pensarai/apexAI-powered offensive security testing using autonomous agents, directly in your terminal.
AI-powered penetration testing using autonomous agents — directly in your terminal. Run blackbox and whitebox pentests that explore, reason, and surface real vulnerabilities.
Want to run from the cloud or integrate it with your CI/CD? See Pensar Console.
/pentest before merging a PR — catch vulnerabilities as naturally as running tests/operator mode for manual investigation, exploit chaining, and validation| Method | Command |
|---|---|
| Quick Install (macOS/Linux) | curl -fsSL https://pensarai.com/install.sh | bash |
| Homebrew | brew tap pensarai/tap && brew install apex |
| npm | npm install -g @pensar/apex |
| Windows (PowerShell) | irm https://www.pensarai.com/apex.ps1 | iex |
Open the Apex TUI:
pensar
Apex automatically reports its state when launched inside
Herdr. The sidebar shows working
during a turn, blocked when approval, plan review, or answers are needed, and
idle when Apex is ready for input. Terminal-attached CLI agent commands also
report their activity. No plugin or additional Apex configuration is required.
Herdr 0.9.2 or later can restore the current conversation after a server restart.
Keep pensar on your PATH; Apex supplies a resume command with the session ID,
active model, and obfuscation setting. The saved session restores its operator
mode and approval settings. Restored sessions wait for your next prompt.
You can also reopen a session directly:
pensar --resume <session-id>
pensar --resume <session-id> --model <model-id>
State reporting and release also work with older Herdr versions. Reports run in the background with a short timeout, and Herdr failures do not interrupt Apex.
Run pentests without the TUI for scripting, CI, or evalgate integration:
# Basic pentest
pensar pentest --target https://example.com
# With extended thinking and task-driven mode
pensar pentest --target https://example.com --extended-thinking --task-driven
# Whitebox (with source code access)
pensar pentest --target https://example.com --cwd ./my-app
# Targeted pentest with specific objectives
pensar targeted-pentest --target https://example.com --objective "Test authentication bypass"
| Flag | Command | Description |
|---|---|---|
--target <url> | pentest, targeted-pentest | Target URL (required) |
--cwd <path> | pentest | Source code path for whitebox mode |
--mode <mode> | pentest | exfil for pivoting and flag extraction |
--model <model> | pentest, targeted-pentest | AI model (default: auto-selected) |
--extended-thinking | pentest | Enable extended thinking for supported models |
--task-driven | pentest | Enable task-driven architecture (experimental) |
--prompt <text|@file> | pentest | Custom guidance for the agent |
--threat-model <text|@file> | pentest | Threat model to guide testing |
--objective <text> | targeted-pentest | Testing objective (repeatable) |
Start Ollama with a model installed, then open /models and select it under
Ollama (local). Apex discovers models automatically at startup and refreshes
the list every five seconds, including when Ollama starts after Apex. No API key
or manual endpoint setup is needed. Running models appear first.
Discovery uses http://127.0.0.1:11434 by default and honors OLLAMA_HOST.
Headless commands accept --model-provider ollama --model <ollama-model-name>
or --model ollama:<ollama-model-name>. Model names retain their full tags,
including Hugging Face paths. Existing manual local endpoints remain separate.
Apex loads the selected model on the first request if needed, showing Loading model weights with a dedicated throbber. It then reads Ollama's allocated context before fitting the prompt or deciding whether to compact the conversation. Servers without context metadata use a conservative 4,096-token budget. Apex does not download models or override Ollama's idle-unload settings; model lifetime is managed by Ollama, independently of Apex sessions. Agent workflows require a model and Ollama template that support tool calls; discovery alone does not establish tool support.
Connect Hoonify in /providers or set HOONIFY_API_KEY, then select a
discovered model in /models. Headless commands accept
--model-provider hoonify --model <catalog-model-id>. See
Hoonify setup for model discovery, token budgets, and live checks.
Connect Inference.net in /providers or set INFERENCE_API_KEY, then select
DeepSeek V4.1 Flash 1017 Cyber in /models. This is the only Inference.net model
currently available in Apex. Headless commands accept
--model inference:deepseek-v4.1-flash-1017-cyber.
Your team needs approved model access before inference will succeed; saving a valid API key does not grant model access. Apex uses the provider's default reasoning behavior and the catalog limits of 1,040,000 context tokens and 393,216 output tokens.