pentest-ai (ptai) is a local offensive-security tool for authorized web application testing, distributed as a CLI and an MCP server. It runs on your machine, keeps findings in local SQLite, and sends no telemetry. It is meant for human-assisted engagements rather than fully autonomous scanning: probes detect issues, an LLM coordinates the run, and the operator decides, with Ctrl+C twice to take over mid-run.
Its distinguishing mechanism is verification. A finding starts as a candidate and only becomes VERIFIED when a named machine oracle re-runs the exploit and reproduces it N of N times. No LLM ever produces a verdict; the rule is enforced in code, and a verdict that cannot name the oracle that earned it is rejected. Each oracle has a control that must fail, and third-party scanner output from tools such as nuclei, nikto, and ZAP stays unverified until one of ptai's own oracles re-proves it independently.
Every VERIFIED finding ships as a portable proof capsule containing the finding, a recipe to re-prove it, and a receipt, so anyone can ptai replay it against the live target and watch the oracle re-confirm without trusting ptai. Capsules are unsigned by design, treating replay itself as the trust mechanism.
The scope is web-application HTTP testing: all probes and oracle kinds target HTTP. AD, cloud, mobile, and wireless have agents and tool wrappers but no probe library or oracles behind them. It does not do local privilege escalation, is not a CVE scanner beyond osv.dev lookups on leaked manifests, and its playbooks currently plan runs rather than execute them.
Two paths run it. On the MCP path an existing Claude Code, Cursor, or Codex subscription is the LLM and no API key is needed, since the MCP server hosts no model of its own. The standalone CLI uses an Anthropic or OpenAI key, a local Ollama provider, or a --no-llm deterministic mode, with per-engagement spend capped by default.
Features
- Oracle verification: findings are re-run by named oracles N of N times before earning a VERIFIED badge; unproven ones stay candidates
- Code-enforced verdicts: no LLM decides whether a bug is real, and a verdict without a named oracle is rejected
- Proof capsules: each VERIFIED finding is a portable, replayable artifact re-confirmable against the live target
- Held-back scanner output: nuclei, nikto, and ZAP results are not findings until re-proven by ptai's own oracles
- Two drive modes: an MCP server for Claude Code, Cursor, and Codex with no API key, or a standalone CLI with a chosen LLM provider or none
- Deterministic option: --no-llm runs the same phase order and detection as a deterministic tool loop
- CI integration: --fail-on verified gates builds only on proven findings, with SARIF, PR comments, and GitLab and Jenkins templates
- Local-first: findings in local SQLite, no telemetry, with OAST callbacks the one network exception (configurable or disablable)
- Scope guardrails: off-by-default intensity=safe, respectratelimits, and strict_scope controls, with out-of-scope hosts refused at invocation
- Reporting: Markdown, HTML, PDF, SARIF, and JUnit outputs from an 18-agent phased pipeline
