pentest-ai

Dependency freshness

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

API layer

Pydantic

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

• Data
  Local SQLite storageFindings stored on your machine in SQLite
• Other
  MCP client integrationUse it through MCP (Claude Code, Codex, Cursor, VS Code)
• Other
  CLI workflowfrom the CLI, or in CI/CD
• Other
  Machine oracle verificationmachine oracles to verify whether an exploit actually works
• Other
  Bug bounty scope importimport a program's scope (HackerOne, Bugcrowd, Intigriti, YesWeHack)
• Other
  Scope enforcementScope is enforced, not advisory: wildcards, CIDRs and out-of-scope exclusions
• Other
  Platform-ready submissionsturn each verified finding into a platform-ready submission
• Other
  Built-in methodology playbookptai playbook run bug-bounty-web -i target=acme.com --execute
• Other
  Bundled vulnerable demoThe demo tests a bundled vulnerable application
• Other
  Local model supportInstall and start Ollama, then pull a model with tool-calling support
• Other
  SARIF exportReports and SARIF output for existing engineering workflows
• Other
  Opt-in telemetryAnonymous usage counters are opt-in through ptai telemetry enable
• Other
  Out-of-band collaboratorBlind-vulnerability checks can use an external out-of-band collaborator

Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 12, 2026. Every item is checked against an exact README quote; 1 unverifiable item was discarded. A README claim is the maker's description, not something we tested.