pentest-ai
Active·★ 1.8k·MIT·Updated 2026-10-09
Pentest-ai is an autonomous penetration testing tool that runs reconnaissance, authenticated scanning, vulnerability chaining, PoC validation, detection rule generation, and report generation from a single command. It supports multiple LLM providers including Claude, OpenAI, and Ollama, and can be used locally, in CI/CD pipelines, or as an MCP server.
#ai-security#bug-bounty#claude#ctf#cybersecurity#exploit#exploit-chaining#hacking-tools
01
Features
01Autonomous multi-agent architecture
02Authenticated scanning with session handling
03Proof-of-concept validation for every finding
04CI-native with SARIF, GitHub Actions, GitLab CI
05Works with multiple LLM providers (Claude, OpenAI, Ollama) or fully local
02
Compatibility
Linux
Linux
Verified via docs
macOS
macOS
Verified via docs
Windows
Windows
Verified via docs
03
Quick start
1
$ pip install ptai
04
Use cases
↳AppSec teams – automated CI scanning of every PR
↳Penetration testers / consultants – speed up engagement scope and reporting
↳Bug bounty hunters – automated reconnaissance and validated findings
05
Alternatives
McpVanguard★ 13
An open-source security proxy and active firewall for the Model Context Protocol (MCP). It acts as a real-time 'Reflex System' between AI agents and their tools, protecting the host system from malicious intent, prompt injection, and data exfiltration.
mcp-virustotal★ 152
MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.
mcp-shodan★ 179
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
claude-code-pentest★ 31
Automate the full pentest process with six Claude Code skills covering recon, exploit chains, and bug bounty report generation from any domain.
redamon★ 3.2k
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.
red-team-blue-team-agent-fabric★ 32
466 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, 5 DOIs. v4.3.0
Comments
Log in to leave a comment
No comments yet. Be the first!