pentest-ai v1.4.0

Website · Quick start · Bug bounty · Verification · Documentation · Issues

Pentest-AI is an open-source AI penetration testing and bug-bounty tool that proves every finding. It connects an AI client or model to a real pentest workflow — investigating web applications, discovering and reproducing vulnerabilities, and using machine oracles to verify whether an exploit actually works. No proof, no finding: verified results carry evidence you can replay yourself.

Use it through MCP (Claude Code, Codex, Cursor, VS Code), from the CLI, or in CI/CD. The model drives the investigation; an independent oracle decides whether a finding earns a verified verdict — so the output is signal, not AI slop.

Built for authorized bug bounty: import a program's scope (HackerOne, Bugcrowd, Intigriti, YesWeHack), run a scope-enforced engagement, and turn each verified finding into a platform-ready submission. Jump to the bug-bounty workflow →

Test only systems you own or have explicit authorization to assess. Read the acceptable-use policy and terms before running an engagement.

Quick start

Recommended: Codex or Claude Code

Use Python 3.10–3.14 and install pipx first. Run pipx ensurepath and reopen your terminal if needed. pipx isolates Pentest-AI's dependencies and makes its commands available across folders.

pipx install ptai
ptai setup --mcp

Install your AI client's CLI first. Setup asks before connecting all detected supported clients, including both Codex and Claude Code when installed. It preserves existing registrations. Restart your client afterward.

The wizard uses user-wide settings. It does not install clients, sign you in, download models or configure Ollama. Your AI client supplies the model; no separate model API key is required by the MCP server. Use ptai setup --mcp --dry-run to preview changes. See single-client and per-repository setup for Codex .codex/config.toml and Claude Code .mcp.json instructions.

For upgrades, use pipx upgrade ptai. In an existing activated virtual environment, python -m pip install --upgrade ptai is also supported; keep that environment available after registering it with your AI client.

Alternative: Ollama and local models

Install Pentest-AI as above, but skip MCP setup for this route. Install and start Ollama, then pull a model with tool-calling support. Use ollama list to find its exact installed name.

export PENTEST_AI_LLM_PROVIDER=ollama
export PENTEST_AI_MODEL="your-installed-model"
ptai start https://your-authorized-target.example --no-sync

In PowerShell:

$env:PENTEST_AI_LLM_PROVIDER = "ollama"
$env:PENTEST_AI_MODEL = "your-installed-model"
ptai start https://your-authorized-target.example --no-sync

Replace the placeholders before running. A local model needs no cloud API key. Model quality and available memory affect results. See the model guide for endpoint configuration.

Try the bundled demo

No API key or external target required.

pipx install ptai
ptai demo

The demo tests a bundled vulnerable application, replays a finding from its proof capsule, and checks the hardened routes. Inspect the evidence workflow before configuring a real engagement.

Other model providers

For standalone cloud models and optional scanner dependencies, see the installation guide and provider guide. Keep API keys out of source control.

Bug-bounty automation

Pentest-AI is designed for authorized bug-bounty work, where staying in scope and submitting only reproducible findings are what matter.

# 1. Import the program's scope (HackerOne / Bugcrowd / Intigriti / YesWeHack)
ptai bounty import --platform hackerone --file scope.json --out program.scope

# 2. Run a scope-enforced engagement (a preflight shows exactly what will be
#    touched and asks you to confirm — nothing out of scope is ever hit)
ptai start acme.com --scope-file program.scope --intensity stealth

# 3. Turn verified findings into platform-ready submissions
ptai bounty report <engagement-id> --platform hackerone --out submissions/

• Scope is enforced, not advisory: wildcards, CIDRs and out-of-scope exclusions, fail-closed, on every agent and tool.
• Submissions are submittable: each includes a reproducible curl, CVSS/CWE, impact, remediation, and the machine verdict with a replayable proof capsule.
• Or run the built-in methodology playbook end-to-end: ptai playbook run bug-bounty-web -i target=acme.com --execute.

Full bug-bounty guide →

How verification works

1. Find a candidate. A probe or scanner identifies behaviour worth investigating.
2. Reproduce it and check a control. A named oracle repeats the exploit and compares it with a control that should not demonstrate the weakness.
3. Keep the evidence. A verified finding records the oracle and its results in a portable proof capsule. Use ptai replay to check it again.

For example, a trusted-header bypass must return privileged content with the attack header and deny access without it. A server that answers every request with HTTP 200 is not sufficient evidence.

The model cannot award a verified verdict. Third-party scanner output remains unverified until an oracle independently proves it. Findings without a supported verification recipe remain candidates.

A verified verdict applies to the tested conditions. It does not mean the entire application is secure. Proof capsules are unsigned; rerunning the check is the trust mechanism.

Read the verification design

What you can do

Workflow	What Pentest-AI provides
Investigate web applications	Probes for injection, access control, request handling and other application weaknesses
Run a bug-bounty engagement	Import program scope, enforce it, and generate platform-ready submissions (guide)
Work through an AI client	MCP tools for engagements, investigation and verification
Reproduce a finding	Oracle results and replayable proof capsules
Check a fix	Rerun the recorded check against the updated target
Report to your team	Reports and SARIF output for existing engineering workflows
Keep engagement data local	Findings stored on your machine in SQLite