PentAGI

What it is

PentAGI (VXControl, Dubai) is a self-hosted multi-agent system for autonomous penetration testing. You describe a target and goal in plain language. Agents (orchestrator, researcher, developer, executor) plan the work and run 20+ tools such as nmap, Metasploit and sqlmap in a Docker sandbox. The system stores results in PostgreSQL with pgvector and produces a report. Beyond the summary, the README documents where the deployment risk sits and how to tune it for small local models.

Preconditions / Affected

• Minimum 2 vCPU, 4 GB RAM, 20 GB disk, Docker and Docker Compose (Podman is supported).
• At least one LLM provider key, or a local Ollama or vLLM endpoint.
• A fresh install creates the default login admin@pentagi.com / admin. Change it on first login.
• Docker Compose runs the PentAGI service as root because it needs docker.sock. Using a TCP Docker connection lets you drop root and use the pentagi user.
• The web UI and compose services bind to 127.0.0.1 by default.
• Each flow publishes two TCP ports for out-of-band callbacks from the range starting at DOCKER_PORTS_BASE (28000 to 29999 by default), on DOCKER_PUBLIC_IP (0.0.0.0 by default). Docker routes these around ufw, and firewalld lets them through its docker zone. With DOCKER_NETWORK=host, sandbox listeners are exposed with no port mapping.

What to do

Start with the installer, then run as root or add your user to the docker group (the README warns this is root-equivalent):

mkdir -p pentagi && cd pentagi
wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip
unzip installer.zip
sudo ./installer

Give sandboxes Docker through a hardened dind daemon over TLS, not a bind-mounted socket:

DOCKER_INSIDE=true
DOCKER_SOCKET=
DOCKER_INSIDE_HOST=tcp://10.0.0.5:3376
DOCKER_INSIDE_TLS_VERIFY=1
DOCKER_INSIDE_CERT_PATH=/etc/docker/dind/certs/client
DOCKER_INSIDE_POLICY_TESTS=true

The README says mounting the host daemon's socket lets an agent start a privileged container, mount / and compromise the node, PentAGI included. Mounting a dind socket can instead hit a boot-order race where Docker creates a directory in place of the socket. For production, the README strongly recommends a two-node layout with workers on a separate server (examples/guides/worker_node.md).

Also change COOKIE_SIGNING_SALT, the Postgres and Neo4j credentials, and set PUBLIC_URL. For several installs sharing one database or worker node, set TENANT_ID (matches ^[a-z][a-z0-9_]{0,31}$) to namespace schemas, containers, graph ids and cookies.

For models under 32B parameters, enable the supervision features, both off by default:

EXECUTION_MONITOR_ENABLED=true
AGENT_PLANNING_STEP_ENABLED=true

The README reports, from testing with Qwen3.5-27B-FP8, about 2x better result quality at 2-3x the tokens and run time. Both features are marked Beta. Hard tool-call limits are always on: 100 for general agents (MAX_GENERAL_AGENT_TOOL_CALLS) and 20 for limited ones (MAX_LIMITED_AGENT_TOOL_CALLS).

Caveats

• It is not a breach-and-attack-simulation or adversary-emulation product with predefined campaigns. JSON report export is not documented. Reports export as web view, Markdown or PDF.
• The README states PROXY_URL does not cover sandbox containers, the scraper, Graphiti, OAuth or Langfuse/OpenTelemetry export. It does cover LLM, embedding and search calls, including self-hosted ones. Restrict the rest at the network level.
• Deleting a flow does not remove its flow-{id}-data/ directory. LLM_SERVER_* variables are marked experimental.
• The README says to test only systems you own or are authorized to assess, and refers to EULA.md.
• The fetched text was truncated at 60,000 of 233,819 characters. The API, provider, Langfuse, Graphiti, OAuth and testing sections are not covered here.