Repolode
Submit
PentesterFlow

PentesterFlow/agent

A terminal AI assistant for authorized penetration testing that plans scoped work, runs real security tools, asks approval for sensitive actions, and writes evidence-backed findings.

Open-source alternative to:Burp Suite ProfessionalCobalt Strike

View on GitHubWebsite
Stars
1,403
Forks
272
Open issues
5
Last commit
2 months ago

What is it?

PentesterFlow is an open-source, human-in-the-loop agentic CLI for penetration testers and bug hunters. It connects to local or hosted LLMs, plans work against a scoped target, and runs shell commands, HTTP requests, and file operations while the analyst approves sensitive actions and controls scope.

The project covers the engagement lifecycle from recon and enumeration through validation, coverage tracking, and reporting. Confirmed issues are saved as Markdown in ./findings/ with request and response evidence, impact, and a reproducible curl command. Built-in skills cover areas such as IDOR, SSRF, SSTI, JWT, GraphQL, race conditions, and subdomain takeover.

It also includes a local learning system that stores reusable project and personal notes, saved sessions with resume recaps, and a Burp Suite bridge plus an MCP server for browser-captured traffic. It supports Ollama, LM Studio, OpenAI-compatible endpoints, Anthropic, Gemini, and several other hosted providers.

Key features

  • 01Human approval gates for sensitive actions, with ask, auto-safe, and yolo permission modes.
  • 02Confirmed findings saved to Markdown with evidence and a copy-pasteable curl reproduction.
  • 03Built-in pentest skills for recon, web vulnerabilities, SSRF, JWT, GraphQL, and more.
  • 04Burp Suite bridge for sending requests in and importing confirmed findings back as issues.
  • 05Session saving, resume recaps, and a local memory system that keeps secrets redacted.
  • 06Works with Ollama, LM Studio, and multiple hosted or OpenAI-compatible model providers.

Use cases

  • Assisting a bug bounty hunter with IDOR and access control testing on a web API.
  • Running structured recon and coverage tracking across a large authorized web application.
  • Producing Markdown vulnerability reports with reproducible evidence for client deliverables.
  • Using a locally hosted model to keep target data off third-party services.

Topics

#ai-agents#penetration-testing#security-audit#bugbounty#llm#cli#burp-suite#ai#security-automation

FAQ

What is agent?
A terminal AI assistant for authorized penetration testing that plans scoped work, runs real security tools, asks approval for sensitive actions, and writes evidence-backed findings. PentesterFlow is an open-source, human-in-the-loop agentic CLI for penetration testers and bug hunters. It connects to local or hosted LLMs, plans work against a scoped target, and runs shell commands, HTTP requests, and file operations while the analyst approves sensitive actions and controls scope.
Is agent free to use? What license does it have?
agent is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is agent still maintained?
Updated within 6 months. The last commit to agent was on Aug 31, 2026.
What can I use agent for?
Assisting a bug bounty hunter with IDOR and access control testing on a web API. Running structured recon and coverage tracking across a large authorized web application. Producing Markdown vulnerability reports with reproducible evidence for client deliverables. Using a locally hosted model to keep target data off third-party services.
Where can I get agent?
The source code and installation instructions are on GitHub: https://github.com/PentesterFlow/agent

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects