H-mmer/pentest-agents

What it is

H-mmer/pentest-agents (repo also mirrored as pentest-agents-suite), a ~760-file / ~118k-line bug-bounty framework. Beyond the agent/command counts the summary gives, the substance the page adds is how you install and operate it across IDEs, and the safety/translation constraints of doing so.

How it works

The framework ships pre-rendered under providers/<id>/ (codex, gemini, cursor, windsurf, copilot, openclaw), so you can git clone and run a target directly with no install step — bundles use .. relative paths and only work while they stay inside the cloned repo. Alternatively tools.installer writes into your own project or global config dir, rewriting paths to absolute references back into the cloned repo. MCP servers launch via uv run --with mcp (no global pip). A translator converts Claude-format assets for other tools: it drops the model: field, strips Claude-specific prose, maps effort: → model_reasoning_effort in Codex TOML, and adds agents: sibling links so Copilot can wire the dispatch graph.

Preconditions / Affected

Cursor, Windsurf, and OpenClaw have no native subagent concept — Claude agents render as skills/rules, so orchestration behaves differently there. Copilot agents are hard-truncated at 30,000 chars; Windsurf rules chunk at 12,000 (workspace) / 6,000 (global). Platform integration needs credentials, e.g. HACKERONE_USERNAME / HACKERONE_TOKEN.

What to do

Provision a workspace and start hunting:

export HACKERONE_USERNAME=you HACKERONE_TOKEN=your_token
uv run python3 tools/scaffold.py hackerone tesla
cd ~/bounties/hackerone-tesla && claude
/model opus
/sync hackerone tesla
/brain init && /status
/hunt tesla.com

Install / manage across targets:

python3 -m tools.installer install --targets all --scope project
pentest-agents install --dry-run
pentest-agents verify
pentest-agents uninstall

Uninstall is surgical: it removes only files it wrote, strips only the JSON/MCP keys it merged (other settings untouched), and restores any <path>.pa-backup it created. Workflow order matters:

flowchart LR
  N[/new→/sync→/brain init→/analyze→/surface] --> H[/hunt or /autopilot]
  H --> F[/validate→/chain→/report→/dupcheck→/submit→/learn]

Caveats

There is no GitHub Actions CI by project policy; drift is enforced only locally via the test_committed_providers_match_render pytest case, so run python3 -m tools.installer render --check (exit 1 on drift) after editing .claude/, rules/, or skills/. Semantic writeup search is bring-your-own-index (FAISS) — the shipped index is not included. Live platform support is uneven: HackerOne full API, Bugcrowd/Intigriti/Immunefi (public)/YesWeHack, plus 11 stubs.