PentestGPT is an AI-powered autonomous penetration testing framework featuring a multi-stage pipeline, session persistence, Docker deployment, and a legacy multi-LLM mode. It supports local and cloud LLMs, with a focus on autonomous agent workflows for recon, exploit, and reporting.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
PentestGPT is an AI-powered autonomous penetration testing agent framework. It provides an agentic pipeline for penetration testing tasks, a terminal UI with a real-time activity feed, and supports Docker-based deployment. It reports an 86.5% success rate on XBOW benchmarks (90/104).
How it works
The project implements a multi-stage pipeline where each stage's findings feed into the next: recon → exploit → walkthrough for CTF; asset discovery → vulnerability identification → report for pentest. It offers an autonomous agent mode that drives Claude Code or Codex to run tools and reason without human input, plus a legacy interactive multi-LLM mode that runs three cooperating LLM sessions (reasoning, generation, parsing) to maintain a Pentesting Task Tree. It supports a modernized legacy path that can connect to multiple providers via their SDKs.
Getting started
Prerequisites
- Python 3.12+
- uv (Python package manager)
- Claude Code CLI (claude) - installed and authenticated for local Claude runs
- Codex CLI (codex) - installed and authenticated for local Codex runs. The Docker flow bundles both CLIs.
Installation
git clone https://github.com/GreyDGL/PentestGPT.git
cd PentestGPT
make install # runs uv sync
Commands Reference
make install # Install dependencies
make test # Run all tests
make check # Run lint + typecheck
make build # Build distributable package
Usage
pentestgpt --target 10.10.11.234
npentestgpt --target 10.10.11.50 --instruction "WordPress site, focus on plugin vulnerabilities"
pentestgpt --target 10.10.11.234 --mode pentest
pentestgpt --list-sessions
Run in Docker
make docker-build
make docker-login
make docker-auth-status
make docker-run TARGET=http://127.0.0.1:8000 BACKEND=codex MODEL=gpt-5.5 MODE=ctf
make docker-run TARGET=10.10.11.234 BACKEND=claude MODEL=opus MODE=pentest
Recent releases
- v1.0.0 (2025-12-24): Highlights include agentic penetration testing pipeline, terminal UI with real-time activity feed, 86.5% success rate on XBOW benchmark (90/104), and Docker-based deployment.
- v0.14.0 (2024-05-15): OpenAI compatibility updates and support for gpt4o.
- v0.13.0 (2024-05-14): Official GPT4o support; code formatting and minor fixes.
- v0.9.1 (2023-07-25): Local LLM support and custom API endpoints for LLMs.
- v0.8 (2023-05-12): Session saving and continuation with test history storage.
Traction
The repository lists 14698 stars and 2560 forks.
Behind the repo
The project is published with an official website and USENIX Security 2024 publication link in the README. It supports multiple providers via a modernized legacy mode and registry for models.
Caveats
- License: MIT
- Created: 2023-02-27
- Last push: 2026-07-14
- Issues: 81 open
- Language: Python