How bhavsec/autopentest-ai works
AutoPentest is an agentic web-application penetration-testing system: an LLM orchestrates discovery, phased testing, evidence-backed findings, and final review through an MCP server, with specialist roles, methodology references, and security-tool integrations. README documents the major capabilities and workflow; sampled source confirms selected server-side support modules, but does not expose all tool-call wiring, so uncertain internal links are omitted.
Main entry points: server.py WSTG MCP server · CLAUDE.md LLM orchestrator · reporter.md Reporter role · agent-roles Role guidance
Components 23
Agent orchestration
- LLM orchestrator
CLAUDE.md - Scout role
templates/agent-roles/scout.md - Analyzer role
templates/agent-roles/analyzer.md - Exploiter role
templates/agent-roles/exploiter.md - Reporter role
templates/agent-roles/reporter.md
Pentest workflow
- WSTG MCP server
server/server.py - Security tools
- Playwright MCP
- Burp proxy
- Endpoint priority
server/endpoint_priority.py - WAF evasion
server/waf_evasion.py - Task tree
server/task_tree.py
Methodology and context
- WSTG procedures
knowledge-base/web-security-testing-guide - Attack technique guides
knowledge-base/portswigger-academy - Role guidance
templates/agent-roles - Phase summaries
server/context_compression.py - Vulnerability chains
server/knowledge_graph.py
Evidence and reporting
- Tool output parser
server/tool_parsers.py - Result verification
server/tool_verification.py - Findings and gates
server/server.py - Pentest reports
server/server.py
Other components
- Pentest operator
- Web application
Connections 31
- Pentest operator → LLM orchestrator: starts engagement
- LLM orchestrator → WSTG MCP server: calls MCP tools
- LLM orchestrator → Scout role: spawns role
- LLM orchestrator → Analyzer role: spawns role
- LLM orchestrator → Exploiter role: spawns role
- LLM orchestrator → Reporter role: spawns role
- Scout role → Role guidance: reads guidance
- Analyzer role → Role guidance: reads guidance
- Exploiter role → Role guidance: reads guidance
- Reporter role → Role guidance: reads guidance
- LLM orchestrator → WSTG procedures: loads procedures
- LLM orchestrator → Attack technique guides: loads techniques
- Scout role → WSTG MCP server: uses tools
- Analyzer role → WSTG MCP server: uses tools
- Exploiter role → WSTG MCP server: uses tools
- Reporter role → WSTG MCP server: uses tools
- WSTG MCP server → Task tree: manages tasks
- WSTG MCP server → Endpoint priority: prioritizes endpoints
- WSTG MCP server → WAF evasion: provides bypass guidance
- WSTG MCP server → Vulnerability chains: supports chain analysis
- WSTG MCP server → Phase summaries: generates summaries
- WSTG MCP server → Security tools: runs tools
- Security tools → Web application: tests
- Security tools → Tool output parser: returns output
- Tool output parser → Result verification: structures results
- WSTG MCP server → Findings and gates: records findings
- WSTG MCP server → Findings and gates: enforces phase gates
- Reporter role → Findings and gates: reviews evidence
- WSTG MCP server → Pentest reports: generates reports
- Playwright MCP → Web application: tests in browser
- WSTG MCP server → Burp proxy: routes traffic