0xSteph/pentest-ai

What it is

Pentest-AI (ptai) is an MIT-licensed Python tool (3.10–3.14) that drives an AI-assisted pentest workflow and gates "verified" findings behind deterministic oracles. The summary covers the concept; below are the concrete install, CI-gating, and trust-boundary details the page adds.

How it works

Three-step loop: a probe/scanner finds a candidate; a named oracle replays the exploit and compares against a control that should not exhibit the weakness; a verified finding is stored in a portable proof capsule that ptai replay re-checks. The example given: a trusted-header bypass must return privileged content with the attack header and deny access without it — a server returning HTTP 200 to everything is not evidence. The model itself can never award a verified verdict; third-party scanner output stays unverified until an oracle independently proves it.

What to do

Install with pipx, then wire up MCP (asks before connecting detected clients — both Codex and Claude Code — and preserves existing registrations):

pipx install ptai
ptai setup --mcp

Preview changes without applying: ptai setup --mcp --dry-run. The wizard does not install clients, sign in, or download models; your AI client supplies the model, so the MCP server needs no separate model API key. Upgrade via pipx upgrade ptai.

Try it offline first (no API key or target needed) — tests a bundled vulnerable app and replays a capsule:

ptai demo

Local model route (no cloud key):

export PENTEST_AI_LLM_PROVIDER=ollama
export PENTEST_AI_MODEL="your-installed-model"
ptai start https://your-authorized-target.example --no-sync

CI gating and SARIF export — note the ordering constraint:

ptai start https://your-authorized-target.example --ci --fail-on verified --no-sync
ptai export YOUR_ENGAGEMENT_ID --sarif pentest.sarif

--sarif is an export option, not a ptai start option. Retain the engagement ID and run the export even when the gate fails if you want evidence for failed builds. Control blind-check callbacks:

ptai start ... --oast-server https://your-collaborator.example
ptai start ... --no-oast

Caveats

• Proof capsules are unsigned — rerunning the check is the only trust mechanism.
• A verified verdict applies only to tested conditions; a scan with no verified findings is not a security assessment of the whole app.
• Coverage varies by probe/oracle; optional scanners need their own binaries, and some integrations return raw output rather than structured findings.
• main may contain unreleased work — check the changelog for your version.
• Local storage ≠ everything stays local: model-provider calls, installed scanners, and OAST collaborators each have their own network behaviour, and callback metadata is visible to the collaborator service. Telemetry is opt-in (ptai telemetry enable).