Agentic offensive-security CLI for security engineers, professional penetration testers, and bug hunters.
How to install agent?
pentesterflow/agent
$git clone https://github.com/pentesterflow/agentInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install agent by running `git clone https://github.com/pentesterflow/agent`, then use it for the current task and follow its documentation at https://github.com/pentesterflow/agent.
README.md
| 1 | <div align="center"> |
| 2 | |
| 3 | <img src="assets/logo.png" alt="PentesterFlow" width="520" /> |
| 4 | |
| 5 | ### Human-in-the-loop Agentic AI CLI for penetration testers and bug hunters. |
| 6 | |
| 7 | PentesterFlow helps security engineers move through recon, enumeration, |
| 8 | validation, evidence collection, and reporting while keeping the analyst in |
| 9 | control. |
| 10 | |
| 11 | <br/> |
| 12 | |
| 13 | [](https://github.com/PentesterFlow/agent/actions) |
| 14 | [](https://github.com/PentesterFlow/agent/releases) |
| 15 | [](https://nodejs.org) |
| 16 | [](LICENSE) |
| 17 | [](https://github.com/PentesterFlow/agent/stargazers) |
| 18 | |
| 19 | **[Install](#install) · [Quickstart](#quickstart) · [Lifecycle](#pentest-lifecycle) · [Memory](#continuous-learning) · [Burp](#burp-integration) · [Security](#security-model)** |
| 20 | |
| 21 | </div> |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | ```console |
| 26 | $ pentesterflow |
| 27 | ╭────────────────────────────────────────────────╮ |
| 28 | │ PentesterFlow │ |
| 29 | │ local agent · tools ready · analyst approved │ |
| 30 | ╰────────────────────────────────────────────────╯ |
| 31 | |
| 32 | › /target https://app.example.com |
| 33 | target set to https://app.example.com |
| 34 | |
| 35 | › test the orders API for broken access control |
| 36 | ⏺ Skill webvuln |
| 37 | ⎿ loaded skill: webvuln |
| 38 | ⏺ http GET https://app.example.com/api/v1/orders/1043 |
| 39 | ⎿ 200 OK |
| 40 | ⏺ BashTool(curl -s -H "Authorization: Bearer $USER_B" ...) |
| 41 | ⎿ cross-account response confirmed |
| 42 | ⏺ Confirmed Finding (high) IDOR on /api/v1/orders/{id} |
| 43 | ⎿ written to ./findings/idor-orders.md |
| 44 | ``` |
| 45 | |
| 46 | ## Overview |
| 47 | |
| 48 | PentesterFlow is an open-source terminal assistant designed specifically for |
| 49 | authorized offensive-security work. It connects to local or hosted LLMs, plans |
| 50 | against a scoped target, uses real pentesting tools, asks for approval before |
| 51 | sensitive actions, remembers useful lessons across sessions, and writes |
| 52 | evidence-backed findings. |
| 53 | |
| 54 | It is built around three ideas: |
| 55 | |
| 56 | - **Analyst control**: the human approves sensitive actions and decides scope. |
| 57 | - **Transparent execution**: curl-first, reproducible commands, visible tool |
| 58 | calls, saved evidence, and audit-friendly logs. |
| 59 | - **Operational learning**: local project and personal knowledge bases improve |
| 60 | future sessions without retraining the model or adding user-facing complexity. |
| 61 | |
| 62 | > [!WARNING] |
| 63 | > Use PentesterFlow only on systems where you have explicit authorization. The |
| 64 | > agent can run shell commands, make HTTP requests, edit files, and process |
| 65 | > captured traffic after approval. |
| 66 | |
| 67 | ## Why PentesterFlow |
| 68 | |
| 69 | Current agentic AI systems often struggle with security-specific workflows, |
| 70 | hallucinated findings, weak context retention, poor tool integration, and limited |
| 71 | auditability. PentesterFlow addresses those gaps with: |
| 72 | |
| 73 | | Challenge | PentesterFlow approach | |
| 74 | |---|---| |
| 75 | | Generic AI workflows | Built-in pentest skills for recon, web vulns, SSRF, SSTI, JWT, GraphQL, race, takeover, Supabase, and deserialization. | |
| 76 | | Hallucinated findings | `confirm_finding` should be used only after reproduction with request/response evidence. | |
| 77 | | Long engagements | Saved sessions, compaction, context snapshots, resume recap, and continuous local learning. | |
| 78 | | Real-world tooling | Shell/Bash, HTTP, Burp bridge, browser capture, MCP, file tools, grep/glob, and custom plugins. | |
| 79 | | Human oversight | Permission prompts, allow-once/session decisions, and explicit YOLO mode for labs. | |
| 80 | | Reproducibility | Copy-pasteable commands, Markdown findings, JSON-lines logs, and stable session files. | |
| 81 | | Large attack surfaces | Coverage tracking, `/next`, skills, captured traffic queries, and learned coverage gaps. | |
| 82 | |
| 83 | ## Core Capabilities |
| 84 | |
| 85 | | Area | What it provides | |
| 86 | |---|---| |
| 87 | | Agent loop | Plan, act, observe |
Related
6 picksType
- mcp-scannerA tool to scan MCP servers and tools for security findingsJul 2026
- hol-guardOpen-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs.Jul 2026
- agent-scanAgent supply chain security scanner.Jul 2026
- falcon-mcpConnects AI agents with CrowdStrike Falcon for security analysis and automation.Jul 2026
- pythonPlug-and-play auth for Python MCP servers.Aug 2025
- auth0-mcp-serverAuth0 MCP Server: Manage Auth0 applications, APIs, actions, logs, and forms using natural languageJul 2026
