Pentest Agent Suite plugin
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
- 1,030 ★ on the repository
- Last commit
Broad access
Why this level
- Subagents actively test targets with exploits and payloads, and the user sets scope themselves with no authorization check
- The hook gets full shell access for recon and hunt commands, limited only by the scope.yaml list
- The bounty-platforms MCP server holds HackerOne, Bugcrowd, Intigriti and YesWeHack tokens and can submit reports on your behalf
Install
- Works in
Manual install
git clone https://github.com/H-mmer/pentest-agents-suite
cd pentest-agents-suite/pentest-agents/providers/codex
codexA ready translated bundle for Codex with no install step: paths inside reference the cloned repository's tools/, rules/ and mcp-*-server/.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Subagents actively test targets with exploits and payloads, and the user sets scope themselves with no authorization check
- The hook gets full shell access for recon and hunt commands, limited only by the scope.yaml list
- The bounty-platforms MCP server holds HackerOne, Bugcrowd, Intigriti and YesWeHack tokens and can submit reports on your behalf
This is third-party code. Review the repository files before installing.
What it does
Pentest Agent Suite is a workspace for hunting vulnerabilities in bug-bounty programs you have an authorized-testing agreement with. The `/new` command creates a project folder plus `CLAUDE.md`, `AGENTS.md` and settings for seven target tools — Claude Code, Codex, Gemini, Cursor, Windsurf, VS Code Copilot and OpenClaw — translating the shared rules and agents from `.claude/` into each tool's own format: for instance, the model field in an agent's metadata is dropped, and Claude Code-specific wording is swapped for neutral terms. The `/sync` command pulls the program's scope through the bounty-platforms MCP server, which reads the HackerOne, Bugcrowd, Intigriti and YesWeHack APIs with your token, and `/hunt` dispatches vulnerability-class specialist subagents (cross-site scripting, server-side request forgery, insecure direct object references and others) with concrete request templates and an instruction to check the target against the scope file first. Every finding goes through a validator subagent's seven-question check before a report: a single 'no' answer stops it at KILL, and a never-submit list drops purely informational findings without a manual review. The second MCP server, writeup-search, looks up similar prior cases: with no index of your own it returns only the payload and technique notes shipped in the repository, and once pointed at a SQLite or FAISS index it searches your own saved write-ups. Claude Code hooks in `hooks/hooks.json` log token cost per subagent automatically and block Bash commands outside the scope listed in `scope.yaml`.
Who it is for. For bug-bounty and pentest specialists with a signed authorization to test a specific program, who run their search through Claude Code, Codex or another supported agent.
Good fit when
- There is an active bug-bounty program on HackerOne, Bugcrowd, Intigriti or YesWeHack and you want scope, findings and reports in one workspace
- You want ready request templates and methodology for a specific vulnerability class instead of searching from memory
- You want a finding checked against formal criteria before spending time writing a report
- The hunt runs in Codex, Gemini, Cursor, Windsurf, VS Code Copilot or OpenClaw rather than Claude Code, and you want the rules and agents already translated into that tool's format
Not a fit when
- There is no signed authorization to test the target: the tool does not verify this itself, and the scope file can be filled with any domains
- You want a ready index of past write-ups for semantic search: the repository ships only the search server, and the write-up database itself has to be built with the `rag-builder/` scripts
- You need support for a niche bug-bounty platform: full API access is implemented only for HackerOne, the other eleven platforms are stubs so far
- The author did not state a license, so usage and copying rights are undefined; check with the author
Example request
Run /hunt on target.com focused on object references, I have a signed authorization in the HackerOne programLimitations
The author did not state a license, so usage and copying rights are undefined; check with the author.
- The tool does not verify that you hold an authorization for the target: the scope in `scope.yaml` is filled in by the user, who is responsible for staying within it.
- Of the sixteen bug-bounty platforms, full API access is implemented only for HackerOne, Bugcrowd, Intigriti, Immunefi and YesWeHack; the other eleven are stubs with no real requests.
- Semantic search over past write-ups works only with the user's own index: the author states plainly that bulk-redistributing other people's write-ups violates most platforms' terms, so no index ships in the repository.
- The README describes the installer as translating formats for seven tools, but the author names Claude Code as the tested environment; a tested run for the other six is not documented.
- The specialist hooks, including the Bash block outside scope, run on Claude Code's own hook format and are not carried over to the other tools by the installer.
How to disable. Run `pentest-agents uninstall`: the installer removes only the files it wrote itself and surgically strips the keys it added from `.mcp.json` and settings, restoring the saved `<path>.pa-backup` copies of any file it changed.
FAQ
Does Pentest Agent Suite check that I have permission to test the target?
No, it does not verify authorization: the user fills in scope.yaml themselves. The scope_hook.py hook blocks Bash commands that touch domains outside that file, but it does not check where the file itself came from.
What happens to a finding before it is submitted to a program?
A validator subagent runs it through seven questions, and a single 'no' answer sets it to KILL with no retry in that cycle. The never-submit list additionally drops findings programs usually treat as informational.
Does the search over past write-ups work right after install?
Only the local mode does: the writeup-search server returns payloads and technique notes from the repository's rules/payloads.md file. Semantic or keyword search over your own past write-ups turns on only once you drop a metadata.db file into the configured folder yourself.
Can the suite be used outside Claude Code?
Yes, the providers/ folder already ships ready translations for Codex, Gemini, Cursor, Windsurf, VS Code Copilot and OpenClaw, usable straight from the cloned repository. The author names only Claude Code as the tested environment, though; there is no separate test run documented for the other six in the README.
How do I build my own index for semantic write-up search?
The `rag-builder/build.py` script clones the repositories from your repos.yaml list and builds metadata.db and index.faiss from them. Any action that clones, indexes or writes files needs the --execute flag; without it the script only prints the plan.
Discussion
No questions or reviews yet.
Related
PluginsA pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
Burp Suite extension with AI: analyzes requests, runs scanners and opens Burp over MCP to Claude Desktop, Claude Code, Codex and Gemini CLI
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Pentest Agent Suite (this entry) | no | key is optional | 1,030 | |
| pentest-ai-agents | no | 2,365 | the same genre of authorized-pentest subagents, but without bug-bounty platform API integration or MCP search over past write-ups | |
| pentest-ai (ptai) | no | 1,768 | an autonomous pentester that confirms each finding with proof for a rerun, rather than a set of subagents and commands | |
| h1-brain | no | API key | 356 | MCP server that gathers your HackerOne history and 3,600 disclosed |
README in short
The description opens with counts — about 760 files, 118,000 lines, 50 agents, 26 commands and 2,500 lines of payloads — followed by a table mapping agents, commands, rules and MCP across seven target tools. Separate sections describe what the format translator changes when moving content out of Claude Code into another tool, and list the hooks that log token cost and check scope. The closing License section is a single line: the tool is for authorized testing only, with responsible disclosure.