kitproof

Cybersecurity toolkits · Rank #12

B

pentestagent

Grade B: derived only from the two verdicts below. How grades work

PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

Active1 major behindFree
Visit pentestagent ↗Source on GitHub ↗

Why this verdict

How we check →
  • 15 commits by 5 contributors in the last 90 days (4 in the last 30). receipt ↗
  • OpenAI SDK 2 declared; latest is 3 (1 major behind). receipt ↗
  • On current major: NumPy, Pydantic. receipt ↗
  • Not counted in verdict: Anthropic SDK 0 → 1. receipt ↗

Snapshot: commit 87d763a on main, checked 2026-10-19 07:50 UTC. Receipts link to files at this exact commit.

Dependency freshness

PackageDeclaredLatestStatus
Anthropic SDK anthropic0.84.01.15.0Behind, not counted
OpenAI SDK openai2.0.03.35.11 major behind
NumPy numpy2.0.02.5.4Current
Pydantic pydantic2.7.02.14.1Current

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

API layer
Pydantic

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

  • AI
    Multiple LLM providersAPI key for OpenAI, Anthropic, or other LiteLLM-supported provider
  • AI
    Agent self-spawningspawn_mcp_agent is a built-in tool that allows a running agent to spawn a child copy
  • AI
    MCP RAG tool optimizerPentestAgent automatically replaces the full catalogue with a single mcp_ _rag_optimizer tool
  • API
    External MCP server consumptionConfigure mcp_servers.json to connect PentestAgent to any external MCP servers
  • API
    Expose as MCP serverPentestAgent can run as an MCP server
  • API
    STDIO and SSE transportsTwo transports are supported
  • API
    Async task submissionSubmit a task and return immediately with a task_id
  • API
    Task cancellationCancel a running or pending task by ID
  • Content
    Prebuilt attack playbooksPentestAgent includes prebuilt attack playbooks for black-box security testing
  • Deploy
    Docker isolation runtimeRun tools inside a Docker container for isolation and pre-installed pentesting tools
  • Other
    Four agent modesPentestAgent has three modes, accessible via commands in the TUI
  • Other
    Built-in pentest toolsBuilt-in tools: terminal, browser, notes, web_search
  • Other
    Manual child agent controlthe TUI exposes two commands that let you spawn and terminate child agents manually
  • Other
    Persistent memory storePersist a key-value pair to the in-process memory store

Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 1, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.

Watch pentestagent

Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.

You'll get a confirmation email first. One click to unsubscribe. Watch as many kits as you like.

RSS feed for pentestagent · all changes

History

Oct 1, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.

Show as a table
DateMaintenanceDependenciesCommits (90d)
Oct 19, 2026Active1 major behind15
Oct 12, 2026Active1 major behind15
Oct 1, 2026Active1 major behind18

Sources

Every claim on this page comes from these public records, checked . Open them to verify.

Maintainer? Add the badge

It updates automatically every time we refresh the evidence. Clicking it opens this page.

kitproof badge for pentestagent
[![kitproof](https://kitproof.dev/badge/pentestagent.svg)](https://kitproof.dev/kits/pentestagent/)