0xSteph/pentest-ai

pip install ptai
ptai setup --mcp   # auto-writes config for all MCP clients found
ptai setup --tier recommended   # batch-install wrapped security tools

Usage

• •claude mcp add pentest-ai -- ptai mcp # drive from Claude Code, no API key
• •ptai start https://your-target.com # standalone CLI (needs ANTHROPIC/OPENAI key or Ollama)
• •ptai demo # bundled vulnerable app, 2-minute self-contained demo
• •ptai replay # re-prove a portable proof capsule; ptai resume <engagement_id> after a cost cap

Key features

• ✓Every VERIFIED finding comes from a machine oracle (SQLi, BOLA/IDOR, XSS, XXE, SSRF, JWT alg:none, IDOR, mass assignment, etc.), never an LLM assertion; verdicts that cannot name an oracle are rejected
• ✓47 MCP tools (list_tools/run_tool over 200+ wrapped security tools, plan_tools/ensure_tools_installed for batch install, list_probes/run_probe over 60 SPA-aware OWASP Top 10 probes, http_request under a hard scope guard)
• ✓17 agents across recon, web, API security, AD, cloud, mobile, wireless, browser, credential testing, privesc, vuln scanning, exploit chaining, PoC validation, detection, reporting, LLM red team, social engineering
• ✓Detects via curated probes and logs in (session holding, credential refresh, auth profiles store references not values); scoped, non-destructive PoCs; portable proof capsules
• ✓CI-native: GitHub Action, severity gates, SARIF/JUnit output, PR comments; YAML playbooks; 6 report formats (md/html/pdf/SARIF/JUnit/compliance maps); HITL teleoperation via Ctrl+C twice

Best for

Authenticated web/API pentests and bug bounty work where findings must be independently re-proven (SPA-focused), plus CI security gates that fail builds only on verified findings.

Caveats

• ⚠Offensive tooling — authorized testing only; installing accepts the Acceptable Use Policy (pentestai.xyz/aup) and Terms; first run prompts AUP consent
• ⚠MCP path needs no API key; standalone CLI path does (Anthropic/OpenAI/Ollama/LiteLLM) and caps LLM spend at $10/engagement by default (PTAI_PRICE_LIMIT)
• ⚠Detects only what the curated probe library covers (~60 web probes, growing); Juice Shop numbers are a head start, honeypot numbers are the honest signal
• ⚠OAST blind-vuln detection routes callbacks to ProjectDiscovery's public oast.fun by default — payload contents encrypted to a local keypair, but metadata (interaction fact, source IP, timestamp) is server-visible; self-host Interactsh or use --no-oast
• ⚠Guardrails (intensity=safe, respect_rate_limits, strict_scope) all default off — must be turned on; 'production' only with written authorization