Run on your own hardware

Pentest-AI is an open-source CLI and MCP server. It tests your applications from your machine and stores findings in local SQLite.

Choose how to run

Connect Codex or Claude Code, use a local Ollama model, or run deterministic checks without a model.

pipx install ptai
ptai demo

Install pipx first. The demo uses a bundled vulnerable app. You do not need an API key or an external target.

Installation guide ↗

How a finding earns verification

A scanner result starts as a candidate. Pentest-AI reruns the exploit and checks a control before marking it verified.

Reproduce the exploit

Confirm the reported behaviour in repeated runs.

Check the control

Distinguish the weakness from safe behaviour.

Keep the evidence

Record the oracle and runs behind the verdict.

What happens to scanner results?

Third-party scanner results remain unverified until an oracle independently proves them. Multi-step attack chains are checked hop by hop.

Explore the evidence →

Web application coverage

Checks cover injection, access control, request handling and other application weaknesses. Browser-based probes can render single-page applications and inspect JavaScript bundles for routes.

Checks include

SQL injection, stored and reflected XSS
BOLA / IDOR, mass assignment, JWT alg:none
SSRF, XXE, path traversal and open redirects
Trusted headers, host-header poisoning, type confusion

Blind vulnerabilities and authenticated applications

Out-of-band checks use an opt-in Interactsh collaborator or a self-hosted loopback for blind SSRF, SQL injection and XXE. SPA-aware probes can sign in and follow application behavior in Chromium.

Inspect the implementation ↗

Your AI. One connection.

Use Pentest-AI with Codex, Claude Code, or your terminal.

Connect through MCP

Install pipx and your AI client first. Setup asks before connecting all detected supported clients, including Codex and Claude Code.

pipx install ptai
ptai setup --mcp

Local models and CI

Run the CLI with Ollama or your own API key. Export verified findings as SARIF for your build pipeline.

Client setup and local models

Install the Codex or Claude Code CLI before setup, then restart your client. For Ollama, set PENTEST_AI_LLM_PROVIDER=ollama and PENTEST_AI_MODEL to an installed tool-capable model. The --no-llm option runs deterministic checks.

Client and model setup guide ↗

Replayable evidence

Keep the evidence needed to reproduce a verified finding.

Share the proof

Attach the proof capsule to an issue so the person fixing it can rerun the check.

Check the fix

Run ptai replay after a fix to check whether the weakness still reproduces. Keep the capsule with the issue, and use SARIF to bring verified findings into code scanning.

What does a verified verdict mean?

It records that a particular oracle reproduced the finding under the tested conditions. It does not establish that an application is free of other vulnerabilities or replace investigation of the result.

Replay documentation ↗

Tested against controls

The published project benchmarks cover 14 vulnerability classes and 21 oracles. Its reported Juice Shop run produced 12 oracle-verified findings, each replayable.

3 repeated runs: Required for the reported verification result.
Clean-application gate: CI checks that safe targets do not earn verified findings.

These are project benchmarks under specific test conditions, not a guarantee of field detection rates or zero false positives.

Review the tests and source ↗