pentest-ai

MCP server + 10 AI agents + 150+ security tools. One command.

Website · Quick Start · Agents · 150+ Tools · Claude Code Agents

pentest-ai connects AI to 150+ real security tools through the Model Context Protocol. It works with Claude Desktop, Cursor, VS Code Copilot, Windsurf, or any MCP-compatible client.

Point it at a target. It runs recon, finds vulnerabilities, chains them into full compromise paths, validates every finding with a working proof of concept, and generates professional reports with detection rules for your blue team.

No vendor lock-in. No cloud dependency. Runs locally.

How It Works

You: "Run a full assessment against staging.example.com"

pentest-ai:
  1. Recon       > nmap, subfinder, amass, DNS enum, OSINT
  2. Web scan    > nuclei, sqlmap, nikto, ffuf, dalfox
  3. Cloud audit > prowler, ScoutSuite, pacu
  4. AD attack   > BloodHound, Impacket, CrackMapExec
  5. Chaining    > Links 3 medium findings into domain admin
  6. Validation  > Generates safe PoC for each finding
  7. Detection   > Sigma + SPL + KQL rules for every attack
  8. Report      > Professional markdown/HTML/PDF with CVSS scores

Quick Start

pip install -e .
pentest-ai start target.example.com

That starts the MCP server. Connect from your AI client and start talking to it.

Connect to Claude Desktop

Add this to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "pentest-ai": {
      "command": "pentest-ai",
      "args": ["server", "start"]
    }
  }
}

Connect to Cursor / VS Code Copilot

Add the same MCP server config in your editor's settings. Any client that speaks MCP will work.

Agents

10 specialist agents, each focused on a specific attack surface.

Every agent stores findings in a local SQLite database. Findings persist across sessions and feed into the chaining engine.

Tools

158 security tools organized into 6 categories. pentest-ai wraps each tool with structured output parsing so findings flow directly into the database.

Built-in Scanners (Zero Dependencies)

Don't have nmap installed? pentest-ai includes built-in scanners that work immediately:

• Port scanner (async TCP connect)
• HTTP header analyzer (missing security headers, CORS, cookies)
• SSL/TLS checker (expiry, weak ciphers, deprecated protocols)
• Path discovery (admin panels, backups, .env files, .git exposure)
• DNS enumerator (A records, subdomain brute-force)
• Secret scanner (AWS keys, GitHub tokens, JWTs, connection strings in responses)

# Works with zero external tools installed
pentest-ai start target.example.com --scope recon

Exploit Chaining

Most scanners give you a list of isolated findings. pentest-ai connects them.

Example: 5 medium-severity findings individually look minor. The chaining engine discovers they connect into a path from unauthenticated user to domain admin.

SSRF in /api/internal > Read cloud metadata > AWS keys
  > Lateral move to staging DB > Extract AD service account creds
    > Kerberoast > Crack hash > Domain Admin

Each chain is validated with a working PoC before it shows up in your report.

Architecture

pentest-ai/
├── mcp_server/       # FastMCP server, exposes all tools via MCP protocol
├── agents/           # 10 specialist Python agents
├── tools/            # 158 tool wrappers with output parsers
├── engine/           # Orchestrator + findings DB + built-in scanners
├── cli/              # CLI interface (Typer + Rich)
├── config/           # YAML config
└── tests/            # Test suite

Configuration

# config/pentest-ai.yaml
llm:
  provider: openai        # or anthropic, ollama
  model: gpt-4o
  temperature: 0.0

agent:
  auto_chain: true
  auto_validate_pocs: true
  auto_generate_detections: true
  hitl_mode: true          # Human approval before exploitation

scope:
  allowed_targets: []
  excluded_targets: []
  max_depth: 3

MCP Tools Reference

Claude Code Agents

Looking for the Claude Code version? pentest-ai-agents has 28 specialized Claude Code subagents for penetration testing. No server, no dependencies. Copy .md files into Claude Code and go.

Requirements

• Python 3.10+
• An MCP-compatible AI client (Claude Desktop, Cursor, VS Code Copilot, etc.)
• Security tools you want to use (optional, built-in scanners work without any)

Development

git clone https://github.com/0xSteph/pentest-ai.git
cd pentest-ai
pip install -e ".[dev]"
pytest tests/ -v

FAQ

Does this replace manual pentesting? No. It accelerates it. The agents handle recon, scanning, and correlation. You make the decisions about what to exploit and how deep to go. Human-in-the-loop is on by default.

Is my data sent to the cloud? No. Everything runs locally. The only external calls are to whatever LLM provider you configure (OpenAI, Anthropic, or a local model via Ollama).

Can I add my own tools? Yes. Add a SecurityTool entry in tools/registry.py with a command template and output parser. The tool is immediately available through the MCP server.

What about false positives? The PoC validator generates a safe proof of concept for every finding. If the PoC fails, the finding is flagged as unconfirmed. Only validated findings appear in the final report.

Legal

This tool is for authorized security testing only. Always get written permission before testing any system you don't own. See LICENSE for the MIT license.

Built by 0xSteph · pentestai.xyz · Claude Code Agents