🕷️PentAGI
vxcontrol/pentagi · homepage ↗
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
⭐ Very popular: 22k stars, gaining about 394 a week
View on GitHub ↗repo profile
momentum
durability
bus factor = how many people it takes to cover more than half the commits (6 months). 1 is a solo project; higher means the work is spread across a team. top-author share is the single busiest author's slice of those commits.
since we covered it
why it's a big deal
- Automates penetration testing tasks that normally require a human security engineer, letting teams run reconnaissance, exploitation, and reporting without manually driving each tool.
- Runs entirely in isolated Docker containers with hard caps on tool calls, so autonomous agents can execute offensive tooling inside a contained boundary rather than on a live workstation.
- Produces vulnerability reports with exploitation guides exportable to Markdown and PDF, giving security teams a documented output they can review and act on.
under the hood
- Go backend exposing REST and GraphQL APIs with Bearer token auth, backed by PostgreSQL with pgvector for embeddings, Neo4j for a knowledge graph, and an async queue for task processing.
- Multi-agent design splits work across Researcher, Developer, Executor, Adviser, and Planner roles, with the Planner decomposing tasks into 3 to 7 steps and mentor intervention triggered after repeated identical tool calls.
- Ships 20 or more security tools including nmap, metasploit, and sqlmap in sandboxed containers, connects to many LLM providers including OpenAI, Anthropic, Google, AWS Bedrock, Ollama, and DeepSeek, and adds OpenTelemetry, Grafana, and Langfuse for observability.
Radar summary, generated from the project's public sources
star history
- PR#28 8k 2026-02-25
- now 22k + 14k since first covered
curve is sampled from GitHub's star history, plus our own daily readings since we covered it; the dashed stretch is before we first covered it, the solid line since. figures at coverage are the numbers we printed then (approx.), current count is live.
understory
Quietly building: more output than attention, for now.
- output, commits & releases
- clout, star velocity
output = commits & releases; clout = star velocity, both 0 to 100 monthly indices; the gap where output runs above clout is the understory. The understory →
covered in
-
Autonomous offensive security agent
similar projects
compare these →- 🦉 strix
Python · 2.4× the stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
53k ACTIVE - ⚿ Infisical
TypeScript
Infisical is the open-source platform for secrets, certificates, and privileged access management.
29k ACTIVE - 🔌 TanStack AI
TypeScript · leaner, 3k stars
🤖 Type-safe, provider-agnostic TypeScript AI SDK for streaming chat, tool calling, agents, and multimodal apps across OpenAI, Anthropic, Gemini, React, Vue, Svelte, and Solid.
3k ACTIVE
comments
Sign in with GitHub to add your blip on PentAGI.