pentest-ai

概述

Pentest-AI是一个全面的安全测试平台，通过MCP协议暴露205多个包装的安全工具。它包含17个专业代理，覆盖侦察、Web、API、活动目录、云、移动和无线测试，以及针对OWASP Top 10漏洞的60个确定性探针。该服务器与Claude Code、Cursor和VS Code Copilot等MCP兼容客户端无缝协作，通过MCP使用时无需API密钥。每个发现都包含可工作的概念验证，系统会生成攻击链和检测规则。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• list_tools

  List all available security tools in the pentest-ai server

  试试:List all available pentest tools试试:Show me what security tools I can use
• run_tool

  Execute a specific security tool against the target

  试试:Run wpscan against target.com试试:Execute sqlmap on the login form
• plan_tools

  Get the recommended tool list for a specific engagement

  试试:Plan tools for a web application pentest试试:What tools do I need for API testing?
• ensure_tools_installed

  Batch install the required tools for an engagement

  试试:Install all tools needed for this scan试试:Make sure wpscan and dalfox are installed
• list_probes

  List available SPA-aware probes for OWASP Top 10 vulnerabilities

  试试:Show me available web probes试试:List all SQL injection probes
• run_probe

  Execute a specific probe against the target

  试试:Run the XSS probe on the search endpoint试试:Test for SQL injection in the login form
• http_request

  Make raw HTTP requests with scope guards for custom testing

  试试:Send a POST request with this custom payload试试:Test the endpoint with a malformed JWT
• start_engagement

  Begin a new pentest engagement against a target

  试试:Start a pentest against https://target.com试试:Begin testing the internal application
• get_findings

  Retrieve all findings from the current engagement

  试试:Show me all the vulnerabilities found试试:Get the latest scan results
• get_attack_chains

  Retrieve attack chains formed from correlated findings

  试试:Show me the attack paths identified试试:What attack chains exist in the results?
• test_web_app

  Run a comprehensive web application security test

  试试:Test this web application for vulnerabilities试试:Perform a full web security assessment
• test_api_security

  Test API security including endpoints, authentication, and data validation

  试试:Test the API for security vulnerabilities试试:Check the GraphQL endpoint for issues

可对比工具

安装

pip install ptai

{
  "mcpServers": {
    "pentest-ai": {
      "command": "ptai",
      "args": ["mcp"]
    }
  }
}

ptai setup --mcp

FAQ

这需要API密钥吗？

通过MCP与Claude Code/Cursor/Codex使用时，不需要API密钥。独立CLI模式需要LLM API密钥。

包含哪些工具？

205多个包装的安全工具，包括wpscan、dalfox、hydra、hashcat、paramspider、ffuf、gobuster、sqlmap等许多其他工具。

pentest-ai 对比