AI-powered pentesting,
right from your terminal
PentestPad Agent is an AI assistant that helps you run security assessments. It suggests commands, executes tools, and reports findings — all from the CLI.
id parameter.
Creating finding in PentestPad...
6 Built-in, Customizable AI Agents
Each agent is purpose-built for a specific testing domain, with deep knowledge of relevant tools, methodologies, and common vulnerability patterns. Customize their behavior or create your own.
Web Application Tester
OWASP Top 10, SQLi, XSS, authentication bypass, CSRF, SSRF, and more. Deep knowledge of web frameworks and common misconfigurations.
Network Pentester
Network discovery, service enumeration, infrastructure testing. From port scanning to privilege escalation on internal networks.
Recon Specialist
OSINT, subdomain enumeration, asset discovery. Map the attack surface before the first test begins.
API Security Tester
REST, GraphQL, authentication flaws, BOLA/IDOR, rate limiting, and API-specific attack patterns.
Mobile App Tester
Android and iOS application testing. APK analysis, certificate pinning bypass, local storage inspection.
General Assistant
Versatile penetration testing guidance. Helps with methodology, tool selection, and reporting across all domains.
From Terminal to Report in Minutes
The agent handles the entire workflow — from reconnaissance to a finished finding in your PentestPad project.
Describe the target
Agent runs tools
Findings created
2. Set user param to
admin'--3. Observe auth bypass...
Generate report
Built for Real-World Pentesting
Every feature is designed around actual penetration testing workflows, not generic AI chat.
Intelligent Command Execution
The agent suggests and runs the right tools with the right flags. No more memorizing nmap syntax or sqlmap options — just describe what you want to test.
Trust Level System
Control what the agent can auto-execute. From read-only recon commands to full automation mode for CI pipelines — you decide the level of autonomy.
Auto-Report Findings
Discovered vulnerabilities are automatically created in PentestPad with proper severity, CWE classification, and reproduction steps.
Conversation History
Every session is saved with full command logs. Link conversations to projects, search history, and pick up where you left off.
Secure Authentication
Browser-based OAuth login with PKCE. Tokens stored in your OS keyring. No API keys to manage or accidentally commit.
MCP Integration
Extend the agent with Model Context Protocol servers. Connect to external tools and services for custom workflows.
Mobile App Testing with Frida
The mobile agent handles the full lifecycle — from APK decompilation to runtime hooking with Frida and Objection. SSL pinning bypass, data storage inspection, and dynamic analysis, all guided by AI.
3 methods intercepted
Keychain access logged
com.bank.util.Config You Control the Autonomy
Four trust levels let you decide exactly how much the agent can do on its own.
None
--trust=noneEvery command requires explicit approval. Best for learning and reviewing what the agent wants to run.
Safe
--trust=safeAuto-runs read-only commands like ls, cat, curl -I, dig, and ping. Asks for anything that modifies state.
Moderate
--trust=moderateAuto-runs pentesting tools like nmap, nikto, gobuster, and sqlmap --batch. Still blocks dangerous operations.
Full
--trust=fullFull autonomy — runs everything without asking. Designed for CI/CD pipelines and automated testing. Fork bombs and destructive commands are still blocked.
Get Started in Seconds
Install the CLI, connect it to your PentestPad instance, and start testing.
Ready to supercharge your pentests?
Get early access to PentestPad Agent and let AI handle the heavy lifting.
