pensarai/apex

AI-powered offensive security testing using autonomous agents, directly in your terminal.

What it solves

Pensar Apex is an AI-powered penetration testing tool that automates the process of finding vulnerabilities in software and web applications. It replaces manual, repetitive security testing with autonomous agents that can explore targets, reason about potential flaws, and surface real vulnerabilities with evidence and suggested fixes.

How it works

The tool operates as a terminal-based application (TUI) or a headless CLI. It uses autonomous AI agents to perform both blackbox testing (testing from the outside without internal knowledge) and whitebox testing (analyzing source code provided via the --cwd flag). Users can provide custom guidance, threat models, or specific objectives to guide the agent's behavior. For advanced users, it supports "extended thinking" and an experimental "task-driven" architecture to improve reasoning capabilities.

Who it’s for

  • Developers: To catch vulnerabilities before merging pull requests or as part of a CI/CD pipeline.
  • Security Engineers: To automate repetitive workflows, scale testing across large attack surfaces using agent-driven swarms, and perform manual investigations via an /operator mode.

Highlights

  • Autonomous Agentic Workflow: Performs exploration and reasoning to identify vulnerabilities autonomously.
  • Dual Testing Modes: Supports both blackbox and whitebox (source code access) penetration testing.
  • Flexible Deployment: Available as a TUI, headless CLI for CI/CD, or within a preconfigured Kali Linux Docker container.
  • Observability: Integrates with Weights & Biases Weave for agent tracing and OpenTelemetry for performance and LLM call monitoring.
  • Actionable Findings: Provides severity scores, evidence, and suggested fixes for discovered issues.

Related

  • Project
    vxcontrol/pentagi

    An autonomous AI-powered penetration testing platform that uses a multi-agent system to automate security vulnerability research and exploitation in isolated environments.

  • Project
    Autumn-27/ARTEX

    An AI-driven autonomous penetration testing system that uses a multi-agent architecture and dual-graph tracking to automate security auditing and attack chain execution.

  • Project
    bugbasesecurity/pentest-copilot

    An AI-driven penetration testing agent that autonomously runs security tools on a Kali attack box, analyzes results, and iterates to find vulnerabilities.

  • Project
    usestrix/strix

    An autonomous AI penetration testing tool that uses multi-agent orchestration to find, validate with PoCs, and fix application vulnerabilities.

  • Project
    hackerai-tech/hackerai

    An AI-powered penetration testing assistant that automates vulnerability identification and exploitation using isolated cloud execution environments.