Passing tests leave the mission question open
T3MP3ST's README says end-to-end swarm exploitation is unbenchmarked and still unreliable. Our successful repository run does not resolve that limitation. Security engineers can use this review to decide what to investigate in an authorized lab, but it provides no completed mission result.
The framework connects a coding agent or local model to security tools. Its documented interfaces include a browser War Room, CLI, HTTP API and MCP server. The README distinguishes components it labels stable from experimental operators and planned modules. Those labels describe upstream's assessment; we did not verify their operating reliability.
What happened when we ran it
We measured commit 29824d5 on November 6, 2026. Installation succeeded in 60 seconds, with 383 dependencies recorded and 293 MB on disk. Build succeeded in 18 seconds. The test command succeeded in 31 seconds, with Vitest reporting 988 passed and 0 failed out of 988.
The checkout contained 1,835 files, approximately 79,338 lines of source and 14 MB of repository data. The configured sandbox had 3 CPUs, 8 GB RAM and image lab-node:22. That label does not establish the actual Node or operating-system version, and these measurements do not describe the resources needed by a local model or a live assessment.
npm audit reported 26 known vulnerabilities: 1 critical, 10 high and 15 moderate, with none low. The supplied result does not identify affected packages or exposure, so it cannot establish exploitability or prescribe a remediation. Inspect the advisory paths for the revision and deployment you intend to use.
The scan found a Dockerfile, a Compose file and 1 CI workflow file. It found no standalone tests directory. The Vitest results establish that tests executed; the directory scan is not evidence of absent test coverage.
No agent connection, reconnaissance mission, verified finding or exploit execution accompanies these measurements.
The release checkpoint has explicit limits
The v1.0.0 release, released September 8, 2026, identifies source commit 29824d5625ede419ac8cdae418c8f4c72c6270f7. That matches the short commit recorded by our harness. The release describes deterministic certification checks and excludes optional live-provider, external Cybench corpus, PowerShell and hardware checks from those results.
Its statement about dependency updates with zero reported vulnerabilities belongs to that release report. Our November 6 audit reported 26. The packet does not establish the reason for the difference; the older statement cannot establish a clean audit for our run.
The release also states: Stop prevents new scheduling; requests and tools already in flight may finish. Treat Stop as a scheduling control with that documented limit. We did not test cancellation or independently verify the implementation.
Connecting an agent adds a separate trust decision
The README documents connecting an existing local coding agent through War Room settings. It also describes hosted-provider configuration and a local-model route. These are documentation examples, unexecuted in this review. Reusing an agent's authentication can avoid adding another API key, but it does not establish zero model cost or availability of every external security tool.
Claude Code session reuse is disabled by default. The README explains that a resumed session may retain provider-side context and ambient tool authority outside the Arsenal receipt boundary. It explicitly says the opt-in choice must not be treated as an Arsenal-enforced sandbox. Assess the connected agent's configuration as part of the execution environment.
Match the trial to what upstream claims
The README says its headline benchmark results came from a single agent, rather than the coordinated operator swarm. We did not reproduce those benchmarks. Recomputing verdicts from committed artifacts would also be a different exercise from rerunning the underlying workloads and validating findings.
Upstream labels live-cloud exploitation and dynamic-mobile exploitation as unbenchmarked. It describes white-box source analysis as experimental and some advanced modules as interface-only. If your required task depends on those paths, this review supplies no evidence that they are ready for it.
Issue 229, opened November 3, 2026, reports recovery returning failure or cancellation snapshots after a persistence write loses a compare-and-swap race. This is a reporter's reproduction, not a fault reproduced in our sandbox. It makes recovery a useful evaluation target; it does not establish that the measured release contains the reported fault.
We leave setup, documentation, community and maturity scores unassessed. The packet supports specific observations about commands and documentation, but not numerical ratings for operating quality. T3MP3ST uses AGPL-3.0; review the license before organizational integration.
Choose an alternative by the task
Nuclei uses YAML templates for vulnerability checks. Consider it when selecting explicit templates is the task you need to perform. PentestGPT documents saving and resuming penetration-testing sessions. Consider it when that session workflow fits your lab. Neither alternative was run here, so this is a workflow distinction without a comparative accuracy or reliability result.
For a first T3MP3ST trial, choose a small authorized target and retain the agent configuration, actual tool output and a finding another engineer can verify. Test recovery and the documented Stop behavior if your workflow depends on them. Those observations would answer questions the passing repository commands leave open.