#1010th of 13 in Security
pentestgpt
Autonomous pentest agent that drives Claude Code or Codex against a target
- Stars
- 16.1k
- License
- MIT
- Last commit
- Jul 2026
- Last release
- Dec 2025
- Language
- Python
12,065 on 26 Mar 202616,096 on 22 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
PentestGPT runs a staged pipeline against a target IP or URL, using Claude Code or Codex as the backend to run tools and reason. CTF mode goes recon, exploit, walkthrough; pentest mode goes asset discovery, vulnerability identification, report. A separate pentestgpt-legacy mode keeps the interactive three-session design from the USENIX Security 2024 paper and supports several providers plus Ollama.
Who it is for: Pentesters and CTF players running authorized tests with LLM agents
Strengths
- Staged pipelines for CTF and pentest modes, with saved and resumable sessions
- Legacy interactive mode supports OpenAI, Anthropic, Gemini, DeepSeek, xAI, Qwen, Kimi and Ollama
- Docker image bundles Claude Code and Codex CLIs, with logins persisted in volumes
- Backed by a USENIX Security 2024 paper; reports 90/104 on an XBOW suite run in Dec 2025
Weaknesses
- Autonomous pipeline supports only Claude Code and Codex backends
- Needs an authenticated Claude Code or Codex CLI, so a paid account or API access
- Sends anonymous usage telemetry to Langfuse by default; opt out with a flag
- XBOW result is historical; the shipped CLI has no XBOW runner
What it needs
- no GPU
- Docker + Compose
- Needs Python 3.12+, uv, Claude Code CLI, Codex CLI, Langfuse (telemetry, can be disabled)
- Models: Claude, OpenAI, Google Gemini, DeepSeek, xAI Grok
Quick answers
Is pentestgpt open source?
Yes. Its code is on GitHub under the MIT license.
Can you run pentestgpt with Docker?
Yes. Its repository has a Docker setup: a Dockerfile, a Compose file or a published image.
Does pentestgpt need a GPU?
No, it runs without one.
Also in Security
See all 13| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source code analysis | 91 out of 100 |
| 2 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 85 out of 100 |
| 3 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 84 out of 100 |
| #4 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 79 out of 100 |
| #5 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 72 out of 100 |