BugTraceAI/BugTraceAI

Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.

BugTraceAI – AI‑augmented, self‑hosted web‑pentesting suite

What it is – An open‑source collection of four interoperable components that let you run autonomous web and API security assessments on your own hardware. The suite couples large‑language‑model (LLM) reasoning (via configurable providers such as OpenRouter, Anthropic, Z.ai, Bedrock, Ollama) with deterministic security tools. The AI agents plan, prioritize and interpret findings; the tools execute the checks and produce evidence that the UI (CLI TUI or web dashboard) displays as a structured report.

Core components

Component Role Typical deployment
BugTraceAI‑CLI Terminal‑based, agentic scanner; exposes a REST/MCP API; stores scan metadata in SQLite. Local Python 3.10+ or Docker container.
BugTraceAI‑WEB Browser UI with 20+ AI‑powered security tools, live scan monitoring, chat, and a ModelLab for benchmark‑ing LLMs. Docker (PostgreSQL backend) or local install.
BugTraceAI‑API Stand‑alone service that performs contract‑aware API discovery and evidence‑first testing. Docker or local Python service exposing REST/MCP.
BugTraceAI‑Launcher Guided installer that can provision any combination of the above, set up ports, create a global btai command, and run an optional AI‑assistant wizard. One‑liner script (`curl …
reconftw‑mcp Extensible “Model Context Protocol” plug‑in framework; ships with Kali Linux and ReconFTW agents that the scanner can call.
BugStore Deliberately vulnerable demo application (32 OWASP flaws) used for tutorials and sample reports.
BugTraceAI Models Published checkpoint families (CORE‑Fast, CORE‑Pro, CORE‑Ultra, Apex) tuned for bug‑bounty and pentesting workflows; hosted on HuggingFace.

How it works (high‑level architecture)

CLI TUI  →  Scan Engine  ←→  Specialist tools & browser validation
               │
               └─►  SQLite (metadata) & disk reports
WEB UI  →  REST API (exposed by CLI)  →  Scan Engine
API Service  →  REST/MCP  →  Scan Engine
Launcher  →  orchestrates services, ports, and optional global command
  • The engine runs a six‑phase pipeline (Recon → Discovery → Strategy → Exploit → Validate → Report).
  • AI agents decide which specialist tools to invoke at each phase and synthesize the evidence into human‑readable findings.
  • All data stays on‑premises; you supply the LLM provider key, keeping the workflow privacy‑first.

Quick start (one‑command install)

curl -fsSL https://raw.githubusercontent.com/BugTraceAI/BugTraceAI-Launcher/main/install.sh | bash
  • The installer presents a TUI menu where you pick a profile (terminal, web, full, etc.).
  • After selecting a profile it walks you through provider API‑key entry, port selection, and optional AI‑wizard setup.
  • When finished you get a btai command (if you chose the global option) that can launch the CLI TUI, start the WEB dashboard, or run the API service.

Typical use cases

  • Bug‑bounty hunters – Run an autonomous scan against a target, let the AI prioritize high‑value findings, and receive a ready‑to‑submit report.
  • DevSecOps – Call the CLI REST or MCP endpoint from CI/CD pipelines to automatically test newly deployed web services; ingest the JSON evidence for ticket creation.
  • Security teams – Use the WEB dashboard to monitor long‑running assessments, replay evidence, and compare LLM performance in ModelLab.
  • Training & education – Practice on the built‑in BugStore vulnerable app and explore the demo report to learn the workflow.

Releases (as of the README)

Component Latest version Notable features
CLI 4.0.35‑beta TUI, web‑scan API/MCP, provider wizard, global btai command
WEB 2.0.37‑beta Dashboard, chat, ModelLab, real‑time scan view
API 1.4.11‑beta Independent API‑target engine, REST + MCP
Launcher 3.3.35 Universal installer, profile wizard, AI‑assistant setup

License & community

  • License: Apache‑2.0 (all core repositories). Model checkpoints have their own HuggingFace licenses, listed on each model card.
  • Community: Discord server, YouTube demo (DEF CON 34), presentations at RootedCON 2026, HKOSCon 2026, and DEF CON 34. Issue trackers live in each component repo; the Launcher is the recommended entry point for new users.

Bottom line

BugTraceAI is a genuine, modular, self‑hosted pentesting platform that leverages LLM agents to orchestrate classic security tooling. It provides a terminal‑first workflow, a web UI, and a programmable API, all under an Apache‑2.0 licence, making it a solid example of AI‑augmented security tooling for researchers and teams that need full control over their data.

Related

  • Project
    ZeroDayEvil/ai-security-tool

    AI Security Tool is an open‑source, cross‑platform suite that combines a multi‑protocol terminal (SSH, RDP, VNC, etc.) with AI‑driven security automation. It offers supply‑chain & CVE scanning, LLM‑based command assistance, and a set of 12+ autonomous agents that handle tool selection, recon, attack‑chain building, and fault tolerance. Available as native installers for Windows, macOS, Linux, Android, and as a web UI, it targets red‑teamers, bug‑bounty hunters, and CTF players looking for a unified AI‑native workflow.

  • Project
    CyberStrikeus/CyberStrike

    CyberStrike is an open‑source AI agent that turns any LLM (Claude, GPT, Gemini, etc.) into an autonomous penetration‑testing platform. It adds a security‑focused “intelligence layer”, ships 13+ specialised agents and 7,600+ signed security‑skill files, supports 150+ AI providers (including offline models), and can orchestrate real tools locally or on remote Bolt servers. A TUI, optional web UI, and built‑in HackBrowser complete the workflow.

  • Project
    bug0inc/qa-agent

    Bug0 AI is an open‑source TypeScript library that lets you write Playwright browser regression tests in plain English. It sends each step to LLMs (Claude, Gemini, OpenAI’s computer‑use agent), executes the returned actions, caches successful steps in Redis, and validates outcomes with a multi‑model consensus engine. Supports AI gateways, video‑based assertions, dynamic placeholders, email extraction, and optional telemetry.

  • Project
    open-webui/open-webui

    Open WebUI is a self-hosted AI platform that provides a user-friendly interface for interacting with AI models, supporting local models via Ollama and any OpenAI-compatible API. It offers features like plugins, role-based access control, persistent memory, RAG, and more, and can run entirely offline.

  • Project
    lintsinghua/DeepAudit

    DeepAudit is an open‑source, multi‑agent AI security auditor that analyses code, generates and sandbox‑executes PoC exploits, and outputs professional reports. It runs via Docker, supports local LLMs, and aims to reduce false positives and verify vulnerabilities automatically.