PentesterFlow

PentesterFlow is an open-source terminal agent for authorized penetration testing that runs recon and vulnerability checks with local LLMs.

PentesterFlow is a terminal agent for penetration testers, security engineers and bug bounty hunters working on authorized engagements. It turns a one-line goal, such as checking a host for insecure direct object references, into a tool-using agent loop covering reconnaissance, vulnerability discovery, exploitation and report-grade findings written to disk. It runs against models the user controls, such as Ollama, LM Studio or any OpenAI-compatible endpoint, so data stays local unless a remote provider is chosen. The agent prefers curl and a built-in HTTP tool before heavier scanners, can drive a real browser, and its prompt is calibrated against the OWASP Top 10, the Bugcrowd VRT and PortSwigger research. The user approves the agent's proposed actions, and the project is open source and published on npm.

PentesterFlow at a glance

Best for: Software engineer
Runs on: CLI, open source
Pricing: Free and open source
Released: May 2026
Category: AI coding tool
Website: github.com/pentesterflow/agent

Key features

Goal-driven pentest agent in the terminal
Recon, vulnerability discovery and exploitation steps
Local models via Ollama, LM Studio or OpenAI-compatible APIs
Curl-first HTTP testing and optional browser control
Report-grade findings saved to disk
OWASP and Bugcrowd VRT calibration
User approval of agent actions

Use it for

Run a recon pass on an in-scope target
Check a web app for access control bugs
Write up confirmed findings for a report

Alternatives to PentesterFlow

PentestAgent — It provides autonomous multi-agent penetration testing and Docker tool isolation.
Autonomous Pentest Agent — Dual-graph architecture for asset synchronization and multi-step attack planning.
PentestGPT — Runs autonomous multi-stage pipelines or interactive multi-LLM workflows for security tests.
PentAGI — It autonomously manages penetration testing workflows within a secure Docker sandbox.
Pentest AI — Eliminates false positives by reproducing every exploit three times.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
VulnClaw — It uses LLM agents to autonomously execute end-to-end security testing loops.
OpenFlow — Build and run multi-agent AI pipelines on a visual canvas using real parallel agents.
CyberStrike — Autonomous AI agents execute recon, web, network, and cloud penetration testing.
OpenAPPA — Tracks data flows algebraically to prevent prompt injection without breaking agents.
Raindrop Workshop — Provides real-time observability and self-healing evaluation loops for local AI agents.
AgentGuard — Get a security and quality assessment of AI skills in seconds without an account.

All PentesterFlow alternatives