Repository navigation
Roadmap
Current status as of October 2026. All 6 platform phases are implemented in code.
12-month execution plan: ROADMAP-12M.md — model-agnostic runtime, Strix adapter, teams, TUI, and the path to 1.0.
Agent capability milestones: see MILESTONES.md. M1 (efficient loop/auth) and M2 (verifiable exploitation) are implemented. M3 (autonomous exploitation without deterministic probes) recorded a first no-probe solve (XBEN-021, 171.5 s) and now measures 8/20 (40%) on the fixed sample (2026-10-24), with 20/20 runnable and 0 harness errors. A clean live authorized target remains.
2073 tests · Python 3.11+
All 6 platform phases are complete. Two gaps remain: M3 (autonomous exploitation without probes) and live validation against authorized targets.
Full-stack Docker deployment (pentestai + Neo4j + Qdrant + Metasploit) validated on 2026-10-20: all services Up/healthy, 35 .env variables injected, smoke test 38/53 pass (the remaining 15 are empty keys), and LLM end-to-end succeeded via Anthropic. Details: STATUS.md.
Capability gaps (validation gate, browser automation, SARIF/PDF, CI gate, run budget) were closed on 2026-10-21. The benchmark harness exists; the selected XBOW pilot is 5/5 with opt-in probes. The no-probe sample progressed from 4/20 (Phase A) to 8/20 (40%) in the clean 2026-10-24 run, with 20/20 runnable and 0 build/up/harness errors — see BENCHMARK.md and MILESTONES.md.
The six capability conditions are tracked separately from the platform phases.
| Phase | Scope | Status | Exit criteria |
|---|---|---|---|
| A — Perception & hypotheses | Attack-surface parser (OpenAPI/HTML/URL), hypothesis planner, verifier feedback, scorecard | ✅ Gate passed: 20/20 runnable, 4/20 solved, 0 false-positive SSTI, agent max 302 s | Structured context used; repeated actions down; 3–5/20 solves |
| B — Planning, memory & budget | Hierarchical planner/attack graph, strategy memory L1/L2, mode-aware A/B, engagement dynamic budget | ✅ Gate met: 8/20 solved, 20/20 runnable, 0 harness errors; A/B +1 (1/5→2/5) | 5–8/20 solves; measurable transfer |
| C — Breadth & live | Source-aware mode, 2FA/SSO, SSRF/deserialization/GraphQL/crypto, live validation | 🟡 Partial: GraphQL, deserialization, traversal, Mongo ObjectId, upload verifiers verified; SSRF/business logic/crypto and autonomous live target open | 8–12/20 solves; one live authorized target |
Phase A implementation: core/attack_surface.py, agents/hypotheses.py,
scripts/scorecard.py, plus HTTP body metadata and ReAct context injection.
Details and evidence: MILESTONES.md.
Phase B implementation: agents/planner.py (attack graph), core/strategy.py
(mode/tag-aware memory), agents/critic.py (reward/lessons), and
bench_agent --mode / bench_matrix --mode --strategy for mode-aware A/B.
- Interactive CLI shell, scope enforcement, session management
- REST API 48 endpoints, RBAC, SSE streaming, session diff
- Tamper-evident audit log (SHA-256 hash chain)
- Tool integrations: nmap, http, gobuster, sqlmap, nikto, hydra
- Parsers: Nmap XML/text, Gobuster, Hydra
- Knowledge graph SQLite backend
- Vector store TF-IDF + RAG pipeline
- Offline CVE bundle (50 CVEs pre-seeded)
- LearningEngine ❌ disabled — heuristic pattern matching creates false confidence
- ReActAgent: REACT_SYSTEM 4400+ chars, 4 system prompts, attack state machine
- KillChainOrchestrator: 6 phases, phase gates
- PermissionGate: scope + engagement brief + autonomy level
- HITL: modify-before-execute, phase sign-off, FP marking
- REST API 48 endpoints + scheduler + plugin system
- 36 tools: web + AD + cloud + crypto + recon + exploit verifiers
- Skill mode system (junior/mid/advanced)
- Engagement brief, evidence vault, pending tracker
- Word report (.docx), CVSS 4.0, EPSS
- Scope expansion workflow (request/approve/deny/audit log)
- Evidence vault (SHA-256 hash, verify, ZIP bundle export)
- Pending items tracker (suspicious services, untested endpoints, missing PoC)
- Engagement brief guardrails per client
- 15 LLM providers auto-detect from env vars
-
Multi-agent orchestration (
agents/orchestrator.py) — ReconSubAgent + WebSubAgent + InfraSubAgent + ReportSubAgent run in parallel, shared session context, phase gates per skill mode -
PTES report format (
reports/ptes.py) — JSON + Markdown, phase mapping, business impact, overall risk -
ISO 27001 risk register (
reports/ptes.py) — Annex A controls mapping, risk scoring, residual risk tracking -
Plugin marketplace (
plugins/marketplace.py) — GitHub registry, search/install/uninstall/verify checksum - Fine-tuned LLM: ❌ SKIP — no real dataset, the base model (Claude Sonnet) is already good enough
Platform code exists. Two gaps remain:
- M3 capability — autonomous exploitation without deterministic probes.
- Live validation — execution against real, authorized targets.
See MILESTONES.md for the M3 work packages and exit criteria.
| Target | Gap | Time estimate |
|---|---|---|
| Local DVWA | None — can do now | 1 day |
| HTB Jerry (Tomcat) | HTB VPN | 1 week |
| HTB Lame (Samba) | HTB VPN + MSF install | 2 weeks |
| Live engagement | Client authorization | Ongoing |
# Fastest validation — local DVWA
docker run -d -p 18080:80 vulnerables/web-dvwa
export ANTHROPIC_API_KEY=sk-ant-...
python3 scripts/live_llm_check.py --provider anthropic # verify API
python3 __main__.py --target http://localhost:18080 --mode junior
# HTB
openvpn lab.ovpn
export ANTHROPIC_API_KEY=sk-ant-...
python3 __main__.py
# > session new htb-jerry
# > scope add 10.10.10.0/24
# > target 10.10.10.95
# > orchestrate # multi-agent Phase 6| Tool | Score | Validated |
|---|---|---|
| PentestAI (current) | 53/100 | ❌ 0 live targets |
| PentestAI + live test | ~70/100 | ✅ proven |
| PentestGPT | 54/100 | ✅ 87.8% Easy HTB |
One HTB machine solved = Validated Accuracy from 0 to 5+ = total score rises to ~65.