# Autopentest Ai > Agentic Pentesting MCP server that discovers, exploits, and reports web application vulnerabilities. - **Type:** MCP server - **Install:** `agentstack add mcp-bhavsec-autopentest-ai` - **Verified:** Pending review - **Seller:** [bhavsec](https://agentstack.voostack.com/s/bhavsec) - **Installs:** 0 - **Category:** [Integrations](https://agentstack.voostack.com/c/integrations) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [bhavsec](https://github.com/bhavsec) - **Source:** https://github.com/bhavsec/autopentest-ai ## Install ```sh agentstack add mcp-bhavsec-autopentest-ai ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # AutoPentest **An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references.** Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized agents (Scout, Analyzer, Exploiter, Reporter) to test for XSS, SQLi, SSRF, SSTI, IDOR and more. No false positives — every finding is backed by real, reproducible evidence with quality gates enforcing proof at every phase. Includes 31 PortSwigger technique guides, adaptive WAF evasion for 12 vendors, cross-phase vulnerability chaining, and risk-weighted endpoint prioritization. Run it with Claude Code, the API, or go fully offline using Ollama models. > **Think of it as:** A senior pentester's methodology encoded into an MCP server — 109 OWASP tests, 31 PortSwigger attack technique guides, 68+ MCP tools, 27 security tools, 4 specialized agent roles, 7 structured phases, automated quality assurance, and a zero-context final review. --- ## Table of Contents - [Why AutoPentest?](#why-autopentest) - [Architecture](#architecture) - [Features](#features) - [Agent Role System](#agent-role-system) - [Quick Start](#quick-start) - [Usage](#usage) - [Testing Phases](#testing-phases) - [Security Tools](#security-tools) - [WSTG Knowledge Base](#wstg-knowledge-base) - [PortSwigger Technique Guides](#portswigger-technique-guides) - [Quality Assurance System](#quality-assurance-system) - [Benchmarking](#benchmarking) - [Example Report](#example-report) - [Configuration](#configuration) - [Multi-Domain Testing](#multi-domain-testing) - [Crash Recovery](#crash-recovery) - [Project Structure](#project-structure) - [Requirements](#requirements) - [FAQ](#faq) - [Disclaimer](#disclaimer) --- ## Why AutoPentest? Manual penetration testing is thorough but slow. Automated scanners are fast but shallow. AutoPentest bridges the gap: | Capability | Manual Pentest | Automated Scanner | AutoPentest | |------------|:-:|:-:|:-:| | Full OWASP WSTG coverage | Depends on tester | Partial | **109 tests** | | Business logic testing | Yes | No | **Yes** | | Multi-step exploitation | Yes | Limited | **Yes** | | Vulnerability chaining | Yes | No | **Yes** | | Evidence-based findings | Yes | Template output | **Reproducible curl commands** | | Consistent quality | Varies | Yes | **Phase gates + Final Judge** | | Speed | Days | Minutes | **Hours** | | Cross-domain auth (SSO/OIDC) | Manual setup | Usually fails | **Automated handling** | --- ## Architecture ``` ┌─────────────────────────────────────────────────────────────┐ │ LLM Orchestrator (Claude) │ │ │ │ Reads CLAUDE.md workflow, manages phases, │ │ spawns role-specialized subagents │ └──────────┬──────────┬──────────┬──────────┬─────────────────┘ │ │ │ │ ┌─────▼────┐ ┌───▼─────┐ ┌──▼───────┐ ┌▼─────────┐ │ Scout │ │Analyzer │ │Exploiter │ │ Reporter │ │ (recon) │ │ (vuln │ │ (proof) │ │ (QA / │ │ │ │ disc.) │ │ │ │ judge) │ └──────────┘ └─────────┘ └──────────┘ └──────────┘ │ │ │ │ │ MCP │ │ MCP │ ▼ ▼ ▼ ▼ ┌──────────────────────────┐ ┌──────────────────────┐ │ WSTG MCP Server │ │ Playwright MCP │ │ (68+ tools) │ │ (Browser Testing) │ │ │ │ │ │ ◦ 109 WSTG tests │ │ ◦ DOM XSS proof │ │ ◦ 31 technique guides │ │ ◦ Clickjacking │ │ ◦ Task tree │ │ ◦ JS-rendered auth │ │ ◦ Knowledge graph │ └──────────────────────┘ │ ◦ WAF evasion │ │ ◦ Tool output parser │ │ ◦ Results verification │ docker exec │ ◦ Context compression │ │ │ ◦ Endpoint priority │ ▼ │ ◦ Quality gates │ ┌──────────────────────┐ │ ◦ Report generation │ │ autopentest-tools │ └──────────────────────────┘ │ (Docker Container) │ │ │ │ 27 security tools: │ │ nuclei, sqlmap, │ │ dalfox, katana, │ │ ffuf, nmap ... │ │ │ │ Burp proxy │ │ passthrough │ └──────────────────────┘ ``` **How it works:** 1. **Claude Code** reads `CLAUDE.md` for the complete pentest methodology and orchestrates the 7-phase workflow 2. **Role-specialized subagents** (Scout, Analyzer, Exploiter, Reporter) execute focused tasks with dedicated prompt templates, tool guidance, and anti-patterns 3. **WSTG MCP Server** (68+ tools) provides OWASP test procedures, 31 PortSwigger technique guides, hierarchical task tree, knowledge graph, WAF evasion, endpoint prioritization, results verification, context compression, quality gates, and report generation 4. **Docker Container** runs all 27 security tools — traffic optionally routes through Burp Suite for passive monitoring 5. **Playwright MCP** handles browser-based testing (DOM XSS, clickjacking, JS-rendered login pages) --- ## Features ### Comprehensive OWASP Coverage - **109 WSTG test cases** across 12 categories — from information gathering to API testing - Each test includes step-by-step CLI procedures, context-specific payloads, detection criteria, and severity rubrics - Tests are prioritized (MUST/SHOULD) with conditional triggers so nothing relevant is skipped ### 31 PortSwigger Attack Technique Guides - Sourced from [PortSwigger Web Security Academy](https://portswigger.net/web-security) — detection methods, exploitation techniques, payloads, cheat sheets, and WAF bypass patterns - Organized by vulnerability class (SQLi, XSS, SSRF, JWT, OAuth, etc.) for direct use during testing - Integrated into every testing phase — agents automatically load the relevant technique guide before testing each vulnerability class - Database/platform-specific payload tables (Oracle vs MySQL vs PostgreSQL vs MSSQL for SQLi, Jinja2 vs Twig vs Freemarker for SSTI, etc.) - WAF bypass patterns organized by bypass level (basic → intermediate → advanced) ### 27 Pre-Configured Security Tools - All tools pre-installed in a single Docker image — `make setup` and you're ready - Tools organized by phase: discovery, injection testing, authentication, cryptography, API testing - Automatic Burp Suite proxy integration for passive traffic monitoring ### Structured 7-Phase Workflow - **Phase 0:** Application Discovery & Mapping - **Phase 1:** Information Gathering & Reconnaissance - **Phase 2:** Configuration & Deployment Testing - **Phase 3:** Identity, Authentication, Authorization & Session Management - **Phase 4:** Input Validation Testing (pipelined XSS/SQLi/SSRF pipelines) - **Phase 5:** Error Handling, Cryptography, Business Logic, Client-Side & API Testing - **Phase 6:** Coverage Verification & Reporting - **Phase 7:** Final Judge Review & Remediation ### Quality Assurance System - **Automated phase gates** — each phase must pass quality checks before proceeding - **Quality Reviewer** subagent at every phase transition identifies gaps and suggests improvements - **Final Judge** — a zero-context agent reviews the entire engagement cold, like an external QA reviewer - **Exhaustion gates** — "not vulnerable" requires proof of sufficient testing effort (minimum techniques and bypass attempts) ### Evidence-Based Findings - Every finding requires reproducible curl commands and full request/response evidence - **Three-tier classification:** EXPLOITED (proven impact), POTENTIAL (blocked by control), FALSE_POSITIVE (control holds) - **Anti-hallucination framework** — "no exploit = no finding" enforced at every level - Evidence checklists per vulnerability class verified before any finding is logged ### Role-Specialized Subagents - **4 dedicated roles** with focused prompt templates, tool guidance, and anti-patterns: - **Scout** — reconnaissance only, maps attack surface without sending payloads (Phase 0-1) - **Analyzer** — identifies potential sinks with canary/witness payloads, builds exploitation queues (Phase 2-5 analysis) - **Exploiter** — consumes Analyzer output, proves exploitation with evidence, logs confirmed findings (Phase 4 exploitation) - **Reporter** — quality review and Final Judge, reviews data without sending requests (QA + post-report) - Validation checkpoint between analysis and exploitation prevents wasted effort - Each role has explicit allowed/restricted tool lists and input/output contracts ### Pipelined Exploitation (Phase 4) - 3 independent **two-stage pipelines** run in parallel: XSS, Injection (SQLi/CMDi), SSRF/SSTI - Each pipeline: Analyzer (discover → analyze → queue) → validation checkpoint → Exploiter (exploit → log) - Each pipeline loads its PortSwigger technique guide for detection methods, cheat sheets, and WAF bypass patterns - WAF intelligence shared across all pipelines - Context-aware witness payloads for 13 sink types ### Adaptive WAF Evasion - **Automatic WAF fingerprinting** from response headers, body, and status codes — identifies 12 WAF vendors (Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, F5, FortiWeb, Sucuri, Barracuda, Wordfence, NAXSI, Citrix) - **Vendor-specific bypass payloads** organized by complexity level (basic → intermediate → advanced) - WAF intelligence shared across all agents via deliverable system - Agents automatically identify WAF on first block response and switch to tailored bypass payloads ### Cross-Phase Knowledge Graph - **Entity-relationship graph** tracks endpoints, parameters, technologies, findings, cookies, domains, and user roles - **Automated vulnerability chaining** via BFS path finding with 7 predefined chain patterns: - XSS + missing CSP, XSS + weak cookie (no HttpOnly), Open redirect + OAuth callback - IDOR + admin role, SSRF + cloud metadata, No lockout + no MFA, CORS + sensitive endpoint - Severity upgrades when chaining materially increases impact - Populated throughout testing, queried after Phase 4 for chain discovery ### Hierarchical Task Tree - Persistent tree structure (phases as branches, tests as leaves) prevents LLM depth-first bias and context loss - Main agent maintains strategic macro view; subagents update only their assigned leaf nodes - Auto-propagation: when all children complete, parent auto-completes - Phase-level completion percentages for informed decision-making ### Endpoint Risk Prioritization - Score and sort endpoints by risk for prioritized testing — highest risk tested first - Scoring factors: parameter count, technology risk indicators, taint chain confidence, tool convergence, auth requirements, injectable parameter names - Integrated into Phase 0 endpoint map generation ### Tool Output Parsing - **13 built-in parsers** for common CLI tools (nmap, nuclei, sqlmap, ffuf, httpx, whatweb, testssl, nikto, dalfox, katana, gau, wapiti, commix) - Condenses raw tool output 3-5x while preserving key findings, endpoints, and errors - Configurable verbosity: summary (~15 lines), detailed (~50 lines), full (complete parsed output) ### CLI Tool Results Verification - Automatic validation of CLI tool output quality — detects empty output, proxy errors, permission issues, and suspicious results - **10 per-tool validators** (nmap, nuclei, sqlmap, ffuf, feroxbuster, testssl, dalfox, wapiti, katana, httpx) with corrected command suggestions - When a tool produces empty or suspicious output, the validator suggests fixes (e.g., add `-Pn` for nmap, remove proxy env vars, try different flags) - Integrated into the tool execution workflow — agents call `verify_tool_result()` after every CLI tool run ### Progressive Context Compression - **Phase summaries** (~500-800 words) auto-generated when phase gates pass — capturing findings, coverage, tool results, and attack surface in compressed form - Prevents context degradation in long-running engagements by replacing raw historical data with structured summaries - `get_engagement_summary()` combines all phase summaries into a single overview for injecting into new subagent prompts - Summaries stored as deliverables — accessible by any downstream agent without requiring full engagement history ### Counterfactual Analysis (Second-Pass Discovery) - After an Analyzer completes with vulnerabilities found, a **second Analyzer** is spawned with instructions to "assume those vulns are patched" - The counterfactual Analyzer searches for **additional** vulnerabilities: different endpoints, different parameters, different injection contexts, logic flaws - Results are appended to the existing exploitation queue (automatic merge with deduplication by endpoint+parameter and auto-incrementing IDs) - Based on PenHeal ablation research showing +71% vulnerability coverage with counterfactual prompting ### Multi-Domain Support - Automatic SSO/OAuth/OIDC/SAML detection and handling - Per-domain scope registration, crawling, and testing - Cookie jar management for cross-domain session persistence - 6-level authentication failure escalation (alternative grants → PKCE → headless browser → token extraction → user provision → unauthenticated) ### Crash-Safe Engagement Management - Append-only `findings.md` and `progress.log` survive crashes - Git workspace checkpointing with rollback capability - **Auto-resume on interruption** — `resume-prompt.md` auto-generated at every checkpoint with full context (target, credentials, current phase, remaining tests, scope). Paste into a new session to continue exactly where you left off - Mid-phase checkpoint granularity — tracks which tests within a phase are completed, not just phase-level state - Full audit trail of every MCP tool call with timestamps ### Professional Reporting - Markdown reports with executive summary, findings by severity, test coverage matrix, and tool coverage - Per-category coverage percentages and gap analysis - Vulnerability chaining analysis documented - Final Judge observations and quality notes included --- ## Agent Role System AutoPentest uses 4 specialized agent roles instead of generic subagents. Each role has a dedicated prompt template with focused tool guidance, input/output contracts, and anti-patterns. | Role | Template | Purpose | Phases | |------|----------|---------|--------| | **Scout** | `templates/agent-roles/scout.md` | Reconnaissance and attack surface mapping | Phase 0-1, source code discovery | | **Analyzer** | `templates/agent-roles/analyzer.md` | Vulnerability discovery with canary/witness payloads | Phase 2-5 analysis | | **Exploiter** | `templates/agent-roles/exploiter.md` | Exploitation proof with evidence | Phase 4 exploitation | | **Reporter** | `templates/agent-roles/reporter.md` | Quality review and Final Judge | Phase transitions, post-report | ### How the Pipeline Works Phase 4 (highest-impact testing) uses a two-stage pipeline per vulnerability class: ``` ┌──────────────────────────────────────────────────────────────┐ │ Pipeline 1: XSS │ │ │ │ Analyzer (75 turns) Exploiter (75 turns) │ │ ┌─────────────────────┐ ┌─────────────────────┐ │ │ │ Discover endpoints │ │ Load Analyzer queue │ │ │ │ Send canary payloads│─────▶│ Attempt exploitation│ │ │ │ Build exploit queue │ gate │ Prove impact │ │ │ │ Save deliverable │ │ Log findings │ │ │ └─────────────────────┘ └─────────────────────┘ │ │ ▲ … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [bhavsec](https://github.com/bhavsec) - **Source:** [bhavsec/autopentest-ai](https://github.com/bhavsec/autopentest-ai) - **License:** Apache-2.0 Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-bhavsec-autopentest-ai - Seller: https://agentstack.voostack.com/s/bhavsec - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.