### Human-in-the-loop Agentic AI CLI for penetration testers and bug hunters.
PentesterFlow helps security engineers move through recon, enumeration,
validation, evidence collection, and reporting while keeping the analyst in
control.
[](https://github.com/PentesterFlow/agent/actions)
[](https://github.com/PentesterFlow/agent/releases)
[](https://nodejs.org)
[](LICENSE)
[](https://github.com/PentesterFlow/agent/stargazers)
**[Install](#install) · [Quickstart](#quickstart) · [Lifecycle](#pentest-lifecycle) · [Memory](#continuous-learning) · [Burp](#burp-integration) · [Security](#security-model)**
---
```console
$ pentesterflow
PF v0.3.0 · ollama · …/engagement
› /target https://app.example.com
target set to https://app.example.com
› test the orders API for broken access control
⏺ Skill webvuln · forked
⎿ forked webvuln · 4 tools
⏺ http GET https://app.example.com/api/v1/orders/1043
⎿ 200 OK
⏺ shell · HTTP request
$ curl -s -H "Authorization: Bearer $USER_B" ...
⎿ cross-account response confirmed
★ (high) IDOR on /api/v1/orders/{id}
⎿ written to ./findings/idor-orders.md
Ready · qwen3:14b · app.example.com
```
## Overview
PentesterFlow is an open-source terminal assistant designed specifically for
authorized offensive-security work. It connects to local or hosted LLMs, plans
against a scoped target, uses real pentesting tools, asks for approval before
sensitive actions, remembers useful lessons across sessions, and writes
evidence-backed findings.
It is built around three ideas:
- **Analyst control**: the human approves sensitive actions and decides scope.
- **Transparent execution**: curl-first, reproducible commands, visible tool
calls, saved evidence, and audit-friendly logs.
- **Operational learning**: local project and personal knowledge bases improve
future sessions without retraining the model or adding user-facing complexity.
> [!WARNING]
> Use PentesterFlow only on systems where you have explicit authorization. The
> agent can run shell commands, make HTTP requests, edit files, and process
> captured traffic after approval.
## Why PentesterFlow
Current agentic AI systems often struggle with security-specific workflows,
hallucinated findings, weak context retention, poor tool integration, and limited
auditability. PentesterFlow addresses those gaps with:
| Challenge | PentesterFlow approach |
|---|---|
| Generic AI workflows | Built-in pentest skills for recon, web vulns, SSRF, SSTI, JWT, GraphQL, race, takeover, Supabase, and deserialization. |
| Hallucinated findings | `confirm_finding` should be used only after reproduction with request/response evidence. |
| Long engagements | Saved sessions, compaction, context snapshots, resume recap, and continuous local learning. |
| Real-world tooling | Shell/Bash, HTTP, Burp bridge, browser capture, MCP, file tools, grep/glob, and custom plugins. |
| Human oversight | Permission tiers (`ask` / `auto-safe` / `yolo`), allow-once/session, plan mode. |
| Reproducibility | Copy-pasteable commands, Markdown findings, JSON-lines logs, and stable session files. |
| Large attack surfaces | Coverage tracking, `/next`, skills, captured traffic queries, and learned coverage gaps. |
## Core Capabilities
| Area | What it provides |
|---|---|
| Agent loop | Plan, act, observe, verify, report, and learn — with auto-continue and context compact. |
| Model backends | Ollama, LM Studio, Kimi, Groq, Gemini, Anthropic, and OpenAI-compatible APIs. |
| Tools | Shell, HTTP, file tools, search, browser capture, Burp ingest, MCP, jobs, findings. |
| Skills | Markdown playbooks; optional `fork` so large playbooks stay out of parent context. |
| Memory | Session memory, curated `#` facts, context snapshots, resume recap, local intelligence. |
| Reporting | Confirmed findings in `./findings/