pentest-ai

Why we included this project

Most scanner output reads like a pile of possibilities, and pentest-ai is built to cut that noise: it wraps 205 offensive tools and re-executes each candidate exploit through a machine oracle before a finding earns a VERIFIED badge. The LLM coordinates the attack and chains findings into multi-step paths, but it never gets to vouch for a result on its own, so the report carries only what the tool actually reproduced, each finding with a proof capsule you can replay. Output from third-party scanners like nuclei or ZAP is held back until an oracle re-proves it, a relief if you have spent weeks triaging false alarms. The MCP path works with an existing Claude subscription, so no separate API key is needed, and the project ships honeypot and clean-app harnesses so you can check its precision claims yourself. Just remember this is authorized-testing tooling only, and verification buys precision, not broader detection.