infobyte/ai-pentest-agentStandalone autonomous AI pentest agent with a plan→act→judge loop, generic skills, destructive-action gate, and swappable LLM providers, plus a vulnerable API target for demos.
A small, standalone autonomous pentest agent, plus a purpose-built vulnerable target to run it against. Built to show, end to end, how an AI pentesting agent actually works — not a black box, just a plan→act→judge loop, a handful of generic skills, a gate that vetoes destructive actions, and a provider layer that swaps between a public model and a local one without touching anything else.
No frameworks, no magic. Every piece is plain Python you can read in a few minutes.
pentest-agent/ — the agent itself. Start here;
its README explains the architecture (orchestrator, gate, skills,
judge) in detail.vulntarget/ — a small, intentionally-vulnerable
e-commerce API (SQL injection, IDOR, JWT alg=none, business-logic
price tampering) to run the agent against. The agent isn't hardcoded
to it — it's also been run live against real-world labs — but it's
the fastest way to see it work end to end on your own machine.cd vulntarget
python3.13 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python app.py # serves on http://localhost:5000
In another terminal:
cd pentest-agent
python3.13 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env # fill in ANTHROPIC_API_KEY
python main.py --target http://localhost:5000 --model claude
Watch it reason, act, and get verified step by step in the terminal.
MIT — see LICENSE.
Gabriel Franco