Add Dark-Moon (open source autonomous AI DAST)

[Dark-Moon-X]

Adds Dark-Moon, an open source (GPL-3.0) autonomous AI penetration testing tool for web, Active Directory, Kubernetes and API, with proof of exploitation on every finding and a local Privacy Gateway so the model never sees real IPs, hosts or credentials. Repo https://github.com/ASCIT31/Dark-Moon , site https://dark-moon.org

[mre]

Reopening this: the stale bot closed it without a review. Thanks for the submission, and sorry it went unanswered. The project now meets our published maturity criteria, and its live-target security testing is a good fit for the catalog.

A few concrete changes are needed in data/tools/dark-moon.yml:

• Replace categories: [dast] with categories: [linter]. The current schema does not have a dast category; security is already an appropriate tag.
• Remove the kubernetes tag unless you also add a definition to data/tags.yml. The existing security, api, and web tags are valid.
• Please narrow the description rather than promising proof of exploitation on every finding or guaranteeing that the model never sees sensitive data. For example:

Self-hosted AI-assisted penetration-testing platform that orchestrates security tools against live web, API, Active Directory and Kubernetes targets. Runs tools in Docker through MCP and collects command output and findings. Supports local or cloud LLMs and configurable local tokenization of sensitive data.

Please keep features exclusive to the Pro edition separate from the description of the open-source core. We have just added CI checks; the renderer should help catch the category and tag issues, while the contribution checker assesses repository maturity separately.