pentest-ai (ptai) CLI
An autonomous AI pentester that proves every finding: verified bugs ship a proof capsule you can replay
- 1,823 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Performs real offensive actions against a target
- Works with credentials and network services
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/pentest-ai-ptaiDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Performs real offensive actions against a target
- Works with credentials and network services
This is third-party code. Review the repository files before installing.
What it does
ptai runs authorized penetration testing with a set of agents by area: reconnaissance, API security, cloud, browser, credential testing and more. The key idea is that each finding is re-verified independently, and only confirmed vulnerabilities reach the report with a capsule you can replay. Results are exported by engagement id, there is SARIF export and a CI step. It installs via pipx as the ptai CLI.
Who it is for. For security professionals running authorized penetration testing.
Good fit when
- You need an automated pentest run against an authorized target
- You want only confirmed findings with proof
- You need to embed a security check in CI
Not a fit when
- You do not have written authorization for the target
- You need a manual focused audit rather than an automated run
Example request
Run a ptai check against this authorized lab and export only the confirmed findingsLimitations
The tool performs real offensive actions, so use it only against targets you are authorized to test. It needs model access: you can point it at a local model via ollama or another provider, whose availability from Russia should be checked.
How to disable. Remove the CLI with pipx uninstall ptai.
FAQ
How is this different from a plain scanner?
Each finding is re-verified, and only confirmed vulnerabilities reach the report with a replayable capsule.
Can it run without a cloud model?
Yes, a local ollama provider is supported and set via environment variables.
How is pentest-ai different from an ordinary vulnerability scanner?
ptai runs authorized testing with a set of agents by area: recon, API security, cloud, browser and credential checks. Each finding is confirmed, and a verified vulnerability comes with a proof capsule for rerunning.
How do I install ptai and where are the docs?
Install with pipx install ptai. Docs and descriptions of the checks are in the project repository. Use it only on systems you have permission to test. Risk is high.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI agent for authorized pentesting: from a natural-language brief it runs recon, finds and verifies vulnerabilities and prepares a report
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Nine skills that let an agent run Strix pentests, fix validated findings and add security scanning to CI
A Claude Code plugin with 15 agents and 63 attack categories for authorized penetration testing with sign-off.
An agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
Open-source adversary emulation for AI agents, LLM apps and MCP servers, checked against OWASP catalogs
README in short
The README describes pentest-ai as an autonomous pentester with the ptai CLI that proves every finding. Installation is via pipx, with pipx upgrade for updates, and a local ollama model is supported. Results are exported by engagement id, with SARIF export and a GitHub Action step. It stresses that the tool is for authorized testing only.