Repolode
Submit
s0ld13rr

s0ld13rr/pentestcode

A terminal-based autonomous penetration testing agent that runs security tools, tracks engagement state, and coordinates multiple specialist subagents.

Open-source alternative to:PenteraHorizon3.ai NodeZeroCore Impact

View on GitHub
Stars
852
Forks
139
Open issues
4
Last commit
17 days ago

What is it?

PentestCode is an AI penetration testing agent that runs in the terminal. Given a target and a goal, it executes security tools such as nmap, reads their output, updates its model of the network, and decides the next step. It is a hard fork of OpenCode, reworked from a code-editing assistant into an offensive security tool.

The system uses a lead agent that breaks an engagement into tasks and dispatches 13 specialist subagents in parallel, covering areas such as reconnaissance, enumeration, Active Directory and Kerberos identity attacks, web application testing, post-exploitation, and reporting. All agents read and write a shared structured engagement state that holds hosts, services, vulnerabilities, credentials, access levels, and an entity graph with attack path search. The state persists across sessions, and a findings.md file logs progress with timestamps.

The project ships as a single binary for Linux and macOS and works with more than 20 LLM providers through ai-sdk, including Anthropic, OpenAI, Google, Azure, AWS Bedrock, and Ollama. It supports auto, free, and guided modes, and pauses on findings according to configurable rules. The project is in beta.

Key features

  • 01Runs nmap and other pentest tools, then parses their output into structured engagement state.
  • 02Coordinates 13 specialist subagents in parallel, including recon, exploitation, identity, and post-exploitation.
  • 03Persists hosts, credentials, vulnerabilities, and access across sessions.
  • 04Computes attack paths through an entity relationship graph.
  • 05Supports auto, free, and guided operation modes with configurable pause rules.
  • 06Works with 20+ LLM providers, including Anthropic, OpenAI, and Ollama.

Use cases

  • Running full penetration tests from reconnaissance through reporting.
  • Working through CTF challenges with flag and objective tracking.
  • Auditing network services and checking for default credentials.
  • Assisting bug bounty work with web app and API testing.

Topics

#penetration-testing#ai-agents#security-automation#multi-agent-system#offensive-security#llm#cli#ai-security#ai-security-tool#anthropic

FAQ

What is pentestcode?
A terminal-based autonomous penetration testing agent that runs security tools, tracks engagement state, and coordinates multiple specialist subagents. PentestCode is an AI penetration testing agent that runs in the terminal. Given a target and a goal, it executes security tools such as nmap, reads their output, updates its model of the network, and decides the next step. It is a hard fork of OpenCode, reworked from a code-editing assistant into an offensive security tool.
Is pentestcode free to use? What license does it have?
pentestcode is open source under the MIT license. Check the license terms before using it in commercial products.
Is pentestcode still maintained?
Actively maintained. The last commit to pentestcode was on Oct 2, 2026.
What can I use pentestcode for?
Running full penetration tests from reconnaissance through reporting. Working through CTF challenges with flag and objective tracking. Auditing network services and checking for default credentials. Assisting bug bounty work with web app and API testing.
Where can I get pentestcode?
The source code and installation instructions are on GitHub: https://github.com/s0ld13rr/pentestcode

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects