pentest-ai

Autonomous pentests from one command. Real tools, working PoCs, audit-ready reports.

Website · Install · Docs · Benchmarks · Agents · Discord

⚠️ Offensive tooling, authorized testing only. By installing you accept the AUP and Terms. Full text in Responsible use ↓

Point ptai at a target. It runs recon, logs in, and ties findings into multi-step attack paths. Every finding comes with a working PoC. The report writes itself.

Runs on your laptop. No cloud, no telemetry.

What's new in 0.15.1 (2026-05-16). Three new flags for pointing ptai at real production targets without breaking the engagement rules. intensity=safe skips probes that mutate server state (no mass-assignment, no stored XSS, no race conditions). respect_rate_limits=true honors HTTP 429 and Retry-After instead of hammering through them. strict_scope=true refuses any request whose host doesn't match the engagement target, and turns off redirect-following so a 302 to attacker.com can't pull the scan off-target. All three default off - existing 0.14.x behavior is unchanged unless you opt in. There's also a working bearer auth flow now: POST your creds, ptai pulls the JWT out of a JSON path you configure, then attaches it to every probe. JWT-style APIs (Juice Shop, crAPI, most modern bug-bounty stacks) actually work. Measured: 63.24% catch rate (43/68 in-scope challenges) on OWASP Juice Shop v19.2.1 with intensity=aggressive + strict_scope=true. See CHANGELOG.

Also in 0.14.0 (2026-05-13): 200+ wrapped security tools (wpscan, dalfox, hydra, hashcat, paramspider, ffuf, gobuster, sqlmap, ...) are reachable from Claude Code, Cursor, Codex, and any MCP client via list_tools, run_tool, plan_tools, ensure_tools_installed. No Anthropic API key required. Pick a tool, install missing ones in one batched prompt, run, get findings.

See it run

One prompt to Claude Code. The MCP server ran ptai's tools against the target, and Claude streamed findings back into the session. Subscription-driven, no API key.

The scan returned 17 critical, 53 high, 107 total findings, 7 confirmed attack chains, and 264 generated detection rules against a stock OWASP Juice Shop instance. JWT alg:none accepted on 8+ protected endpoints, SQLi auth bypass on /rest/user/login, UNION-based SQLi on /rest/products/search, path-filter bypass via NUL byte, XXE disclosing /etc/passwd, file upload polyglot, mass assignment, password reset bypass. Each one has a working PoC.

Recording is the actual output of claude -p against a local

... View full README on GitHub