Skip to content

Back to the catalog

PentesterFlow/agent
github.comrepo

PentesterFlow/agent

PentesterFlow is an open-source terminal AI agent for authorized offensive-security engagements, connecting to local or hosted LLMs (Ollama, LM Studio, Anthropic, Gemini, DeepSeek, Groq, OpenRouter, etc.) to plan and execute recon, enumeration, vulnerability validation, and evidence-backed reporting against a scoped target. It gates sensitive actions behind analyst approval, bridges with Burp Suite for traffic capture/finding import via a local listener and companion MCP server, and maintains persistent project/personal memory (redacting secrets) to carry lessons and coverage state across sessions. The demo walks through discovering and confirming an IDOR on an orders API and writing findings to a local markdown report.

TL;DR Open-source LLM-powered terminal agent for authorized pentesting, with Burp Suite/MCP integration, human-approval gating, and persistent cross-session memory.
Open original ↗
Document

What it is

PentesterFlow (current release v0.3.0 per the demo banner) is a standalone terminal binary for authorized offensive-security work. The summary covers its purpose and provider list; this page adds the operational detail an engineer needs before running it: how it's installed, what to expect from different model sizes, and provider-specific quirks.

How it works

The tool ships as a standalone binary built with Bun's baseline runtime — the x64 builds do not require AVX2, so they run on older x86_64 CPUs. Sessions are resumable (pentesterflow --resume <session-id>), and on resume it auto-displays a recap of the previous session's persistent memory rather than making you reconstruct context. Backend/model are set interactively (/provider, /model list) or via --backend/--model.

Preconditions / Affected

  • Model size matters: the page states sub-70b hosted models "may be unreliable for agentic tool calls"; 70b+ or a frontier MoE is recommended. Do not judge the tool on a small model.
  • Authorization: the agent can run shell commands, make HTTP requests, edit files, and process captured traffic after approval — only point it at systems you're authorized to test.

What to do

Install via the vendor scripts (note these are pipe-to-shell; review before running in your environment):

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/PentesterFlow/agent/main/install.sh | sh
# Windows PowerShell
irm https://raw.githubusercontent.com/PentesterFlow/agent/main/install.ps1 | iex

The installer verifies the published SHA-256 checksum "when available." To pin a version and install location:

PENTESTERFLOW_VERSION=v0.1.6 PENTESTERFLOW_INSTALL_DIR="$HOME/.local/bin" \
  sh -c "$(curl -fsSL https://raw.githubusercontent.com/PentesterFlow/agent/main/install.sh)"

Binaries are also on GitHub Releases for direct download if you'd rather not pipe to a shell.

Caveats

  • DeepSeek aliases are being deprecated: deepseek-chat/deepseek-reasoner are compatibility aliases for deepseek-v4-flash and are slated for removal on 2026-07-24 — prefer the deepseek-v4-* ids.
  • Provider-specific handling you may hit: Groq sessions use a compact prompt and lower compaction threshold to avoid on-demand TPM errors; LM Studio output is trimmed for <|user|>/<|observation|> template leakage; Anthropic Opus 4.7/4.8 reject the temperature parameter.
  • Checksum verification is conditional ("when available"), so it is not guaranteed on every install path.

Technologies named here

Techniques named here

  • IDOR / Broken Access Control testing
  • IDOR

Related in Offensive Security