pentestkit

Dependency freshness

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

AI

Anthropic SDK

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

• Other
  Multi-agent pentest frameworkA multi-agent, context-accumulating penetration-testing framework built on the Claude Agent SDK
• Other
  Orchestrator testing plandoes light recon, writes a testing plan into the knowledge base
• Other
  Specialist scope agentsone specialist per scope (recon, auth, injection, access-control, SSRF/XXE, business-logic; plus network scopes)
• Other
  Finding exploitation proofproves each finding by exploiting it
• Other
  CVSS v3.1 scoringscores it with CVSS v3.1
• Other
  Client-ready reportwrites a client-ready report
• Other
  Shared knowledge basea shared knowledge base grows
• Other
  Scope-guarded chokepointevery packet that leaves the box passes one scope-guarded chokepoint
• Other
  Authorization confirmationEach run requires you to confirm authorization
• Other
  Payload hostingpayload hosting (`payload_publish`)
• Other
  Multi-port target discoverymulti-port/multi-network target discovery
• Other
  PHP filter chain toola `php_filter_chain` tool
• Other
  Raw HTTP sockets`raw_http` sockets
• Other
  Link harvestinglink harvesting

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.