Autopentest Ai

AutoPentest

An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references.

Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized agents (Scout, Analyzer, Exploiter, Reporter) to test for XSS, SQLi, SSRF, SSTI, IDOR and more. No false positives — every finding is backed by real, reproducible evidence with quality gates enforcing proof at every phase. Includes 31 PortSwigger technique guides, adaptive WAF evasion for 12 vendors, cross-phase vulnerability chaining, and risk-weighted endpoint prioritization. Run it with Claude Code, the API, or go fully offline using Ollama models.

> Think of it as: A senior pentester's methodology encoded into an MCP server — 109 OWASP tests, 31 PortSwigger attack technique guides, 68+ MCP tools, 27 security tools, 4 specialized agent roles, 7 structured phases, automated quality assurance, and a zero-context final review.

---

Table of Contents

• [Why AutoPentest?](#why-autopentest)
• [Architecture](#architecture)
• [Features](#features)
• [Agent Role System](#agent-role-system)
• [Quick Start](#quick-start)
• [Usage](#usage)
• [Testing Phases](#testing-phases)
• [Security Tools](#security-tools)
• [WSTG Knowledge Base](#wstg-knowledge-base)
• [PortSwigger Technique Guides](#portswigger-technique-guides)
• [Quality Assurance System](#quality-assurance-system)
• [Benchmarking](#benchmarking)
• [Example Report](#example-report)
• [Configuration](#configuration)
• [Multi-Domain Testing](#multi-domain-testing)
• [Crash Recovery](#crash-recovery)
• [Project Structure](#project-structure)
• [Requirements](#requirements)
• [FAQ](#faq)
• [Disclaimer](#disclaimer)

---

Why AutoPentest?

Manual penetration testing is thorough but slow. Automated scanners are fast but shallow. AutoPentest bridges the gap:

| Capability | Manual Pentest | Automated Scanner | AutoPentest | |------------|:-:|:-:|:-:| | Full OWASP WSTG coverage | Depends on tester | Partial | 109 tests | | Business logic testing | Yes | No | Yes | | Multi-step exploitation | Yes | Limited | Yes | | Vulnerability chaining | Yes | No | Yes | | Evidence-based findings | Yes | Template output | Reproducible curl commands | | Consistent quality | Varies | Yes | Phase gates + Final Judge | | Speed | Days | Minutes | Hours | | Cross-domain auth (SSO/OIDC) | Manual setup | Usually fails | Automated handling |

---

Architecture

┌─────────────────────────────────────────────────────────────┐
│                  LLM Orchestrator (Claude)                  │
│                                                             │
│  Reads CLAUDE.md workflow, manages phases,                  │
│  spawns role-specialized subagents                          │
└──────────┬──────────┬──────────┬──────────┬─────────────────┘
           │          │          │          │
     ┌─────▼────┐ ┌───▼─────┐ ┌──▼───────┐ ┌▼─────────┐
     │  Scout   │ │Analyzer │ │Exploiter │ │ Reporter │
     │  (recon) │ │ (vuln   │ │ (proof)  │ │ (QA /    │
     │          │ │  disc.) │ │          │ │  judge)  │
     └──────────┘ └─────────┘ └──────────┘ └──────────┘
           │          │          │          │
           │     MCP  │          │     MCP  │
           ▼          ▼          ▼          ▼
┌──────────────────────────┐  ┌──────────────────────┐
│  WSTG MCP Server         │  │  Playwright MCP      │
│  (68+ tools)             │  │  (Browser Testing)   │
│                          │  │                      │
│  ◦ 109 WSTG tests        │  │  ◦ DOM XSS proof     │
│  ◦ 31 technique guides   │  │  ◦ Clickjacking      │
│  ◦ Task tree             │  │  ◦ JS-rendered auth  │
│  ◦ Knowledge graph       │  └──────────────────────┘
│  ◦ WAF evasion           │
│  ◦ Tool output parser    │
│  ◦ Results verification  │  docker exec
│  ◦ Context compression   │       │
│  ◦ Endpoint priority     │       ▼
│  ◦ Quality gates         │  ┌──────────────────────┐
│  ◦ Report generation     │  │  autopentest-tools   │
└──────────────────────────┘  │  (Docker Container)  │
                              │                      │
                              │  27 security tools:  │
                              │  nuclei, sqlmap,     │
                              │  dalfox, katana,     │
                              │  ffuf, nmap ...      │
                              │                      │
                              │  Burp proxy          │
                              │  passthrough         │
                              └──────────────────────┘

How it works:

1. Claude Code reads CLAUDE.md for the complete pentest methodology and orchestrates the 7-phase workflow
2. Role-specialized subagents (Scout, Analyzer, Exploiter, Reporter) execute focused tasks with dedicated prompt templates, tool guidance, and anti-patterns
3. WSTG MCP Server (68+ tools) provides OWASP test procedures, 31 PortSwigger technique guides, hierarchical task tree, knowledge graph, WAF evasion, endpoint prioritization, results verification, context compression, quality gates, and report generation
4. Docker Container runs all 27 security tools — traffic optionally routes through Burp Suite for passive monitoring
5. Playwright MCP handles browser-based testing (DOM XSS, clickjacking, JS-rendered login pages)

---

Features

Comprehensive OWASP Coverage

• 109 WSTG test cases across 12 categories — from information gathering to API testing
• Each test includes step-by-step CLI procedures, context-specific payloads, detection criteria, and severity rubrics
• Tests are prioritized (MUST/SHOULD) with conditional triggers so nothing relevant is skipped

31 PortSwigger Attack Technique Guides

• Sourced from PortSwigger Web Security Academy — detection methods, exploitation techniques, payloads, cheat sheets, and WAF bypass patterns
• Organized by vulnerability class (SQLi, XSS, SSRF, JWT, OAuth, etc.) for direct use during testing
• Integrated into every testing phase — agents automatically load the relevant technique guide before testing each vulnerability class
• Database/platform-specific payload tables (Oracle vs MySQL vs PostgreSQL vs MSSQL for SQLi, Jinja2 vs Twig vs Freemarker for SSTI, etc.)
• WAF bypass patterns organized by bypass level (basic → intermediate → advanced)

27 Pre-Configured Security Tools

• All tools pre-installed in a single Docker image — make setup and you're ready
• Tools organized by phase: discovery, injection testing, authentication, cryptography, API testing
• Automatic Burp Suite proxy integration for passive traffic monitoring

Structured 7-Phase Workflow

• Phase 0: Application Discovery & Mapping
• Phase 1: Information Gathering & Reconnaissance
• Phase 2: Configuration & Deployment Testing
• Phase 3: Identity, Authentication, Authorization & Session Management
• Phase 4: Input Validation Testing (pipelined XSS/SQLi/SSRF pipelines)
• Phase 5: Error Handling, Cryptography, Business Logic, Client-Side & API Testing
• Phase 6: Coverage Verification & Reporting
• Phase 7: Final Judge Review & Remediation

Quality Assurance System

• Automated phase gates — each phase must pass quality checks before proceeding
• Quality Reviewer subagent at every phase transition identifies gaps and suggests improvements
• Final Judge — a zero-context agent reviews the entire engagement cold, like an external QA reviewer
• Exhaustion gates — "not vulnerable" requires proof of sufficient testing effort (minimum techniques and bypass attempts)

Evidence-Based Findings

• Every finding requires reproducible curl commands and full request/response evidence
• Three-tier classification: EXPLOITED (proven impact), POTENTIAL (blocked by control), FALSE_POSITIVE (control holds)
• Anti-hallucination framework — "no exploit = no finding" enforced at every level
• Evidence checklists per vulnerability class verified before any finding is logged

Role-Specialized Subagents

• 4 dedicated roles with focused prompt templates, tool guidance, and anti-patterns:
• Scout — reconnaissance only, maps attack surface without sending payloads (Phase 0-1)
• Analyzer — identifies potential sinks with canary/witness payloads, builds exploitation queues (Phase 2-5 analysis)
• Exploiter — consumes Analyzer output, proves exploitation with evidence, logs confirmed findings (Phase 4 exploitation)
• Reporter — quality review and Final Judge, reviews data without sending requests (QA + post-report)
• Validation checkpoint between analysis and exploitation prevents wasted effort
• Each role has explicit allowed/restricted tool lists and input/output contracts

Pipelined Exploitation (Phase 4)

• 3 independent two-stage pipelines run in parallel: XSS, Injection (SQLi/CMDi), SSRF/SSTI
• Each pipeline: Analyzer (discover → analyze → queue) → validation checkpoint → Exploiter (exploit → log)
• Each pipeline loads its PortSwigger technique guide for detection methods, cheat sheets, and WAF bypass patterns
• WAF intelligence shared across all pipelines
• Context-aware witness payloads for 13 sink types

Adaptive WAF Evasion

• Automatic WAF fingerprinting from response headers, body, and status codes — identifies 12 WAF vendors (Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, F5, FortiWeb, Sucuri, Barracuda, Wordfence, NAXSI, Citrix)
• Vendor-specific bypass payloads organized by complexity level (basic → intermediate → advanced)
• WAF intelligence shared across all agents via deliverable system
• Agents automatically identify WAF on first block response and switch to tailored bypass payloads

Cross-Phase Knowledge Graph

• Entity-relationship graph tracks endpoints, parameters, technologies, findings, cookies, domains, and user roles
• Automated vulnerability chaining via BFS path finding with 7 predefined chain patterns:
• XSS + missing CSP, XSS + weak cookie (no HttpOnly), Open redirect + OAuth callback
• IDOR + admin role, SSRF + cloud metadata, No lockout + no MFA, CORS + sensitive endpoint
• Severity upgrades when chaining materially increases impact
• Populated throughout testing, queried after Phase 4 for chain discovery

Hierarchical Task Tree

• Persistent tree structure (phases as branches, tests as leaves) prevents LLM depth-first bias and context loss
• Main agent maintains strategic macro view; subagents update only their assigned leaf nodes
• Auto-propagation: when all children complete, parent auto-completes
• Phase-level completion percentages for informed decision-making

Endpoint Risk Prioritization

• Score and sort endpoints by risk for prioritized testing — highest risk tested first
• Scoring factors: parameter count, technology risk indicators, taint chain confidence, tool convergence, auth requirements, injectable parameter names
• Integrated into Phase 0 endpoint map generation

Tool Output Parsing

• 13 built-in parsers for common CLI tools (nmap, nuclei, sqlmap, ffuf, httpx, whatweb, testssl, nikto, dalfox, katana, gau, wapiti, commix)
• Condenses raw tool output 3-5x while preserving key findings, endpoints, and errors
• Configurable verbosity: summary (~15 lines), detailed (~50 lines), full (complete parsed output)

CLI Tool Results Verification

• Automatic validation of CLI tool output quality — detects empty output, proxy errors, permission issues, and suspicious results
• 10 per-tool validators (nmap, nuclei, sqlmap, ffuf, feroxbuster, testssl, dalfox, wapiti, katana, httpx) with corrected command suggestions
• When a tool produces empty or suspicious output, the validator suggests fixes (e.g., add -Pn for nmap, remove proxy env vars, try different flags)
• Integrated into the tool execution workflow — agents call verify_tool_result() after every CLI tool run

Progressive Context Compression

• Phase summaries (~500-800 words) auto-generated when phase gates pass — capturing findings, coverage, tool results, and attack surface in compressed form
• Prevents context degradation in long-running engagements by replacing raw historical data with structured summaries
• get_engagement_summary() combines all phase summaries into a single overview for injecting into new subagent prompts
• Summaries stored as deliverables — accessible by any downstream agent without requiring full engagement history

Counterfactual Analysis (Second-Pass Discovery)

• After an Analyzer completes with vulnerabilities found, a second Analyzer is spawned with instructions to "assume those vulns are patched"
• The counterfactual Analyzer searches for additional vulnerabilities: different endpoints, different parameters, different injection contexts, logic flaws
• Results are appended to the existing exploitation queue (automatic merge with deduplication by endpoint+parameter and auto-incrementing IDs)
• Based on PenHeal ablation research showing +71% vulnerability coverage with counterfactual prompting

Multi-Domain Support

• Automatic SSO/OAuth/OIDC/SAML detection and handling
• Per-domain scope registration, crawling, and testing
• Cookie jar management for cross-domain session persistence
• 6-level authentication failure escalation (alternative grants → PKCE → headless browser → token extraction → user provision → unauthenticated)

Crash-Safe Engagement Management

• Append-only findings.md and progress.log survive crashes
• Git workspace checkpointing with rollback capability
• Auto-resume on interruption — resume-prompt.md auto-generated at every checkpoint with full context (target, credentials, current phase, remaining tests, scope). Paste into a new session to continue exactly where you left off
• Mid-phase checkpoint granularity — tracks which tests within a phase are completed, not just phase-level state
• Full audit trail of every MCP tool call with timestamps

Professional Reporting

• Markdown reports with executive summary, findings by severity, test coverage matrix, and tool coverage
• Per-category coverage percentages and gap analysis
• Vulnerability chaining analysis documented
• Final Judge observations and quality notes included

---

Agent Role System

AutoPentest uses 4 specialized agent roles instead of generic subagents. Each role has a dedicated prompt template with focused tool guidance, input/output contracts, and anti-patterns.

| Role | Template | Purpose | Phases | |------|----------|---------|--------| | Scout | templates/agent-roles/scout.md | Reconnaissance and attack surface mapping | Phase 0-1, source code discovery | | Analyzer | templates/agent-roles/analyzer.md | Vulnerability discovery with canary/witness payloads | Phase 2-5 analysis | | Exploiter | templates/agent-roles/exploiter.md | Exploitation proof with evidence | Phase 4 exploitation | | Reporter | templates/agent-roles/reporter.md | Quality review and Final Judge | Phase transitions, post-report |

How the Pipeline Works

Phase 4 (highest-impact testing) uses a two-stage pipeline per vulnerability class:

┌──────────────────────────────────────────────────────────────┐
│                    Pipeline 1: XSS                           │
│                                                              │
│  Analyzer (75 turns)          Exploiter (75 turns)           │
│  ┌─────────────────────┐      ┌─────────────────────┐        │
│  │ Discover endpoints  │      │ Load Analyzer queue │        │
│  │ Send canary payloads│─────▶│ Attempt exploitation│        │
│  │ Build exploit queue │ gate │ Prove impact        │        │
│  │ Save deliverable    │      │ Log findings        │        │
│  └─────────────────────┘      └─────────────────────┘        │
│                          ▲

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [bhavsec](https://github.com/bhavsec)
- **Source:** [bhavsec/autopentest-ai](https://github.com/bhavsec/autopentest-ai)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.