The Problem

Penetration testing remains predominantly manual, requiring significant security expertise and time to enumerate, exploit, and document findings across target environments. Organizations need scalable assessment capabilities without proportionally increasing headcount or risk exposure.

What This Does

PentAGI is an autonomous AI agent system for automated penetration testing. The backend/ (770 files, dominated by Go) contains the core orchestration, agent logic, Docker sandboxing, and database models. Key entry point backend/cmd/ctester/main.go:34 reaches 401 functions and is the primary execution start. The frontend/ (539 files, TypeScript/React) provides the web UI, with frontend/e2e/helpers/errors.ts serving as a hub module that 29 other modules depend on. The system integrates with 20+ professional security tools (nmap, metasploit, sqlmap) inside Docker containers, supports multiple LLM providers (Anthropic, OpenAI, Ollama, Gemini, etc.), and offers knowledge graph integration via Graphiti/Neo4j for long-term research memory storage. Execution flows through backend/cmd/installer/wizard/app.go where Run is called from 254 places and reaches 279 functions, ultimately spawning PTY sessions via Execute -> startPty for filesystem interaction.

How It Is Wired

Execution starts at backend/cmd/ctester/main.go:34 (entry point reaching 401 functions, called by nothing else in repo) or backend/cmd/installer/wizard/app.go:245 where Run is invoked from 254 call sites. Traced paths to external effects:

  • main -> Close [filesystem via os.Remove]
  • Init -> BuildForm -> createCredentialField -> New [model via anthropic.New]
  • start -> GatherAllInfo -> checkFileIsReadable [filesystem via os.Open]
  • Execute -> startPty [filesystem via pty.Open]

The import graph has 460 internal modules and 461 edges with 3 modules in circular dependencies. Hub modules with blast radius: frontend/e2e/helpers/errors (29 importers), frontend/e2e/mocks/cassettes/flows (19 importers, instability 0.14), and frontend/src/components/shared/file-manager/file-manager (1 importer, instability 0.92 - very stable but high fan-in). A circular import exists in frontend/src/features/knowledges/knowledge-form.tsx. The most connected internal functions are Run (254 callers), Close (182), require (149), and Contains (144).

How To Use It

Setup: Build with docker compose up --build (docker-compose.yml in backend/cmd/installer/files/links/). Requires pnpm for frontend dependencies (frontend/package.json) and go toolchain (backend/go.mod). Configuration: Environment variables in backend/cmd/installer/files/links/.env (currently tracked in git - critical security issue). LLM provider keys configured per provider in the installer wizard models (backend/cmd/installer/wizard/models/llm_provider_form.go, etc.). Running it: Invoke the ctester binary or start the installer wizard: go run backend/cmd/ctester/main.go or go run backend/cmd/installer/main.go. The web UI runs on the port configured in the wizard.

Real-World Use

An security team configures Anthropic and Ollama keys in .env, launches the agent against a target network, and the system autonomously runs nmap scans, identifies services, attempts exploitation with sqlmap/metasploit modules, and stores successful approaches in the Graphiti knowledge graph. The agent retains context across runs, so subsequent engagements benefit from accumulated research. The web dashboard shows live PTY output, task progression, and discovered vulnerabilities.

Code Health & Issues

  • 376 total findings: 126 high, 247 medium, 3 low across 5 kinds
  • [HIGH] Untrack the file your own .gitignore says to ignore - backend/cmd/installer/files/links/.env is tracked though .gitignore excludes it; credentials actively in use are exposed
  • [HIGH] Pin third-party GitHub Actions to commit SHAs - @vN tags in .github/workflows risk secret leakage; pin to SHAs
  • [HIGH] Drop privileged mode and host networking - docker-compose.yml mounts docker socket with privileged, enabling host escape; replace with cap_add and explicit port publishing
  • [HIGH] Remove the committed .env and rotate what it holds - Same file; rotate all credentials, add to .gitignore, commit .env.example with empty values
  • [HIGH] Remove continue-on-error from steps that gate correctness - .github/workflows/ci.yml line 113 suppresses test failures
  • [MEDIUM] Enable Dependabot or Renovate - No update bot configured for 2 manifest ecosystems
  • [MEDIUM] Pin container base images by digest - Dockerfile uses mutable tags (node:24.17.0-slim, golang:1.26-bookworm, alpine:3.23.5)
  • [MEDIUM] Gate pull requests on a dependency vulnerability scan - No dependency scan in CI
  • [MEDIUM] Add a pre-commit secret gate - No repo-level gate; same class of leak will recur
  • [MEDIUM] Move large binaries to Git LFS - observability/jaeger/bin/jaeger-clickhouse-linux-amd64 at 27.5MB committed
  • [HIGH/cognitive_load] Oversized file - frontend/src/components/shared/file-manager/file-manager-utils.ts at 607 lines; frontend/src/pages/settings/settings-provider.tsx
  • [HIGH/cognitive_load] Deep nesting x49 - in frontend/e2e/mocks/cassettes/flows.ts, markdown-editor-extensions.ts, flow-tasks-dropdown.tsx
  • [HIGH/clarity] Hub module x6 - frontend/e2e/helpers/errors.ts (29 dependents), frontend/e2e/mocks/cassettes/flows.ts, frontend/e2e/mocks/cassette.ts
  • [HIGH/soundness] Import cycle member - frontend/src/features/knowledges/knowledge-form.tsx participates in circular import

The Bottom Line

The system delivers on its promise of autonomous penetration testing with solid Docker sandboxing and multi-LLM provider support, but critical security hygiene failures undermine production readiness. The tracked .env with live credentials and docker-compose privileged/host-networking misconfigurations must be remediated before any external deployment. Frontend code shows genuine maintainability debt: oversized files, deep nesting, and a circular import that will slow feature work. Teams needing rapid prototyping of AI-assisted security testing can use this today with the security gaps closed, but the code health investments are substantial.