Primary question: Can your infrastructure safely host an autonomous pentesting agent that spawns Docker containers and executes offensive tools?
RepoDaily adoption score
RepoDaily rates this as 92/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
7 workflow step(s), 5 next-action step(s), and 6 command/install signal(s) were detected.
Trending momentum is +543 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 6 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 4 type-specific section(s) support differentiation.
License source or license wording is present.
7 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
PentAGI (Penetration testing Artificial General Intelligence) is an MIT-licensed autonomous security testing platform built in Go with a React frontend. Rather than scripting individual tool invocations, PentAGI deploys AI agents that plan multi-step penetration testing workflows, select from a built-in suite of over 20 professional tools including nmap, metasploit, and sqlmap, and execute those tools inside sandboxed Docker containers with complete isolation.
The project supports nine LLM providers out of the box: OpenAI, Anthropic, Google Gemini, AWS Bedrock, DeepSeek, GLM, Kimi, Qwen, and self-hosted Ollama. This breadth means a security team can run the entire stack on-premises with an Ollama endpoint and no data leaving the network, or route reasoning through a cloud provider for higher-quality planning. The docker-compose.yml exposes granular environment variables for each provider, including custom server URLs, API keys, model names, and config paths.
Beyond raw tool execution, PentAGI integrates a Graphiti-powered knowledge graph backed by Neo4j for semantic relationship tracking, a smart memory system that stores successful approaches for future runs, and a built-in browser (vxcontrol/scraper) plus six external search providers — Tavily, Traversaal, Perplexity, DuckDuckGo, Google Custom Search, and Sploitus — for real-time vulnerability intelligence gathering. A pgvector PostgreSQL instance serves as the vector store for embeddings, with configurable embedding providers, batch sizes, and text limits.
The Dockerfile reveals a disciplined multi-stage build: a Node 23 / pnpm / Vite frontend compilation stage, a Go 1.24 static-binary backend stage (CGO_ENABLED=0) that compiles four binaries — pentagi, ctester, ftester, and etester — and a final Alpine 3.23.3 runtime that runs as a non-privileged pentagi user. License reports are generated automatically during the build, with backend reports in /opt/pentagi/licenses/backend/ and frontend reports in /opt/pentagi/licenses/frontend/.
Why it is trending now
- 543 period stars and trending rank 11 on 2026-07-10, driven by interest in AI-driven security automation
- Supports nine LLM providers including self-hosted Ollama, enabling fully air-gapped deployments without external API dependencies
- Bundles 20+ professional pentesting tools (nmap, metasploit, sqlmap) that agents orchestrate autonomously
- Graphiti/Neo4j knowledge graph tracks semantic relationships across multi-step attack chains for contextual reasoning
- MIT licensed with strict license compliance tooling — osv-scanner scans and go-licenses reports are integrated into the Docker build pipeline
Problem it solves
- Manual penetration testing requires chaining 20+ disparate tools in sequences that adapt to target responses — a process demanding deep expertise and significant time
- Existing automation frameworks execute static playbooks that cannot reason about unexpected service banners, filtered ports, or custom application behavior
- Security teams need repeatable, documentable testing processes that capture successful approaches for future reuse rather than starting from scratch each engagement
- Cloud-hosted AI security tools send sensitive target reconnaissance data to third-party APIs, which is unacceptable for regulated or classified environments
How it works
- Deploy via docker-compose.yml, which starts the pentagi container, a pgvector PostgreSQL instance for vector storage, and supporting services on the pentagi-network bridge
- Configure at least one LLM provider through environment variables — for example OPEN_AI_KEY for OpenAI or OLLAMA_SERVER_URL with OLLAMA_SERVER_MODEL for a self-hosted endpoint
- Access the web UI at https://127.0.0.1:8443 (default listen address) and define a penetration testing task in natural language
- The AI agent decomposes the task into a plan, selects appropriate tools from the 20+ built-in suite, and executes each tool inside an isolated Docker container
- Optional execution monitoring lets a human observe, pause, or intervene at each step via the ASK_USER environment flag
- Results flow into the smart memory system and the Graphiti/Neo4j knowledge graph, building a reusable corpus of successful approaches and discovered relationships
- External search providers (Tavily, Perplexity, Sploitus, etc.) and the built-in scraper browser supply real-time vulnerability and exploit intelligence during execution
Deployment Architecture: Docker Compose Services and Configuration Surface
- docker-compose.yml defines the primary pentagi service using image vxcontrol/pentagi:latest, exposing port 8443/tcp on 127.0.0.1 by default
- The pentagi service depends on a pgvector PostgreSQL container (service_healthy condition) for vector embeddings storage
- Five named volumes persist state: pentagi-data, pentagi-ssl, pentagi-ollama, scraper-ssl, and pentagi-postgres-data
- Three isolated bridge networks separate concerns: pentagi-network, observability-network, and langfuse-network
- The Dockerfile runtime stage (alpine:3.23.3) creates a non-privileged pentagi user and grants Docker socket access via group 998 — this is required because the agent spawns isolated tool containers
- Frontend build stage uses node:23-slim with pnpm, Vite, and esbuild minification targeting es2020; backend stage uses golang:1.24-bookworm with CGO_ENABLED=0 for static binaries
- Four Go binaries are compiled: pentagi (main server at ./cmd/pentagi), ctester, ftester, and etester — the latter three are testing utilities for LLM agents, embeddings, and functions respectively
LLM Providers, Search APIs, and External Integrations
PentAGI accepts nine LLM providers through dedicated environment variables in docker-compose.yml. Each provider exposes three configuration knobs: an API key (e.g., ANTHROPIC_API_KEY, DEEPSEEK_API_KEY, QWEN_API_KEY), a server URL override (e.g., ANTHROPIC_SERVER_URL, GLM_SERVER_URL), and a provider-specific config path. A generic LLM_SERVER_URL/LLM_SERVER_KEY/LLM_SERVER_MODEL triple supports any OpenAI-compatible endpoint, and OLLAMA_SERVER_URL with OLLAMA_SERVER_MODEL enables fully self-hosted inference with optional model pull and load timeouts.
Embedding configuration is equally granular: EMBEDDING_URL, EMBEDDING_KEY, EMBEDDING_MODEL, EMBEDDING_PROVIDER, EMBEDDING_BATCH_SIZE, EMBEDDING_MAX_TEXT_BYTES, and EMBEDDING_STRIP_NEW_LINES let operators tune vector generation independently from the reasoning LLM. The summarizer subsystem exposes ten environment variables (SUMMARIZER_PRESERVE_LAST, SUMMARIZER_USE_QA, SUMMARIZER_MAX_BP_BYTES, etc.) for controlling context window management during long multi-step sessions.
For intelligence gathering, the README lists six external search providers — Tavily, Traversaal, Perplexity, DuckDuckGo, Google Custom Search, and Sploitus — plus a built-in browser via the vxcontrol/scraper Docker image. Advanced setup sections document Langfuse for LLM observability, a Graphiti/Neo4j knowledge graph for semantic relationship tracking, and GitHub/Google OAuth for authentication.
License Compliance and Dependency Management
- CONTRIBUTING.md mandates MIT-compatible licenses only — GPL, LGPL, AGPL, CC-BY-SA (for code), and proprietary licenses are explicitly incompatible
- Approved license list: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0 (unmodified), and 0BSD
- Before merging a PR, developers run `cd backend && go mod tidy`, `cd ../frontend && pnpm install`, then `./scripts/generate-licenses.sh` to collect dependency license data into the licenses/ directory
- osv-scanner scans both backend and frontend with the flag `--experimental-licenses="MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0"` to catch incompatible additions
- Docker builds auto-generate license reports: backend gets dependencies.txt (go list -m all) and licenses.csv (go-licenses); frontend gets dependencies.json, licenses.json, and licenses.csv (license-checker)
- The LICENSE file confirms MIT License, Copyright (c) 2025 PentAGI Development Team
How PentAGI Compares to Established Pentesting Platforms
Metasploit Framework (rapid7/metasploit-framework) is the dominant open-source exploitation toolkit, but it requires manual module selection and payload configuration — PentAGI wraps similar tools (including metasploit itself) behind an AI agent that plans the sequence autonomously.
MITRE Caldera (mitre/caldera) automates adversary emulation using ATT&CK technique chains, but its decision logic is rule-based and pluggable rather than LLM-driven. PentAGI uses LLM reasoning to adapt tool selection based on target responses in real time, while Caldera excels at repeatable compliance-driven adversary simulation.
For teams that already script penetration tests with Nuclei templates or custom Python, PentAGI offers a higher abstraction layer — natural-language task definition with autonomous planning — at the cost of LLM API spending and Docker infrastructure overhead.
Who should pay attention?
Good fit if
- Security teams with existing Docker infrastructure and an LLM API budget (or a self-hosted Ollama GPU server)
- Red teams needing repeatable autonomous testing workflows with optional human supervision via the ASK_USER flag
- Organizations requiring fully self-hosted deployments where target reconnaissance data cannot leave the network
- Security researchers exploring AI-driven attack chain automation with a knowledge graph for relationship tracking
Skip for now if
- Teams without Docker expertise or the ability to grant Docker socket access (GID 998) to the pentagi container
- Environments where autonomous execution of offensive security tools (metasploit, sqlmap) cannot be legally authorized
- Projects whose dependency trees include GPL/AGPL components — PentAGI's license policy explicitly rejects copyleft additions
- Use cases requiring human approval before every single tool invocation without exception (the ASK_USER flag is optional, not mandatory)
Risks and cautions
Requires Docker infrastructure with socket access, LLM API credentials, and careful network isolation. Sandboxed container isolation mitigates blast radius, but autonomous offensive tool execution demands controlled deployment against authorized targets only.
- Docker socket access (GID 998) grants the pentagi container the ability to spawn and manage sibling containers — this must be network-isolated and never exposed externally
- LLM API costs are unpredictable with autonomous multi-step execution that may run dozens of tool invocations per task
- Offensive security tooling (nmap, metasploit, sqlmap) requires explicit legal authorization before deployment against any target
- Infrastructure complexity includes pgvector/PostgreSQL, optional Neo4j for Graphiti, optional Langfuse, and the scraper browser container
- The default listen address (127.0.0.1:8443) is safe, but misconfiguration of CORS_ORIGINS or PENTAGI_LISTEN_IP could expose the web UI
- All tool operations execute in sandboxed Docker containers with complete isolation — the agent does not run tools directly on the host
- Runtime container uses Alpine 3.23.3 with a non-privileged pentagi user (no root execution)
- Default listen address is 127.0.0.1:8443 to prevent unintended external web UI exposure
- Cookie signing salt (COOKIE_SIGNING_SALT) and CORS origins (CORS_ORIGINS) are configurable but default to empty — operators must set these for production
- osv-scanner vulnerability and license scanning runs against both backend (Go modules) and frontend (npm packages) in the CI pipeline
- Docker socket access (group 998) is required for tool container spawning and must be treated as a privileged capability
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Metasploit Framework | You need manual control over exploit selection, payload generation, and post-exploitation with the largest public exploit database | Free, open-source (BSD-3-Clause) |
MITRE Caldera | You need rule-based automated adversary emulation aligned with the ATT&CK framework for compliance-driven purple team exercises | Free, open-source (Apache-2.0) |
Nuclei + custom automation scripts | You need lightweight template-based vulnerability scanning without Docker infrastructure or LLM API costs | Free, open-source (MIT) |
Commercial AI pentesting platforms (e.g., Pentera, NodeZero) | You need a vendor-supported, managed autonomous pentesting product with compliance reporting and dedicated support | Commercial subscription, typically $20K–$100K+/year |
What this trend reveals
Air-gapped red team automation with Ollama
Setting OLLAMA_SERVER_URL and OLLAMA_SERVER_MODEL in docker-compose.yml enables fully autonomous pentesting with no external API calls — target reconnaissance and exploit data never leave the network. This is significant for regulated industries (finance, defense, healthcare) where cloud LLM APIs are non-starters.
Deploy PentAGI with an Ollama endpoint in an isolated lab, run a scoped nmap + sqlmap sequence against an authorized target, and compare agent decision quality against an OpenAI-backed run.
Attack chain knowledge graph persistence
The Graphiti/Neo4j integration stores discovered host relationships, credentials, and vulnerabilities as a semantic graph that persists across sessions. Subsequent engagements benefit from prior reconnaissance without manual knowledge transfer.
Run two sequential multi-step tasks against the same target range and query the Neo4j graph to confirm that relationships from the first run inform the second.
Multi-provider cost optimization
With nine supported providers including cost-competitive options like DeepSeek and Qwen, operators can route planning to a high-quality model (Claude, GPT-4) and routine tool selection to a cheaper endpoint, controlled entirely through environment variables.
Run identical tasks with DEEPSEEK_API_KEY versus ANTHROPIC_API_KEY and compare token spend, execution time, and task completion rate.
RepoDaily verdict
PentAGI delivers a genuinely autonomous pentesting platform where LLM-driven agents plan multi-step attack sequences, select from 20+ professional tools, and execute inside sandboxed Docker containers. The nine-provider LLM integration (including self-hosted Ollama), Graphiti/Neo4j knowledge graph, and strict MIT license compliance tooling set it apart from script-based alternatives. The Docker socket requirement and unpredictable LLM costs are the primary deployment constraints — this is a tool for security teams with Docker expertise, authorized testing scope, and a clear LLM budget.