PentAGI
A self-hosted, multi-agent platform for authorized penetration-testing workflows in isolated containers.
Per-dimension scores and reasoning
Evidence shows the system runs in a Docker sandbox with isolation, but least privilege is not explicitly addressed. User confirmation mechanisms exist (e.g., execution monitoring and task planning) but not explicit per-action approval. Data flow transparency is partial: architecture diagrams show data flow but not detailed data handling. Sensitive data handling: API token authentication is mentioned, but storage protection is not detailed. Dependency security: CI includes lint and tests but no vulnerability scanning. External effects: system performs penetration tests on external targets, but authorization mechanisms are not explicit. Rollback: not mentioned. Source attribution: version control and CI exist, but source verification is not explicit.
Self-consistency: README and CI show clear project structure, but code consistency is not verified. Dependency availability: relies on multiple external services (LLM, search, etc.) without availability guarantees. Failure messages: execution monitoring and reflector mechanisms exist, but error messages are not detailed.
Audience and scenarios: clearly targets security professionals, supports multiple LLM providers. Capability boundaries: explicitly states it is not a BAS product and lists current limitations. Trigger precision: has tool call limits and monitoring, but trigger conditions are not explicit. Environment fit: supports Docker Compose and multiple deployment methods.
Information architecture: README is well-structured with architecture diagrams. Install notes: provides Docker Compose quick start. Naming stability: has version tags but no explicit naming conventions. Examples and FAQ: provides example configs and guides. Known limitations: explicitly listed. License: MIT. Versioning and changelog: CI generates versions but no changelog provided. Maintenance responsibility: community links exist but maintainers are not explicit.
Output usability: provides report generation and APIs. Marginal value: automated penetration testing offers unique value. Cost benefit: requires configuration of multiple external services, high cost, but no cost analysis provided.
Claim traceability: feature claims in README lack test evidence. Cross-source corroboration: CI tests exist but no independent verification. Fact-inference separation: not explicitly distinguished.
- The system performs penetration testing, which could cause damage to unauthorized targets; ensure explicit user authorization.
- Relies on multiple external services; ensure their availability and security.
- No rollback mechanism is provided; failures may be difficult to recover.
What does this agent do, and when should you use it?
PentAGI is a self-hosted automated security-testing platform for authorized penetration-testing work. Its React and TypeScript web UI is backed by Go REST and GraphQL APIs secured with Bearer tokens. Work is modeled as Flows, Tasks, SubTasks, and Actions, with specialist research, development, and execution agents; command history and results are stored in PostgreSQL with pgvector. Optional Graphiti and Neo4j services provide a knowledge graph, while Langfuse and a Grafana-oriented observability stack cover model analytics, metrics, traces, and logs. Docker Compose is the documented deployment path, with security tools and web scraping intended to run in isolated containers.
A user creates an Automation or Assistant flow in Flows, chooses a model provider, and supplies a target, scope, and objective. The orchestrated roles described as Researcher, Developer, and Executor can retrieve memory and knowledge, query search systems, run security tools in containers, and retain action results and findings. The documented toolset includes nmap, metasploit, and sqlmap, and the scraper provides isolated browser-based web intelligence. After execution, the report menu can open a web report, copy it, or download Markdown or PDF. API clients can create and inspect flows through /api/v1/graphql and /api/v1/flows.
- An internal security team performs a scoped initial assessment of an organization-owned web application and reviews the resulting vulnerability report.
- A penetration-testing consultancy runs a customer-approved engagement inside Docker isolation while monitoring tasks, subtasks, and terminal output on the Flow page.
- An engineering team integrates security-test creation and status retrieval into an internal workflow through the REST or GraphQL API.
- A security researcher deploys a private testing stack with Ollama, a custom OpenAI-compatible endpoint, or another documented model provider.
- A platform operations team needs model analytics, metrics, traces, and logs alongside testing workflows and enables Langfuse plus Grafana, Jaeger, Loki, and VictoriaMetrics.
What are this agent's strengths and limitations?
- Combines specialist-agent orchestration, queued tasks, persistent memory, and a documented suite of more than 20 professional security tools.
- Offers a web console alongside both REST and GraphQL interfaces for interactive work and automation integration.
- Documents a broad provider path: OpenAI, Anthropic, Gemini, AWS Bedrock, Ollama, DeepSeek, GLM, Kimi, Qwen, and custom/OpenAI-compatible endpoints.
- Can add knowledge-graph and observability services spanning LLM analytics, metrics, tracing, and log aggregation.
- Deployment depends on Docker and Docker Compose, with documented minimums of 2 vCPU, 4GB RAM, and 20GB of disk space.
- At least one LLM provider must be configured, while cloud models and several search integrations require their own credentials.
- The documented Compose service runs as root to manage docker.sock, creating a host-permission boundary that operators must assess.
- Execution monitoring and task planning are Beta features; the documentation says they add roughly 2–3x execution time and token use.
- It is not a CALDERA-style BAS or adversary-emulation product with predefined campaigns or attack plans.
How do you install or deploy this agent?
Provide Docker, Docker Compose, at least 2 vCPU, 4GB RAM, 20GB free disk, and credentials for at least one model provider. Create a directory with mkdir pentagi && cd pentagi. Download the environment example with curl -o .env https://raw.githubusercontent.com/vxcontrol/pentagi/master/.env.example, then configure at least one of OPEN_AI_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, a Bedrock method, or OLLAMA_SERVER_URL and OLLAMA_SERVER_MODEL. Download Compose with curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/master/docker-compose.yml, then run docker compose up -d. Open https://localhost:8443; the documented initial administrator account is [email protected] with password admin, which should be changed at first login.
How do you use this agent?
After signing in, open Flows, select New Flow, choose Automation or Assistant, select a model provider, and enter a target, authorized scope, and expected result in natural language. Monitor messages, agent activity, tasks, and terminal output on the resulting Flow page. Use the flow's Assistant view to submit follow-up instructions or redirect the current engagement, and use the Report menu for web, clipboard, Markdown, or PDF output. For automation, create an API token in Settings and send it as an Authorization: Bearer token to https://your-pentagi-instance:8443/api/v1/graphql or the REST endpoint /api/v1/flows.
How does this agent compare with similar options?
PentAGI distinguishes itself from CALDERA-style Breach and Attack Simulation or adversary-emulation products: it is documented as an autonomous and assistant-guided penetration-testing platform, not a system of predefined campaigns or attack plans.