bugbasesecurity/pentest-copilot

What it solves

Pentest Copilot is an AI-driven penetration testing agent designed to automate the complex, iterative process of security testing. It removes the manual effort of running tools, analyzing results, and deciding the next step in a security engagement, allowing users to describe a target and let the AI agent autonomously execute the attack chain.

How it works

The system connects to a Kali Linux attack box and operates as an agentic loop. The AI analyzes the target, selects tools from a curated registry of over 100 capabilities, installs necessary packages, and executes commands directly on the box. It can spawn subagents to run tasks in parallel (e.g., subdomain enumeration and directory brute-forcing) and integrates with professional tools like Burp Suite for proxying and out-of-band testing. It also features a browser agent for interacting with JavaScript-heavy applications and VPN management for connecting to target networks.

Who it’s for

Security researchers, penetration testers, and CTF (Capture The Flag) players who want to augment their workflow with an AI agent capable of autonomous tool execution and result analysis.

Highlights

• Agentic Execution: Runs commands, reads output, and iterates autonomously for up to 25 turns per turn.
• Extensive Toolset: Includes 16 core agent tools and a registry of 100+ security capabilities across network, pwn, crypto, and forensics.
• Burp Suite Integration: Direct access to proxy history, Repeater, Intruder, and Collaborator.
• Browser Automation: Real browser interaction via Magnitude to test login flows and JS-heavy apps.
• Parallelism: Ability to spawn subagents for concurrent task execution.
• Model Flexibility: Supports OpenAI, Anthropic, Google, Mistral, and local CLI subscriptions like Codex and Claude Code.
• Safety Controls: Requires explicit approval for dangerous commands like recursive deletes.
• MCP Access: Exposes its control plane via Model Context Protocol (MCP) for external clients.