n8n-nodes-darkmoon

📦 Marketplace status: Published on npm — installable as a community node today. n8n verified-community-node submission pending review.

An n8n community node + trigger for Darkmoon,
the autonomous AI pentest platform. Launch pentest campaigns, read findings, run
retests, pull security-posture metrics, manage webhooks — and start workflows the
moment Darkmoon confirms a finding, completes a campaign, or opens a fix pull request.

Use it as SOAR glue: exploited finding → Slack/Jira/DefectDojo, remediation PR
merged → auto-retest → post verdict, nightly scan → posture digest.

⭐ Darkmoon ecosystem

Darkmoon is open-source — a star really helps us grow.

🌐 Website: dark-moon.org · 📚 Docs: docs.dark-moon.org · ⭐ Star the core: github.com/ASCIT31/Dark-Moon

Install the integrations, right where you work:

Screenshots

Captured from a real n8n (n8nio/n8n) running this node in Docker against a
synthetic Demo Shop campaign (zeroed secrets).

The node on a canvas	The operation picker

The trigger configuration	A template running

Installation

In n8n: Settings → Community Nodes → Install, then enter:

n8n-nodes-darkmoon

Or self-host with npm:

npm install n8n-nodes-darkmoon

The package is dependency-free at runtime (the shared Darkmoon client is bundled
at build time) and published with npm provenance from GitHub Actions.

Compatibility: n8n >= 1.60, Node >= 20.15. n8nNodesApiVersion: 1. Tested
against n8n 2.40.x.

Credentials — Darkmoon API

Create a Darkmoon API credential:

The Test button calls GET /api/v1/system/info to confirm the Base URL points at
a real Darkmoon API and reports its edition + contract version.

Networked deployments: Darkmoon's write endpoints (run/*, retest/*,
webhooks/*) are destructive. Set DARKMOON_REQUIRE_AUTH_WRITES=1 on the Pro API
and use a scoped token for any workflow that can launch campaigns or retests.

The Darkmoon node (actions)

Remediation

On Campaign → Launch, enable Remediation to let Darkmoon try to fix confirmed
issues and open a pull request for a human to review (it never merges). It requires
an opaque credential reference — a Darkmoon vault ID, not a token; no SCM secret
ever travels through the workflow.

The Darkmoon Trigger node

Starts a workflow on Darkmoon events, with an event-type filter
(campaign.* / finding.* / pr.*). Two modes:

• Poll (recommended) — a polling trigger that reproduces the event taxonomy with a
  cloud-safe synthetic poll-and-diff. It reads campaigns / findings / pull-requests
  each poll, diffs them against a durable cursor kept in the workflow static data
  (exactly-once), and works behind NAT. First activation only primes the cursor (no
  historical replay storm).
• Webhook — registers a Darkmoon Pro webhook that POSTs signed events straight
  to this node; the X-Darkmoon-Signature HMAC is verified before the workflow runs.

Templates

Four importable workflows in templates/ (n8n → Import from File):

Each references a Darkmoon API credential and any third-party credentials (Slack,
DefectDojo) — set them via n8n credentials, never $env.

Redaction & the OSS / Pro boundary (stated honestly)

• Evidence is never emitted. Findings are returned with evidence: null; the
  internal raw mirror is dropped and the output is scrubbed for secrets. To see that
  evidence exists, use Get Evidence Metadata — counts only, never content.
• Secrets never travel or log. SCM credentials are opaque vault references; tokens
  live only in n8n's encrypted credential store.
• This node targets Darkmoon Pro (the networked REST API). The web dashboard, SSE
  event stream, scheduler and remediation → PR are Pro-only capabilities and are not
  open source. The open-source Darkmoon core is the CLI + agents; a co-located OSS
  install without the Pro API is not addressable by a networked automation host like n8n.
• The node reuses the shared @darkmoon_ai/client contract (its normalizers,
  redaction and verdict helpers) so its data model can never drift from the rest of the
  Darkmoon ecosystem. Transport uses n8n's own HTTP helper, per community-node rules.

Testing it yourself (real Docker n8n)

docker compose -f docker/docker-compose.yml up -d      # n8n + a mock Darkmoon API
# open http://localhost:5678 , add a Darkmoon API credential
#   Base URL: http://mock-darkmoon:8000 , any token
# import a template from /home/node/templates , run it

Local checks:

npm ci
npm run lint          # eslint-plugin-n8n-nodes-base
npm run build         # tsc + esbuild bundle + icons
npm test              # drives the built nodes against the mock; asserts no secret leak

License

MIT © ASC-IT (SARL) — Darkmoon