PentAGI
A self-hosted, multi-agent platform for authorized penetration-testing workflows in isolated containers.
- Source repo
- vxcontrol/pentagi
- Stars
- ★ 33k
- Last updated
- 14d ago
- License
- MIT
- Primary language
- Go
- FA score
- 44/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An internal security team performs a scoped initial assessment of an organization-owned web application and reviews the resulting vulnerability report.
- Not a fit if
- Teams wanting a hosted SaaS without running Docker, PostgreSQL and Neo4j themselves
- Teams needing predefined BAS campaigns or adversary-emulation plans
- Source review
- 44/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
PentAGI is a self-hosted automated security-testing platform for authorized penetration-testing work. Its React and TypeScript web UI is backed by Go REST and GraphQL APIs secured with Bearer tokens. Work is modeled as Flows, Tasks, SubTasks, and Actions, with specialist research, development, and execution agents; command history and results are stored in PostgreSQL with pgvector. Optional Graphiti and Neo4j services provide a knowledge graph, while Langfuse and a Grafana-oriented observability stack cover model analytics, metrics, traces, and logs. Docker Compose is the documented deployment path, with security tools and web scraping intended to run in isolated containers.
A user creates an Automation or Assistant flow in Flows, chooses a model provider, and supplies a target, scope, and objective. The orchestrated roles described as Researcher, Developer, and Executor can retrieve memory and knowledge, query search systems, run security tools in containers, and retain action results and findings. The documented toolset includes nmap, metasploit, and sqlmap, and the scraper provides isolated browser-based web intelligence. After execution, the report menu can open a web report, copy it, or download Markdown or PDF. API clients can create and inspect flows through /api/v1/graphql and /api/v1/flows.
- An internal security team performs a scoped initial assessment of an organization-owned web application and reviews the resulting vulnerability report.
- A penetration-testing consultancy runs a customer-approved engagement inside Docker isolation while monitoring tasks, subtasks, and terminal output on the Flow page.
- An engineering team integrates security-test creation and status retrieval into an internal workflow through the REST or GraphQL API.
- A security researcher deploys a private testing stack with Ollama, a custom OpenAI-compatible endpoint, or another documented model provider.
- A platform operations team needs model analytics, metrics, traces, and logs alongside testing workflows and enables Langfuse plus Grafana, Jaeger, Loki, and VictoriaMetrics.
How do you install or deploy this agent?
Provide Docker, Docker Compose, at least 2 vCPU, 4GB RAM, 20GB free disk, and credentials for at least one model provider. Create a directory with mkdir pentagi && cd pentagi. Download the environment example with curl -o .env https://raw.githubusercontent.com/vxcontrol/pentagi/master/.env.example, then configure at least one of OPEN_AI_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, a Bedrock method, or OLLAMA_SERVER_URL and OLLAMA_SERVER_MODEL. Download Compose with curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/master/docker-compose.yml, then run docker compose up -d. Open https://localhost:8443; the documented initial administrator account is [email protected] with password admin, which should be changed at first login.
How do you use this agent?
After signing in, open Flows, select New Flow, choose Automation or Assistant, select a model provider, and enter a target, authorized scope, and expected result in natural language. Monitor messages, agent activity, tasks, and terminal output on the resulting Flow page. Use the flow's Assistant view to submit follow-up instructions or redirect the current engagement, and use the Report menu for web, clipboard, Markdown, or PDF output. For automation, create an API token in Settings and send it as an Authorization: Bearer token to https://your-pentagi-instance:8443/api/v1/graphql or the REST endpoint /api/v1/flows.
What are this agent's strengths and limitations?
- Combines specialist-agent orchestration, queued tasks, persistent memory, and a documented suite of more than 20 professional security tools.
- Offers a web console alongside both REST and GraphQL interfaces for interactive work and automation integration.
- Documents a broad provider path: OpenAI, Anthropic, Gemini, AWS Bedrock, Ollama, DeepSeek, GLM, Kimi, Qwen, and custom/OpenAI-compatible endpoints.
- Can add knowledge-graph and observability services spanning LLM analytics, metrics, tracing, and log aggregation.
- Deployment depends on Docker and Docker Compose, with documented minimums of 2 vCPU, 4GB RAM, and 20GB of disk space.
- At least one LLM provider must be configured, while cloud models and several search integrations require their own credentials.
- The documented Compose service runs as root to manage docker.sock, creating a host-permission boundary that operators must assess.
- Execution monitoring and task planning are Beta features; the documentation says they add roughly 2–3x execution time and token use.
- It is not a CALDERA-style BAS or adversary-emulation product with predefined campaigns or attack plans.
How does this agent compare with similar options?
PentAGI distinguishes itself from CALDERA-style Breach and Attack Simulation or adversary-emulation products: it is documented as an autonomous and assistant-guided penetration-testing platform, not a system of predefined campaigns or attack plans.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| PentAGI This agent | 44 · Major gaps | Self-hosted serviceFree + model costs | ★ 33k | 14d ago | Go | OpenAI API · Claude API |
| LuaN1ao Security Agent | 57 · Major gaps | CLIFree + model costs | ★ 1.5k | 1mo ago | TypeScript | OpenAI API |
| DarkMoon Autonomous Pentesting | 48 · Major gaps | CLIFree + model costs | ★ 1.2k | 9d ago | Python | OpenAI API · Claude API |
| RedAmon: Autonomous AI Red Team Framework | 48 · Major gaps | CLIFree + model costs | ★ 3.3k | today | Python | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows the system runs in a Docker sandbox with isolation, but least privilege is not explicitly addressed. User confirmation mechanisms exist (e.g., execution monitoring and task planning) but not explicit per-action approval. Data flow transparency is partial: architecture diagrams show data flow but not detailed data handling. Sensitive data handling: API token authentication is mentioned, but storage protection is not detailed. Dependency security: CI includes lint and tests but no vulnerability scanning. External effects: system performs penetration tests on external targets, but authorization mechanisms are not explicit. Rollback: not mentioned. Source attribution: version control and CI exist, but source verification is not explicit.
Self-consistency: README and CI show clear project structure, but code consistency is not verified. Dependency availability: relies on multiple external services (LLM, search, etc.) without availability guarantees. Failure messages: execution monitoring and reflector mechanisms exist, but error messages are not detailed.
Audience and scenarios: clearly targets security professionals, supports multiple LLM providers. Capability boundaries: explicitly states it is not a BAS product and lists current limitations. Trigger precision: has tool call limits and monitoring, but trigger conditions are not explicit. Environment fit: supports Docker Compose and multiple deployment methods.
Information architecture: README is well-structured with architecture diagrams. Install notes: provides Docker Compose quick start. Naming stability: has version tags but no explicit naming conventions. Examples and FAQ: provides example configs and guides. Known limitations: explicitly listed. License: MIT. Versioning and changelog: CI generates versions but no changelog provided. Maintenance responsibility: community links exist but maintainers are not explicit.
Output usability: provides report generation and APIs. Marginal value: automated penetration testing offers unique value. Cost benefit: requires configuration of multiple external services, high cost, but no cost analysis provided.
Claim traceability: feature claims in README lack test evidence. Cross-source corroboration: CI tests exist but no independent verification. Fact-inference separation: not explicitly distinguished.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- The system performs penetration testing, which could cause damage to unauthorized targets; ensure explicit user authorization.
- Relies on multiple external services; ensure their availability and security.
- No rollback mechanism is provided; failures may be difficult to recover.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v2.2.0 2.2.0
Release notes excerpt
--- <div align="center"> PentAGI 2.2 — Any Modern LLM, a Contained Sandbox, Unified Web Search, and Multi-Instance Deployment This release supports the current generation of LLMs with a tested configuration for every provider, closes CVE-2026-14784 with rebuilt sandbox isolation, replaces seven search tools with one intent-driven web_search, and lets several installations share one set of backing services. …View on GitHub ↗ -
v2.1.0 2.1.0
Release notes excerpt
--- <div align="center"> PentAGI 2.1 — File Management, Knowledge Base, ToolCall Observability, and Assistant Flow Control This release adds a complete file management layer (user resource libraries and flow workspace files with container sync), a first-class Knowledge Base with semantic search and anonymization, real-time ToolCall logging, and assistant tools to monitor and steer running flows. It also refreshes model configurations across OpenAI, Anthropic, Gemini, DeepSeek, Qwen, Kimi, and GLM, a broad frontend modernization pass (React 19, Apollo Client v4, Vite 8), and a wide range …View on GitHub ↗ -
v2.0.0 2.0.0
Release notes excerpt
--- <div align="center"> PentAGI 2.0 — Broader Model Support, Analytics, Runtime Flexibility, and Agent Guardrails This release expands the LLM provider ecosystem with four new providers, introduces a full analytics dashboard, enables runtime provider switching mid-flow, adds Docker host network mode for OOB attack scenarios, and ships a comprehensive set of stability and reliability improvements. It also includes significant test coverage expansion across the backend codebase. …View on GitHub ↗