Turn Claude Code into your offensive security research assistant
17 specialized AI subagents for every phase of authorized penetration testing, from scoping to reporting
pentest-ai turns Claude Code into a full offensive security research environment. Instead of one general-purpose assistant, you get specialized subagents, each an expert in a specific phase of penetration testing. Ask Claude anything security-related and it automatically routes your request to the right specialist. Whether you are scoping your first engagement or writing a final report, every response is mapped to MITRE ATT&CK and paired with defensive guidance.
Claude delegates to the right specialist based on your task. No manual agent selection needed. Just describe what you need.
Every technique is cross-referenced with ATT&CK IDs. Know exactly where each finding sits in the adversary framework.
Offensive methodology paired with defensive detection in every response. Attack and defend in a single workflow.
From explaining what Kerberoasting is to providing exact Impacket command syntax. Every agent meets you where you are.
Agents are simple Markdown files. No dependencies, no build tools, no lock-in. Fork, modify, and extend freely.
OSINT, planning, recon, exploitation, cloud, mobile, wireless, social engineering, forensics, compliance, and reporting.
17 specialists, each tuned for a distinct phase of the engagement lifecycle.
Plans penetration tests with phased methodology, MITRE ATT&CK mapping, and rules of engagement templates.
Open source intelligence gathering. Domain recon, email harvesting, social media profiling, breach data analysis.
Parses output from Nmap, Nessus, BloodHound, and 20+ tools. Prioritizes targets and maps CVEs.
Exploitation methodology covering AD attacks, web apps, cloud, and post-exploitation with defensive perspective.
Systematic Linux and Windows privilege escalation. SUID abuse, token impersonation, GTFOBins, and LOLBAS.
AWS, Azure, and GCP penetration testing. IAM privilege escalation, container escape, and cloud-native attack paths.
REST, GraphQL, and WebSocket testing. OWASP API Top 10, JWT attacks, OAuth exploitation, BOLA/BFLA testing.
Android and iOS app security. APK/IPA analysis, Frida hooking, SSL pinning bypass, OWASP MASTG/MASVS.
WiFi and Bluetooth penetration testing. WPA2/WPA3 attacks, evil twin, rogue AP, and BLE security.
Phishing campaigns, pretexting, vishing, and physical social engineering for authorized red team engagements.
Produces deployment-ready detection rules in Sigma, Splunk SPL, Elastic KQL with false positive tuning.
STRIDE/DREAD threat modeling, attack tree construction, data flow analysis, and architecture-specific threat enumeration.
Digital forensics and incident response. Memory forensics, disk analysis, timeline construction, evidence handling.
Binary analysis, reverse engineering, sandbox methodology, YARA rule writing, and IOC extraction.
DISA STIG compliance analysis with GPO remediation paths, risk scores, and keep-open justification templates.
Professional pentest reports with executive summaries, CVSS scoring, evidence formatting, and remediation roadmaps.
Methodical CTF challenge partner for HackTheBox, TryHackMe, and competitions. Web, pwn, rev, crypto, forensics.
Describe your task naturally. Claude routes to the right agent automatically.
$ claude You: Analyze this Nmap scan and prioritize targets for our internal pentest ▸ Routing to recon-advisor agent... ## Prioritized Target Summary ### Critical Priority (Exploit Immediately) | Host | Port | Service | Finding | |----------------|-------|----------------|----------------------------| | 10.10.1.5 | 445 | SMB | SMBv1 enabled, MS17-010 | | 10.10.1.20 | 3389 | RDP | BlueKeep (CVE-2019-0708) | ### High Priority (Investigate Next) | Host | Port | Service | Finding | |----------------|-------|----------------|----------------------------| | 10.10.1.100 | 88 | Kerberos | Domain Controller | | 10.10.1.15 | 1433 | MSSQL | sa login, weak password | ### Recommended Next Steps 1. Run: nmap -sV --script smb-vuln* 10.10.1.5 2. Run: crackmapexec smb 10.10.1.0/24 3. Enumerate AD: bloodhound-python -d corp.local
A natural pipeline from scoping through delivery. Each phase maps to a dedicated agent.
What changes when you add pentest-ai to your Claude Code workflow.
| Task | Without pentest-ai | With pentest-ai |
|---|---|---|
| Engagement scoping | Manual checklist, easy to miss items | Structured plan with RoE, scope boundaries, and methodology |
| Recon analysis | Read raw tool output yourself | Prioritized targets with attack surface mapping |
| Exploit research | Search CVE databases manually | Curated exploit chains mapped to ATT&CK with PoC guidance |
| Detection rules | Write Sigma/YARA from scratch | Deployment-ready rules with detection logic explained |
| STIG compliance | Cross-reference configs vs. PDF checklists | Automated check with fix commands and rationale |
| Reporting | Start from a blank document | Professional findings with CVSS, evidence, and remediation |
Common questions about pentest-ai.
Three commands. No dependencies. No build tools.
New to Claude? No problem. The setup guide walks you through creating an account, installing the CLI, and running your first agent in about 5 minutes.
git clone https://github.com/0xSteph/pentest-ai.git
cp pentest-ai/agents/*.md ~/.claude/agents/
mkdir -p .claude/agents/
cp pentest-ai/agents/*.md .claude/agents/
# Just describe your task naturally
"Plan an internal pentest for a mid-size company with Active Directory"
See INSTALL.md for detailed instructions and troubleshooting.