hooks | Automatic tracing on every Kali MCP call — logs commands to Neo4j, extracts credentials and services from output, surfaces prior attempts before execution |
| Strategic Compaction | Context management for long offsec sessions — phase-aware compaction with Neo4j state preservation and rich recovery files |
| Multi-Agent Orchestration | Spawns parallel teammates after recon or shell access — CVE scouts, code analysts, system enumerators working concurrently |
| Debrief & Writeup | Post-challenge writeup generation with structured failure analysis and MEMORY.md updates |
🚀 Quick Start
Prerequisites
1. Clone and setup the stack
git clone https://github.com/d0gesec/pownie.git
cd pownie
./setup.sh
The setup wizard will:
- Ask which optional services to enable (browser, telemetry)
- Detect container name conflicts and offer alternatives
- Generate
docker-compose.yml, .mcp.json, and .claude/settings.local.json
- Build Docker images and start the stack
- Wait for Neo4j to be healthy
2. Install the plugin
Option A — Marketplace install:
/plugin marketplace add d0gesec/pownie
/plugin install pownie@d0gesec
Option B — Direct from cloned repo:
claude --plugin-dir ./pownie
3. Start hacking
The plugin activates automatically. Skills like the intel graph and strategic compaction work in the background. User-invocable skills:
/pownie:offsec-debrief — generate writeup after completing a challenge
🎯 Basic Workflow
1. Give it a target
Tell Claude the ctf target and the goal. That's it.
CTF target's IP 10.10.11.42. Capture the user flag.
The plugin handles the rest in the background — hooks fire on every tool call, credentials get extracted automatically, attempts get logged, and the intel graph builds itself as the model works.
2. Spawn teammates for layered attacks
After the initial enumeration, kick off the orchestrator to throw multiple approaches at the target in parallel.
/pownie:offsec-lead
This triggers the offsec-lead skill, which spawns 2-3 parallel Agent teammates for CVE scouts, code analysts, system enumerators, each bootstrapping from the same Neo4j intel graph. Same credentials, same disproven attack classes, no duplicate work.
Note: Multi-agent coordination is currently experimental and disabled by default. I usually engage it after the enum stage when there are multiple attack surfaces to explore concurrently.
3. Debrief
After capturing flags, generate a structured writeup with failure analysis.
