# Pentest-AI

An AI-assisted penetration-testing workflow that investigates a target application, then uses machine oracles to verify whether a found exploit actually reproduces before reporting it.

Pentest-AI connects an AI client or model to a penetration-testing workflow. A model drives the investigation of a target application and records findings, while machine oracles independently re-run each candidate exploit to check whether it reproduces; a verified finding carries evidence that a reviewer can replay themselves, so a report is not just an unverified model claim.

It can be used through the Model Context Protocol, from a command line, or inside continuous integration, and its setup wizard can register itself with Codex and Claude Code, preserving any existing MCP registrations. It also supports Ollama and other local models with no separate API key needed for the MCP server itself. The project explicitly limits use to systems the tester owns or is authorized to test, and it is written in Python.

Website: https://github.com/0xSteph/pentest-ai