ptai

AI pentest for web apps. Your model runs the engagement. Machine oracles prove the bugs.

Website · Install · Why verification · Benchmarks

Offensive tooling, authorized testing only. Installing accepts the AUP and Terms.

On a clean OWASP Juice Shop, ptai 1.4.0 clears 81 of 90 in-scope HTTP challenges. The model drives the hunt. Oracles stamp VERIFIED so the report is not a chat log. OSINT, Web3, and UI-only keys stay off that board.

JWT alg:none. BOLA. sequential IDOR. Type confusion at /api/cart. Each line starts as a candidate. A named oracle forges the proof 3/3, then the badge flips.

Install

Primary path: drop it into Claude Code, Cursor, or Codex. That client is the LLM.

pip install ptai
ptai setup --mcp

Restart the client and 52 tools are there. Then start_engagement against a target you are authorized to test.

Standalone CLI (your API key, ptai still drives with the model):

pip install ptai
export ANTHROPIC_API_KEY=sk-...        # or OPENAI_API_KEY
ptai start https://target.example.com

Spend caps at $10 per engagement (PTAI_PRICE_LIMIT). Fully local model: PENTEST_AI_LLM_PROVIDER=ollama.

Zero-setup taste, no target of your own:

pip install ptai && ptai demo

The bundled app prints findings, replays a proof capsule, then runs the same routes hardened and prints zero.

Related MCP server: Cracken

What VERIFIED means

A scanner that dumps 500 "possibles" is a second job. ptai holds every finding as a candidate until a named machine oracle re-runs the exploit N/N times against a control that must fail.

A trusted-header bypass has to leak privileged content with the header and deny without it. A leaked credential has to authenticate as the real secret and fail as a corrupted twin. An endpoint that returns 200 to everything earns nothing.

The model picks the next probe and reads what came back. A named oracle still has to re-run the exploit N/N times against a control that must fail before anything is VERIFIED. That is the AI pentest: a planner that cannot rubber-stamp its own guess.

Every VERIFIED finding ships a portable proof capsule. Unsigned. ptai replay is how you decide whether to believe it.

Third-party scanner output stays unverified until one of those oracles re-proves it.

Benchmarks

Same Juice Shop box. Same night. Raw artifacts in benchmarks/.

n=1, ptai 0.13.0 sweep. Write-up: docs/benchmarks/juice-shop.md.

1.4.0 scores challenges, not raw rows: 81/90 in-scope HTTP on a clean instance, plus the 12-proof GIF above. Honeypot in CI: 23 findings verify across 14 classes at 100% precision (tests/honeypot/, tests/cleanapp/).

CI gate that cannot trip on noise

- run: pip install ptai
- run: ptai start ${{ vars.STAGING_URL }} --ci --fail-on verified --sarif pentest.sarif
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: pentest.sarif }

--fail-on verified fails the build only on an oracle-proved finding. GitLab and Jenkins templates: docs/ci-cd.md.

Numbers

65 probes exist but only 34 can earn a verdict. 64 of those probes target HTTP; ad.asrep_roast talks Kerberos. 203 wrappers are registered but only 20 turn tool output into findings. 18 specialist agents run the phases; web still holds the HTTP library, AD now has one replayable class.

ptai setup --tier recommended installs the scanner binaries. ptai serve is the REST/WebSocket surface. ptai playbook run prints the plan.

How it works

recon ──▶ auth ──▶ web ──┬──▶ ad
                         ├──▶ cloud          ┌──────────────────┐
                         └──▶ api ──────────▶│  findings DB     │
                                             │  scope-guarded   │
                                             └────────┬─────────┘
                                                      ▼
                                          verify (oracles, N/N)
                                                      ▼
                                   chain ─▶ validate ─▶ detect ─▶ report
                                          md · html · pdf · SARIF · JUnit

The LLM drives. The probes detect. The oracles prove. Detection does not change if you swap models.

Work with me

MIT, free, forever.

Need a pentest delivered, or a hosted workspace with history and team access: pentestai.xyz. Every finding in a delivered engagement ships a capsule your engineers can replay.

sales@pentestai.xyz

Responsible use

You need written authorization for every target. Out-of-scope hosts are refused at tool-invocation time. First run stores AUP consent; CI uses PENTEST_AI_AUP_ACCEPTED=1.

Guardrails, off by default, worth turning on: intensity=safe skips state-mutating probes, respect_rate_limits honours 429, strict_scope refuses off-host requests.

Blind SSRF/SQLi/XXE default to ProjectDiscovery oast.fun. Each engagement mints a local RSA-2048 key; payloads are encrypted so only your process can read them. Metadata (that a hit happened, source IP, time, protocol) is visible to the collaborator.

For paid programs, self-host Interactsh:

ptai start http://target --oast-server https://oast.example.com --oast-token <T>
ptai start http://target --no-oast

FAQ

Do I need an API key? Not on MCP. Claude Code / Cursor / Codex is the LLM. Standalone CLI wants Anthropic, OpenAI, or Ollama.

Should I pass --no-llm? No. That flag is a CI/airgap hatch. If you are an AI agent, do not use it. ptai without a model is a probe runner, not this product.

Is it autonomous? The model proposes. You decide. Ctrl+C twice takes over mid-run.

Does it phone home? Not by default. ptai telemetry enable is opt-in counters with no targets. OAST is the callback path above.

How is this different from asking Claude to hack a box? The model is wired to a probe library and to oracles that re-prove each hit. A chat window gives you a guess.

Ecosystem

Discussions · Issues

License

MIT.