# bhavsec/autopentest-ai architecture

> Architecture diagram of the GitHub repository bhavsec/autopentest-ai, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bhavsec/autopentest-ai
- Repository: https://github.com/bhavsec/autopentest-ai

## Overview

AutoPentest is an agentic web-application penetration-testing system: an LLM orchestrates discovery, phased testing, evidence-backed findings, and final review through an MCP server, with specialist roles, methodology references, and security-tool integrations. README documents the major capabilities and workflow; sampled source confirms selected server-side support modules, but does not expose all tool-call wiring, so uncertain internal links are omitted.

Main entry points: [`server/server.py`](https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py) (WSTG MCP server), [`CLAUDE.md`](https://github.com/bhavsec/autopentest-ai/blob/main/CLAUDE.md) (LLM orchestrator), [`templates/agent-roles/reporter.md`](https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/reporter.md) (Reporter role), [`templates/agent-roles`](https://github.com/bhavsec/autopentest-ai/tree/main/templates/agent-roles) (Role guidance)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orchestration["Agent orchestration"]
  node_orchestrator["LLM orchestrator<br/>[CLAUDE.md]"]
  node_scout["Scout role<br/>[scout.md]"]
  node_analyzer["Analyzer role<br/>[analyzer.md]"]
  node_exploiter["Exploiter role<br/>[exploiter.md]"]
  node_reporter["Reporter role<br/>[reporter.md]"]
end

subgraph group_testing["Pentest workflow"]
  node_mcp["WSTG MCP server<br/>[server.py]"]
  node_security_tools["Security tools"]
  node_browser_mcp["Playwright MCP"]
  node_burp["Burp proxy"]
  node_endpoint_priority["Endpoint priority"]
  node_waf["WAF evasion<br/>[waf_evasion.py]"]
  node_task_tree[("Task tree<br/>[task_tree.py]")]
end

subgraph group_knowledge["Methodology and context"]
  node_knowledge_base["WSTG procedures"]
  node_techniques["Attack technique guides"]
  node_role_guides["Role guidance"]
  node_context["Phase summaries"]
  node_knowledge_graph[("Vulnerability chains<br/>[knowledge_graph.py]")]
end

subgraph group_assurance["Evidence and reporting"]
  node_tool_parser["Tool output parser<br/>[tool_parsers.py]"]
  node_verification["Result verification"]
  node_findings[("Findings and gates<br/>[server.py]")]
  node_reports["Pentest reports<br/>[server.py]"]
end

node_operator(("Pentest operator"))
node_target(("Web application"))

node_operator -->|"starts engagement"| node_orchestrator
node_orchestrator -->|"calls MCP tools"| node_mcp
node_orchestrator -->|"spawns role"| node_scout
node_orchestrator -->|"spawns role"| node_analyzer
node_orchestrator -->|"spawns role"| node_exploiter
node_orchestrator -->|"spawns role"| node_reporter
node_scout -->|"reads guidance"| node_role_guides
node_analyzer -->|"reads guidance"| node_role_guides
node_exploiter -->|"reads guidance"| node_role_guides
node_reporter -->|"reads guidance"| node_role_guides
node_orchestrator -->|"loads procedures"| node_knowledge_base
node_orchestrator -->|"loads techniques"| node_techniques
node_scout -->|"uses tools"| node_mcp
node_analyzer -->|"uses tools"| node_mcp
node_exploiter -->|"uses tools"| node_mcp
node_reporter -->|"uses tools"| node_mcp
node_mcp -->|"manages tasks"| node_task_tree
node_mcp -->|"prioritizes endpoints"| node_endpoint_priority
node_mcp -->|"provides bypass guidance"| node_waf
node_mcp -->|"supports chain analysis"| node_knowledge_graph
node_mcp -->|"generates summaries"| node_context
node_mcp -->|"runs tools"| node_security_tools
node_security_tools -->|"tests"| node_target
node_security_tools -->|"returns output"| node_tool_parser
node_tool_parser -->|"structures results"| node_verification
node_mcp -->|"records findings"| node_findings
node_mcp -->|"enforces phase gates"| node_findings
node_reporter -->|"reviews evidence"| node_findings
node_mcp -->|"generates reports"| node_reports
node_browser_mcp -->|"tests in browser"| node_target
node_mcp -.->|"routes traffic"| node_burp

click node_orchestrator "https://github.com/bhavsec/autopentest-ai/blob/main/CLAUDE.md"
click node_scout "https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/scout.md"
click node_analyzer "https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/analyzer.md"
click node_exploiter "https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/exploiter.md"
click node_reporter "https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/reporter.md"
click node_mcp "https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py"
click node_endpoint_priority "https://github.com/bhavsec/autopentest-ai/blob/main/server/endpoint_priority.py"
click node_waf "https://github.com/bhavsec/autopentest-ai/blob/main/server/waf_evasion.py"
click node_task_tree "https://github.com/bhavsec/autopentest-ai/blob/main/server/task_tree.py"
click node_knowledge_base "https://github.com/bhavsec/autopentest-ai/tree/main/knowledge-base/web-security-testing-guide"
click node_techniques "https://github.com/bhavsec/autopentest-ai/tree/main/knowledge-base/portswigger-academy"
click node_role_guides "https://github.com/bhavsec/autopentest-ai/tree/main/templates/agent-roles"
click node_context "https://github.com/bhavsec/autopentest-ai/blob/main/server/context_compression.py"
click node_knowledge_graph "https://github.com/bhavsec/autopentest-ai/blob/main/server/knowledge_graph.py"
click node_tool_parser "https://github.com/bhavsec/autopentest-ai/blob/main/server/tool_parsers.py"
click node_verification "https://github.com/bhavsec/autopentest-ai/blob/main/server/tool_verification.py"
click node_findings "https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py"
click node_reports "https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_orchestrator,node_scout,node_analyzer,node_exploiter,node_reporter toneBlue
class node_mcp,node_security_tools,node_browser_mcp,node_burp,node_endpoint_priority,node_waf,node_task_tree toneAmber
class node_knowledge_base,node_techniques,node_role_guides,node_context,node_knowledge_graph toneMint
class node_tool_parser,node_verification,node_findings,node_reports toneRose
class node_operator,node_target toneIndigo
```

## Components

### Agent orchestration

- [LLM orchestrator](https://github.com/bhavsec/autopentest-ai/blob/main/CLAUDE.md): `CLAUDE.md`
- [Scout role](https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/scout.md): `templates/agent-roles/scout.md`
- [Analyzer role](https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/analyzer.md): `templates/agent-roles/analyzer.md`
- [Exploiter role](https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/exploiter.md): `templates/agent-roles/exploiter.md`
- [Reporter role](https://github.com/bhavsec/autopentest-ai/blob/main/templates/agent-roles/reporter.md): `templates/agent-roles/reporter.md`

### Pentest workflow

- [WSTG MCP server](https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py): `server/server.py`
- **Security tools**
- **Playwright MCP**
- **Burp proxy**
- [Endpoint priority](https://github.com/bhavsec/autopentest-ai/blob/main/server/endpoint_priority.py): `server/endpoint_priority.py`
- [WAF evasion](https://github.com/bhavsec/autopentest-ai/blob/main/server/waf_evasion.py): `server/waf_evasion.py`
- [Task tree](https://github.com/bhavsec/autopentest-ai/blob/main/server/task_tree.py): `server/task_tree.py`

### Methodology and context

- [WSTG procedures](https://github.com/bhavsec/autopentest-ai/tree/main/knowledge-base/web-security-testing-guide): `knowledge-base/web-security-testing-guide`
- [Attack technique guides](https://github.com/bhavsec/autopentest-ai/tree/main/knowledge-base/portswigger-academy): `knowledge-base/portswigger-academy`
- [Role guidance](https://github.com/bhavsec/autopentest-ai/tree/main/templates/agent-roles): `templates/agent-roles`
- [Phase summaries](https://github.com/bhavsec/autopentest-ai/blob/main/server/context_compression.py): `server/context_compression.py`
- [Vulnerability chains](https://github.com/bhavsec/autopentest-ai/blob/main/server/knowledge_graph.py): `server/knowledge_graph.py`

### Evidence and reporting

- [Tool output parser](https://github.com/bhavsec/autopentest-ai/blob/main/server/tool_parsers.py): `server/tool_parsers.py`
- [Result verification](https://github.com/bhavsec/autopentest-ai/blob/main/server/tool_verification.py): `server/tool_verification.py`
- [Findings and gates](https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py): `server/server.py`
- [Pentest reports](https://github.com/bhavsec/autopentest-ai/blob/main/server/server.py): `server/server.py`

### Other components

- **Pentest operator**
- **Web application**

## Connections

- Pentest operator → LLM orchestrator: starts engagement
- LLM orchestrator → WSTG MCP server: calls MCP tools
- LLM orchestrator → Scout role: spawns role
- LLM orchestrator → Analyzer role: spawns role
- LLM orchestrator → Exploiter role: spawns role
- LLM orchestrator → Reporter role: spawns role
- Scout role → Role guidance: reads guidance
- Analyzer role → Role guidance: reads guidance
- Exploiter role → Role guidance: reads guidance
- Reporter role → Role guidance: reads guidance
- LLM orchestrator → WSTG procedures: loads procedures
- LLM orchestrator → Attack technique guides: loads techniques
- Scout role → WSTG MCP server: uses tools
- Analyzer role → WSTG MCP server: uses tools
- Exploiter role → WSTG MCP server: uses tools
- Reporter role → WSTG MCP server: uses tools
- WSTG MCP server → Task tree: manages tasks
- WSTG MCP server → Endpoint priority: prioritizes endpoints
- WSTG MCP server → WAF evasion: provides bypass guidance
- WSTG MCP server → Vulnerability chains: supports chain analysis
- WSTG MCP server → Phase summaries: generates summaries
- WSTG MCP server → Security tools: runs tools
- Security tools → Web application: tests
- Security tools → Tool output parser: returns output
- Tool output parser → Result verification: structures results
- WSTG MCP server → Findings and gates: records findings
- WSTG MCP server → Findings and gates: enforces phase gates
- Reporter role → Findings and gates: reviews evidence
- WSTG MCP server → Pentest reports: generates reports
- Playwright MCP → Web application: tests in browser
- WSTG MCP server → Burp proxy: routes traffic