Pentest AI

Pentest AI is an open-source AI penetration-testing CLI and MCP server that automatically verifies security findings by reproducing exploits.

Pentest-AI is an open-source CLI and MCP server designed for penetration testing applications locally. It distinguishes valid findings from candidates by using a machine oracle to re-run exploits and verify results three consecutive times. Verified findings generate replayable proof capsules, which allow developers to rerun the specific test to confirm and address vulnerabilities. The tool supports local execution via Ollama or connection to AI clients like Codex and Claude Code. It includes browser-based probes for single-page application testing, supports SARIF export for CI pipelines, and utilizes SQLite for local storage.

Pentest AI at a glance

Best for: Software engineer
Runs on: CLI, self-hosted
Pricing: Free
Released: April 2026
Category: AI coding tool
Website: pentestai.xyz

Key features

Machine oracle verification of exploit findings
Generation of replayable proof capsules for evidence
Local execution via CLI and MCP server
Support for Ollama, Codex, and Claude Code models
Browser-based probes for SPA inspection
SARIF export for integration into build pipelines
Deterministic checks without LLM dependency

Use it for

Verify vulnerability findings for injection and access control
Generate replayable evidence to attach to bug reports
Run penetration tests in local CI build pipelines
Test for BOLA, IDOR, and SSRF vulnerabilities
Inspect JavaScript bundles for hidden routes

Alternatives to Pentest AI

PentestGPT — Runs autonomous multi-stage pipelines or interactive multi-LLM workflows for security tests.
PentAGI — It autonomously manages penetration testing workflows within a secure Docker sandbox.
Autonomous Pentest Agent — Dual-graph architecture for asset synchronization and multi-step attack planning.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
PentestAgent — It provides autonomous multi-agent penetration testing and Docker tool isolation.
VulnClaw — It uses LLM agents to autonomously execute end-to-end security testing loops.
CodeAnt AI — It uses agentic testing to prove exploitability with actionable reproduction steps.
Codacy — Enforces unified coding standards and security policies across the software lifecycle.
OpenCode — Works with 75+ model providers, local models, and existing subscriptions
Mantis — Automates vulnerability discovery and patching using AI agents.
Open Kritt — Orchestrates parallel AI agents to find and verify high-impact code vulnerabilities.
CyberStrike — Autonomous AI agents execute recon, web, network, and cloud penetration testing.

All Pentest AI alternatives