Repository navigation
Home
Your AI. Your rules. Every target in scope — because you authorized it.
Pentest Harness is an open-source, dark-first AI agent workspace built for offensive security work — authorized penetration tests, bug bounty research, security labs, and CTFs. Every capability is a plugin on a replaceable seam: swap the model, the shell, the sandbox, the session store — nothing is welded shut.
Bring your own key. Sessions stay local. Nothing phones home.
| 🤖 Any model | OpenAI, Anthropic, DeepSeek, Google, Mistral, Groq, OpenRouter, Azure — or any OpenAI-compatible gateway. One-click auto-discovery. |
| 🔌 Everything is a plugin | Model adapters, tools, sessions, settings, credentials — all replaceable from configuration. No closed core. |
| 🧰 Full toolset | Shell, filesystem, web research, skills, goals, subagents, background jobs, workflows, agent teams. |
| 🛡️ Pentest Mode | A professional offensive-security operating standard for authorized engagements. |
| 💾 Durable sessions | JSONL/SQLite persistence with replay — resume exactly where you left off. |
| 🎨 Dark-only UI | A focused, low-glare interface built for long engagements. |
| 🔐 Secure by default | API keys live in an owner-only credential store — never in settings files or logs. |
git clone https://github.com/S1N6H/pentest-harness.git
cd pentest-harness && pnpm install && pnpm build
pnpm dsh web # → http://127.0.0.1:2323Then: Settings → Models → Add provider → paste key → pick model → hunt.
| I want to… | Read |
|---|---|
| Connect my first AI model | Models & Providers |
| Know every tool the agent has | Tool Arsenal |
| Contain the blast radius | Sandbox & Safety Rails |
| Run many agents on one target | Subagents & Agent Teams |
| Automate and schedule | Jobs, Schedules & Workflows |
| Drive it from my own code | Python SDK & CLI |
| Build my own plugin | Plugin Development |
| Tune the engine | Settings & Credentials |
| Something broke | FAQ & Troubleshooting |
Everything in this workspace exists for authorized security testing — your own engagements, your own scope, programs that granted you permission. The harness is a professional tool, not a weapon for hire. Scope your targets, document your authority, and hunt clean.
⭐ Star the repo · 🛠️ Report a bug · 🤝 Contribute · 📖 Full docs in /docs