GH05TCREW/pentestagent

What it solves

PentestAgent is an AI-driven penetration testing framework designed to automate security assessments. It reduces the manual effort required for reconnaissance, vulnerability scanning, and exploitation by allowing an LLM to orchestrate and execute security tools directly.

How it works

The system uses a Large Language Model (via LiteLLM) to interact with a set of built-in tools (terminal, browser, web search) and external tools integrated via the Model Context Protocol (MCP). It can operate in several modes:

• Assist/Agent/Crew: Ranges from single-shot instructions to autonomous task execution and multi-agent orchestration where a lead agent spawns specialized worker agents.
• Interact: A guided chat mode for manual pentesting support.
• Playbooks: Pre-defined structured attack paths for black-box testing.

To ensure safety and tool availability, it can run within Docker containers (including Kali Linux images) to isolate the execution environment and provide pre-installed security tools.

Who it’s for

Security researchers, penetration testers, and security engineers who want to automate repetitive parts of the security assessment process or use AI to guide their testing methodology.

Highlights

• Hierarchical Multi-Agent Workflows: Agents can self-spawn child agents as isolated MCP servers to delegate subtasks in parallel.
• MCP Integration: Works as both an MCP client (consuming external tools) and an MCP server (allowing external clients like Claude Desktop or Cursor to drive the agent).
• RAG Tool Optimizer: Automatically uses embedding similarity to manage large tool catalogues, retrieving only the most relevant tools to fit within the LLM's context window.
• Knowledge Management: Features a RAG system for CVEs/methodologies and a "Shadow Graph" to derive strategic insights from saved notes.
• TUI Interface: Includes a Terminal User Interface with conversation forking, rewinding, and session restoration.