pentest-ai

Overview

Pentest-AI is a comprehensive security testing platform that exposes 205+ wrapped security tools through the MCP protocol. It features 17 specialized agents covering reconnaissance, web, API, active directory, cloud, mobile, and wireless testing, along with 60 deterministic probes for OWASP Top 10 vulnerabilities. The server works seamlessly with MCP-compatible clients like Claude Code, Cursor, and VS Code Copilot without requiring an API key when used through MCP. Each finding includes a working proof of concept, and the system generates attack chains and detection rules.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• list_tools

  List all available security tools in the pentest-ai server

  Try:List all available pentest toolsTry:Show me what security tools I can use
• run_tool

  Execute a specific security tool against the target

  Try:Run wpscan against target.comTry:Execute sqlmap on the login form
• plan_tools

  Get the recommended tool list for a specific engagement

  Try:Plan tools for a web application pentestTry:What tools do I need for API testing?
• ensure_tools_installed

  Batch install the required tools for an engagement

  Try:Install all tools needed for this scanTry:Make sure wpscan and dalfox are installed
• list_probes

  List available SPA-aware probes for OWASP Top 10 vulnerabilities

  Try:Show me available web probesTry:List all SQL injection probes
• run_probe

  Execute a specific probe against the target

  Try:Run the XSS probe on the search endpointTry:Test for SQL injection in the login form
• http_request

  Make raw HTTP requests with scope guards for custom testing

  Try:Send a POST request with this custom payloadTry:Test the endpoint with a malformed JWT
• start_engagement

  Begin a new pentest engagement against a target

  Try:Start a pentest against https://target.comTry:Begin testing the internal application
• get_findings

  Retrieve all findings from the current engagement

  Try:Show me all the vulnerabilities foundTry:Get the latest scan results
• get_attack_chains

  Retrieve attack chains formed from correlated findings

  Try:Show me the attack paths identifiedTry:What attack chains exist in the results?
• test_web_app

  Run a comprehensive web application security test

  Try:Test this web application for vulnerabilitiesTry:Perform a full web security assessment
• test_api_security

  Test API security including endpoints, authentication, and data validation

  Try:Test the API for security vulnerabilitiesTry:Check the GraphQL endpoint for issues

Comparable tools

Installation

pip install ptai

{
  "mcpServers": {
    "pentest-ai": {
      "command": "ptai",
      "args": ["mcp"]
    }
  }
}

ptai setup --mcp

FAQ

Does this require an API key?

When used through MCP with Claude Code/Cursor/Codex, no API key is required. The standalone CLI mode does require an LLM API key.

What tools are included?

205+ wrapped security tools including wpscan, dalfox, hydra, hashcat, paramspider, ffuf, gobuster, sqlmap, and many others.

Compare pentest-ai with