The source dashboard failed before an engagement could prove anything
Decepticon's web workspace failed to build in 32 seconds in our sandbox. That's an awkward first encounter with a system intended to coordinate security engagements, but it identifies a useful boundary: source-build readiness and attack effectiveness need separate evidence. The project supplies autonomous agents for authorized red-team work, with planning documents and persistent interactive shells. I'd evaluate it as infrastructure for an experienced operator who can inspect the commands and findings.
The English README advertises a Docker-backed launcher, a Python SDK, and a hosted commercial app. Our npm run added 1615 packages and occupied 1490 MB. That result belongs to the source workspaces, not the commercial service or a verified Docker engagement. A working demo of one route would not clear the failure in another. Choose your intended deployment path before deciding what evidence of readiness you need.
What happened when we ran it
Our run installed Decepticon commit db0e726 in 78 seconds, then the build failed with exit code 1 after 32 seconds. We used a fresh Debian container on October 10, 2026, with 3 CPUs, 8 GB of RAM, and image lab-node:22, without secrets or elevated privileges. The checkout held 8000 files, roughly 1022472 source lines, and 1521.7 MB before installation. This is a substantial repository to investigate when a setup step breaks.
The failure tail points to Next.js module-resolution errors at clients/web/src/lib/prisma.ts:6:1 and clients/web/src/hooks/useRunObserver.ts:21:1. Npm identifies web@0.0.0 and the command next build. The excerpt doesn't name the missing modules or establish the cause. Although the dashboard documentation describes generating a Prisma client, it would be speculation to declare that the fix. The defensible finding is that the web workspace did not build through our measured route.
Tests were skipped because the selected path exposed no test script or target. A tests directory was present, alongside monorepo workspaces, a compose file, and 9 CI workflow files. The scan reported no Dockerfile. That scan result should stay separate from the documented container deployment. Npm audit reported 46 known vulnerabilities: 4 critical, 24 high, 11 moderate, and 7 low. The supplied summary neither identifies their dependency paths nor proves that deployed services expose them.
Docker services remain necessary behind the Python SDK
The getting-started guide requires a container runtime and a model-provider credential or local model endpoint. Onboarding writes configuration to ~/.decepticon/.env, and the launcher starts the management services plus the sandbox. LiteLLM handles model routing, PostgreSQL stores application data, and Neo4j holds findings and relationships. You also have LangGraph orchestration to operate. The short installer command introduces a service stack with data that survives an engagement.
Our 1490 MB npm footprint doesn't price the container images, database volumes, or a local model. The Python package is a client SDK whose calls still need model and sandbox services. Installing it alone won't create an independent assessment environment. Likewise, Claude Code and other coding agents can connect through MCP, but Decepticon must already be running. The external-agent guide is the relevant route if you want to keep an existing coding interface.
The sandbox boundary includes Docker socket access
The architecture document separates the management and operational networks. LangGraph drives the Kali sandbox through the Docker socket, while a shared Neo4j store connects to both networks. That is a concrete deployment dependency. If your host policy forbids mounting the Docker socket into an application service, this architecture conflicts with it before you get to model selection or the quality of generated findings.
Persistent tmux sessions let an agent send follow-up input to interactive tools instead of treating each command as an isolated process. That's useful when a security workflow requires an ongoing shell. It also makes operator visibility worth evaluating directly. The 3-CPU, 8-GB sandbox result establishes no containment guarantee for the documented runtime: our npm checks didn't exercise those networks or prove that autonomous commands respected an engagement's scope.
Generated plans still require an operator's approval
The first-engagement instructions have Soundwave interview the operator, write scope and handling documents, and hand an operational plan over for review and approval. Those steps suit someone who already knows the permitted targets and exclusions. I'd walk away if I only needed a web vulnerability scan: the interactive shells and exploitation workflow add operating responsibility. ZAP is the narrower alternative for that job, while Strix and PentestGPT deserve comparison for different agent-driven assessment workflows.
After a 78-second install, our source build stopped before we could treat its dashboard as ready. The dashboard guide makes that interface optional and starts it on demand from the CLI. It also documents Prisma migrations and client generation for source changes. Separately, the README describes the attack-to-defense verification loop as planned. Buyers who need that complete loop today should not convert the description into a shipped capability.
October maintenance doesn't close the original empty-response question
The last push was October 10, 2026, and v1.2.5 shipped on October 8 with optional, lazy Skillogy retrieval. GitHub returned 5796 stars and 5 open issues and PRs. Recent activity includes issue 875, an empty-response report, and a related diagnostics fix. The maintainer's comment explicitly says that improving error classification doesn't establish the original cause. The issue is now closed, so closure alone is weak evidence that the reported symptom was repaired.
Decepticon earns a controlled evaluation by operators who want its engagement workflow and can support the service stack. I wouldn't make this source revision a required dashboard build in a delivery pipeline: our build failed, tests were skipped, and 46 dependency advisories need investigation. The next acceptance result should show your chosen deployment reaching a reviewed plan, executing an authorized objective, and preserving evidence you can inspect.