AI-native penetration testing IDE where operators and an AI agent share browser, terminals, traffic capture, shells, asset graph, tasks, and evidence in one project workspace.
An AI-native penetration testing workbench where you and AI agents work together to accelerate your pentest workflow.
Hexestra aims to make penetration testing smoother for you and your agent. To do that, we've built a harness designed for penetration testing:
Workbench overview: assets, actions, agent chat, and NetMap together.
Inspect requests and responses, then replay them, save evidence, or ask the agent.
Record keeps findings, evidence, and vulnerabilities available in a new conversation.
See completed steps, current progress, and what's next in the task tree.
NetMap links the application, endpoints, and identity.
Bind project rules to the relevant ATT&CK tasks.
Document refinery example: rules, skills, and workflows ready for review.
These screenshots are from the app using a fictional local lab. Some chat and record content is demo data.
Hexestra is designed to fit your existing workflow, with lightweight and flexible customization. We're also considering a plugin system for the future.
The user guide walks you through your first assessment.
Requires Node.js 24 and npm. Traffic capture in source runs also needs mitmdump; see the user guide.
npm ci
npm run electron:dev
User guide · Architecture · Agent runtime · Contributing · Changelog
Not sure which document to read? See the documentation index.
Have a feature in mind? Open an issue.
Hexestra is licensed under Apache 2.0. If it makes your pentest workflow more efficient, consider starring the repository.