Zen-AI-Pentest
An autonomous, AI-driven penetration testing framework that combines large language models with more than 72 professional security tools, aimed at security professionals, bug bounty hunters and enterprise red teams.
The framework follows a ReAct pattern, reason, act, observe, reflect, moving through a state machine from planning to execution, observation, reflection and completion, with a short-term, long-term and context-window memory system, retry logic, adaptive planning, and an optional human-in-the-loop pause for critical decisions. A risk engine combines Bayesian scoring and multi-model voting to reduce false positives, scores findings by CVSS and EPSS and by business impact, and ranks findings automatically.
Exploit validation runs in a Docker-isolated sandbox across four safety levels, from read-only to full exploitation, and records evidence such as screenshots, HTTP captures and packet captures with a chain of custody. Eleven specialized personas cover areas such as reconnaissance, exploitation, reporting, auditing, network, mobile, red team, ICS and cloud work, exposed through CLI tools, a Flask-based REST API with WebSocket support, and a browser web UI; attack-path analysis renders an interactive graph of entry points and critical assets.
It integrates more than 72 tools, including nmap, masscan, scapy and tshark, and includes a benchmarking mode that compares its results against tools such as PentestGPT and AutoPentest on scenarios like HTB, OWASP WebGoat and DVWA.