PentAGI: Detailed Introduction

[ikaijua]

PentAGI: Detailed Introduction

Give it a target and a goal in plain language. A team of specialized AI agents plans the work, runs real penetration-testing tools such as nmap, Metasploit and sqlmap inside an isolated Docker sandbox, remembers what it learned, and hands you a vulnerability report with exploitation steps.

What it is. PentAGI ("Penetration testing AGI") is an open-source, MIT-licensed, self-hosted multi-agent penetration-testing platform by VXControl, a security engineering studio in Dubai's Meydan Free Zone (founded 2025). A Go backend (REST + GraphQL) and a React web UI sit on top of PostgreSQL + pgvector for long-term memory, an optional Graphiti + Neo4j knowledge graph, and a Langfuse / Grafana observability stack.

What it is not. Not a thin wrapper around nmap, and not a CALDERA-style Breach and Attack Simulation product with predefined campaigns — there is no fixed attack playbook; the agents decide the next step for the specific target.

Signature capability. Three things set it apart: real tools, real sandbox (everything runs in isolated Docker containers, with a Kali image as the default pentest environment); your model, your data (12+ cloud LLM providers, or local Ollama / vLLM at zero API cost); and memory (findings and successful approaches land in PostgreSQL + pgvector so the next similar target starts from prior experience).

Traction (reading taken 2026-10-13). 27,046 GitHub stars, 3,840 forks, 155 watchers; the official vxcontrol/pentagi image has been pulled 362,698 times, and the companion Kali tools image 130,270 times. Note that it is not a Hacker News phenomenon — the only submission there scored 2 points. Its traction lives on GitHub and in security communities.

Price. The Community Edition (CE) is free (MIT) and self-hosted. The money goes to model tokens (see section 9).

Caveats. Use it only against systems you own or are explicitly authorized to assess — the EULA says so plainly. And change the default admin password immediately after first login.

Table of Contents

1. What PentAGI is
2. Install it and reach the web UI
3. Your first flow in ten minutes
4. What it can test: tools and intelligence sources
5. The team of specialists: how the agents divide the work
6. Memory, knowledge graph and observability
7. Keeping it on the rails: monitoring and task planning
8. Prerequisites and capability boundaries
9. What it costs
10. Where penetration testing stands legally
11. What the community says: both sides
12. Timeline: from v0.1 to v2.2
13. Related links
14. Update log (maintained)

What PentAGI is

In one line. You have a target (a web app, a host, an internal network). You want to know where it can be broken into. Write that down as one instruction and hand it to PentAGI; it does the reconnaissance, planning, execution and write-up itself.

What you actually do with it — concrete actions rather than capability nouns:

• Run a first-pass assessment of a web app you own, focusing on authentication, file handling and injection issues.
• In a client engagement you are authorized for, run internal reconnaissance and collect ports, services, versions and suspicious configuration into one list.
• Simulate an attack chain against a pre-production environment to see which step breaks first.
• Wire the above into your own systems — it exposes REST and GraphQL APIs, so flows can be created and polled programmatically.

Where it differs. Four things:

• It runs on your own machines. Self-hosted: models, keys and target data never pass through a vendor's servers.
• The model is fully swappable. 12+ cloud providers, or local Ollama / vLLM — a sensitive environment can be run so that not one command leaves the internal network.
• It runs real tools, not simulated attacks. nmap, Metasploit and sqlmap execute for real inside the sandbox; the output is the output of actual commands.
• It has long-term memory. Conclusions and "approaches that worked" are stored in PostgreSQL + pgvector, and the next similar target starts from that experience. An optional Neo4j knowledge graph maps the relationships between hosts, services and findings.

Who builds it. VXControl L.L.C-FZ, a security engineering studio in Dubai's Meydan Free Zone (founded 2025), whose stated goal is to give offensive-security teams open-source, self-hosted, sandboxed, MIT-licensed autonomous-agent infrastructure for the agentic-AI era.

Price. The Community Edition is free (MIT) and self-hosted. Costs come from model tokens and optional search APIs — see section 9.

Three words you will meet everywhere:

Flow. A "job" in PentAGI is called a Flow. You fill in target, scope and objective; it grows Tasks → SubTasks → Actions underneath.

Automation vs Assistant. Two ways to run the same thing. Automation means "you set the goal, it runs end to end". Assistant means "you steer it step by step", and you can flip a Use Agents toggle to let it delegate to specialist sub-agents.

CE / EE. The Community Edition (build suffix ce) is the open-source MIT one. The Enterprise Edition (ee) is the paid tier, adding agent profiles, plugins and MCP servers, customer-ready reports and a real-time attack-chain view.

Install it and reach the web UI

Prerequisites. Docker and Docker Compose (Podman is supported too), at least 2 vCPU / 4 GB RAM / 20 GB disk, and at least one model provider key (any one of OpenAI, Anthropic, Gemini, Bedrock, Ollama). You also need internet access to pull images.

Recommended route: the interactive installer.

mkdir -p pentagi && cd pentagi
wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip
unzip installer.zip && sudo ./installer

There are packages for Linux, macOS (Intel and Apple silicon) and Windows; the download page is split by OS and architecture. The installer has a terminal UI and does five things:

1. System checks — Docker, network, resources.
2. Environment setup — creates a .env file with workable defaults.
3. Provider configuration — OpenAI / Anthropic / Gemini / Bedrock / Ollama / DeepSeek / GLM / Kimi / Qwen / MiniMax / Mistral / xAI / Custom.
4. Search engines — DuckDuckGo, Google, Tavily, Firecrawl, Traversaal, Perplexity, Sploitus, SearXNG.
5. Security hardening and deploy — generates credentials and SSL certificates, then starts the stack with docker compose.

The manual route:

curl -o .env https://raw.githubusercontent.com/vxcontrol/pentagi/master/.env.example
# Fill in at least one: OPEN_AI_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY / BEDROCK_* / OLLAMA_SERVER_URL
curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/master/docker-compose.yml
docker compose up -d

Open and log in. The web UI is at https://localhost:8443. A fresh installation creates a default local administrator — admin@pentagi.com / admin — and there is no self-service sign-up from the login page.

Change the password first. The docs say explicitly to change the default password on first login, before using the instance for real work. An instance that can run penetration tests autonomously, left on default credentials, is the single easiest way for this to go wrong.

Two easy traps:

• Adding your user to the docker group grants root-equivalent privileges. The installer needs access to the Docker socket. That is fine in a dev environment; in production prefer running with sudo or use rootless Docker.
• macOS will flag the installer. The system may report the downloaded installer as malware — download only from the official links, check the CPU architecture of the archive, and follow the official troubleshooting guide before allowing it to run.

Your first flow in ten minutes

Step 1 — create a flow. Open Flows in the sidebar and click New Flow, then make four choices:

1. Mode — Automation (fully autonomous) or Assistant (interactive, with an optional Use Agents toggle that lets it delegate to sub-agents).
2. Model provider for this flow.
3. Template (optional) — pick a saved template, or start from the built-in examples/prompts/base_web_pentest.md that ships in the repo.
4. The objective, written in plain language.

Step 2 — write a good prompt. A good one covers four things: the target, the type of assessment you want, scope limits and rules of engagement, and the result you expect.

Assess https://target.example for common web application vulnerabilities.
Focus on authentication, file handling, and injection issues.
Stay within the provided target only and summarize confirmed findings with reproduction steps.

That third line is not politeness — it is the record that you stayed inside your authorized scope. Use this only against systems you own or are explicitly authorized to test; see section 10.

Step 3 — watch it work. Submitting the flow opens the flow page:

• The main view shows agent messages and task progress.
• You can expand every tool call and its terminal output — this is the difference from a black-box SaaS: each step is reviewable.
• The task and subtask lists show what it is doing and why.

Step 4 — take the report. The Report menu on the flow page offers four outputs: a web view, copy to clipboard, download as Markdown, and download as PDF. JSON export is not a supported format today (the project states this in its capability boundaries).

Step 5 — correct course without restarting. Every flow also has an Assistant view: check the current state, stop the current task, submit follow-up instructions, or patch the remaining planned subtasks. It is meant for the moment when an autonomous run surfaces something that needs human direction but a full restart would throw away useful context.

One tip. Do not start big. Pick a narrow target and a single clear objective first, get one full run to completion, and look at what the report actually looks like. That controls token spend and calibrates your expectations.

What it can test: tools and intelligence sources

Sandbox and tools. All operations execute inside isolated Docker containers. The tools come from the official pentest image vxcontrol/kali-linux — Kali-based, with 200+ curated CLI security tools pre-installed (130k pulls). PentAGI's own README puts it differently: "a built-in suite of 20+ professional security tools including nmap, Metasploit, sqlmap". The two numbers measure different things: what ships in the image, versus the professional suite it highlights.

Container selection is automatic, controlled by a few environment variables:

Variable	Default	What it does
DOCKER_DEFAULT_IMAGE	debian:latest	Default image for general and ambiguous tasks
DOCKER_DEFAULT_IMAGE_FOR_PENTEST	vxcontrol/kali-linux	Default image for security/pentest tasks
DOCKER_IMAGE_SELECTION_MODE	llm	llm lets the model pick; fixed always uses the pentest image
DOCKER_ALLOWED_IMAGES	empty	Allow-list the selected image must belong to

External intelligence sources. The agents do not only run tools; they look things up:

• A built-in browser — the official vxcontrol/scraper image, an isolated browser for pulling current web information.
• Search APIs — Tavily, Firecrawl, Traversaal, Perplexity, DuckDuckGo, Google Custom Search, Sploitus (an exploit database search) and SearXNG.

Sploitus is worth a second look on its own: it lets the agent ask directly whether a given component already has a public exploit.

Files in and out. Every flow has its own Files tab, scoped to that flow (stored on the host under {dataDir}/flow-{id}-data/, never leaking into other flows):

• Uploads — files you upload; while the agent container runs they are mirrored to /work/uploads/.
• Resources — files attached from your saved library, mirrored to /work/resources/.
• Container — point-in-time snapshots pulled back from the running container (read-only on the flow side; never pushed back into the container).

Limits: maximum 300 MB per file, up to 1000 files / 2 GB per upload request, file names capped at 255 bytes.

The team of specialists: how the agents divide the work

The design choice that matters most: this is not one giant prompt to one model. PentAGI runs a delegation system where each role does one job.

The main loop — an orchestrator plus three execution roles (the three-phase diagram in the architecture docs):

1. Orchestrator — receives the flow and breaks it into Tasks and SubTasks. Before doing anything else it queries the vector store for similar past runs, so prior experience is loaded up front.
2. Researcher — analyses the target surface, queries the knowledge base for known vulnerabilities, identifies open ports and weak points, and writes findings back to memory.
3. Developer — plans the attack: which tools, which exploit path, which Docker image fits.
4. Executor — actually runs it: calls nmap, sqlmap, Metasploit inside the sandbox, loads tool guides from the knowledge base, streams status back.

The finer-grained roles. Beyond the main loop there is a set of specialist agents, split into two tiers by how many tool calls they get:

• General agents (default 100 calls): Assistant, Primary Agent, Pentester, Coder, Installer.
• Limited agents (default 20 calls): Searcher, Enricher, Memorist, Generator, Reporter, Adviser (mentor), Reflector, Planner.

The underlying data model is tidy and fully persisted:

Flow → Task → SubTask → Action → Artifact / Memory

A flow contains tasks, tasks break into subtasks, subtasks produce actions (a command, a search), and actions yield artifacts (files, reports, logs) and memories (observations and conclusions with vector embeddings). Every command and its output is stored in PostgreSQL, which is what makes an attack run auditable and reproducible.

A practical consequence. This "division of labour plus supervision" design exists — in the vendor's own words — so that smaller open models can be used. A frontier model is not a hard requirement; see section 7.

Memory, knowledge graph and observability

Three layers, the first always on, the rest optional.

Layer 1 — PostgreSQL + pgvector (always on). Every command, output and conclusion is persisted with vector embeddings, so the agent can ask "have I seen a target like this before". This is not a log; it is a semantic memory database.

Layer 2 — Graphiti + Neo4j knowledge graph (optional). Started via docker-compose-graphiti.yml. It models hosts, services, ports and vulnerabilities as a graph (host → has_port → port → has_service → service → detected_vuln → …) for semantic relationship tracking and deeper context. Note the bundled edition is Neo4j Community, which only supports the default database.

Layer 3 — observability stack (optional). docker-compose-observability.yml plus docker-compose-langfuse.yml:

• Langfuse — an LLM observability dashboard for every model interaction.
• Grafana + VictoriaMetrics + Jaeger + Loki on OpenTelemetry — metrics, distributed tracing and log aggregation.

Context management: chain summarization. Long runs traditionally die at the context limit. PentAGI converts a conversation chain into a structured representation that preserves message types including tool calls and their responses, then summarises it in stages — section-level summarisation, handling oversized message pairs, managing the size of the last section, then a pass of QA summarisation — and only replaces the chain if the summarised version is actually smaller.

In short: it does not bluntly truncate. If summarising did not make things smaller, it leaves the chain alone — avoiding the case where the summariser itself degrades the context.

Keeping it on the rails: monitoring and task planning

The realistic failure mode of autonomous pentesting is not "it cannot break in" — it is "it starts going in circles". PentAGI stacks three supervision mechanisms against that.

1. Execution Monitoring (Beta, opt-in).

• Mentor intervention — the Adviser agent (mentor role) is invoked automatically when execution patterns indicate problems.
• Pattern detection — watches repeated identical tool calls (threshold 5, configurable) and total tool calls (threshold 10, configurable).
• Progress analysis — an evaluation step judges whether it is actually making progress.

2. Intelligent Task Planning (Beta, opt-in).

• Automatic decomposition — the Planner (the adviser in planning mode) produces 3–7 specific, actionable steps before specialist agents start.
• Context-aware plans — an Enricher agent assembles the full execution context first.
• Structured assignment — the original request is wrapped in a <task_assignment> structure together with the plan and instructions.
• Scope management — keeps each agent focused on the current subtask and prevents scope creep.

3. Tool Call Limits (always on, cannot be disabled).

• General agents (Assistant / Primary Agent / Pentester / Coder / Installer): default 100 calls.
• Limited agents (Searcher / Enricher / Memorist / Generator / Reporter / Adviser / Reflector / Planner): default 20 calls.
• Graceful termination — near the limit the Reflector guides the agent to finish properly rather than cutting it off.
• Resource protection — prevents a runaway execution from taking the system down.

Why this matters. The vendor's own guidance for open-source models lists execution monitoring and task planning as the key to running smaller models well — where a large model's raw capability is missing, process constraints fill in. If you plan to run a local Qwen model, these two switches are effectively mandatory.

Prerequisites and capability boundaries

Capability boundaries (four the project states itself):

• It is not a BAS. PentAGI is an autonomous and assistant-guided penetration-testing platform, not a CALDERA-style Breach and Attack Simulation / adversary-emulation product with predefined campaigns or attack plans.
• There is no "agent writes its own attack scripts" feature. BAS-like agent-authored attack scripts should be treated as conceptual or future work, not as something implemented today.
• Report export has no JSON. Flows reports support a web view, clipboard, Markdown and PDF. JSON export is not documented as a supported output format today.
• Provider flexibility today comes from built-in providers plus custom / OpenAI-compatible endpoints.

Three operational traps:

• Self-hosted means you own the operations. Docker and PostgreSQL are mandatory; Neo4j, Langfuse and Grafana are optional but yours to maintain.
• Deleting a flow does not free the disk. Deleting a flow removes the record and its long-term memory entries, but not the flow-{id}-data/ directory. Operators are expected to clean that up manually.
• One instance per server. The installer provisions one instance per server. Running several on one machine is possible (for example behind a shared nginx), but the stock compose file uses fixed container and network names, so it has to be adapted. DATA_DIR is the one variable two instances must never share — they would overwrite each other's flow data.

Do not forget the default password. One more time: admin@pentagi.com / admin must be changed immediately after the first login.

And the one that matters most: authorization comes first. See the next two sections.

What it costs

The software is free. The Community Edition is MIT-licensed and self-hosted, with no subscription.

The real cost is model tokens. Three tiers:

Route	Cost	Notes
Frontier cloud models	Highest	Exploit-chain development and multi-stage attack simulation burn the most tokens; the default configuration lines up with this tier
Mid-size cloud models	Moderate	Usable once execution monitoring and task planning are enabled
Local Ollama / vLLM	Zero API cost	You pay only in your own compute; the project ships a vLLM + Qwen3.5-27B-FP8 deployment guide

Supported providers (12+ plus custom):

• Direct: OpenAI, Anthropic, Google AI / Gemini, AWS Bedrock, Ollama, DeepSeek, GLM (Z.ai), Kimi, Qwen, MiniMax, Mistral, xAI.
• Custom: any OpenAI-compatible endpoint (including Azure OpenAI).
• Aggregators: OpenRouter, DeepInfra, Atlas Cloud, OpenCode Go.

One unobtrusive limit that will stop you. OpenAI's GPT-5 / 5.1 / 5.2 models "work unstably with PentAGI" and may trigger OpenAI's cybersecurity safety mechanisms without verified access. To use them reliably: individual users verify their identity at chatgpt.com/cyber; enterprise teams request trusted access through their OpenAI representative; security researchers can apply to the Cybersecurity Grant Program (which includes $10M in API credits). The defaults use the newer GPT-5.4 / 5.5 / 5.6 series and are not affected — the default models are gpt-5.4-mini, gpt-5.4-nano and gpt-5.6-terra.

Other possible costs: search APIs (Tavily, Firecrawl, Perplexity and others) usually have their own plans.

Enterprise Edition (EE). A paid tier on top of CE, adding agent profiles, plugins and MCP servers, customer-ready reports, and a real-time attack-chain view. Contact info@pentagi.com for a quote.

Where penetration testing stands legally

The tool itself is legal. PentAGI belongs to the same class as nmap and Metasploit — professional security tooling under an MIT licence. Legality depends on how it is used, not on the tool.

The project's own rule. The repository ships a separate EULA.md (acceptable-use requirements), and the README and usage docs repeat the same line:

Only test systems you own or are explicitly authorized to assess.

The example prompt built into the flow page deliberately asks you to state scope and rules of engagement, precisely so the authorized boundary is traceable.

Three real risks that get overlooked:

• Default password plus an exposed port. An instance that runs penetration tests on command, reachable from the internet with the default credentials, is a free attack jumpbox for someone else. This is the most realistic and most common failure — more dangerous than any model misjudgement.
• Sandbox isolation is not authorization. Docker isolation protects your machine, not the target. It decides whether a bad run contaminates your host; it says nothing about whether you have the right to attack someone else.
• Provider terms are another layer. Even with authorization from the target owner, a cloud provider's terms of service and the laws of the target's jurisdiction can still constrain scanning.

In one line. Treat it like professional equipment: write the scope down, keep the authorization on file, and run it only against your own environment or an environment you have written permission to test.

What the community says: both sides

The positive case:

• Solid growth. 27,046 stars and 3,840 forks, listed on Trendshift (repository 15161).
• People actually run it, not just star it. The official image has 362,698 pulls, with 130,270 for the companion Kali tools image — a ratio that suggests a substantial number of real installations.
• Nearly two years of steady iteration. From v0.1.0 in January 2025 to v2.2.0 in October 2026, with no sign of abandonment.
• Third-party reviews agree on the positioning. Several describe it as "not a model wrapper but a full multi-agent microservices stack", and are explicit about fit (internal first-pass assessments, authorized client engagements, wiring security testing into internal workflows) and non-fit (teams that do not want to run Docker/Postgres/Neo4j themselves; teams needing predefined BAS campaigns).

Reservations and things to keep in mind:

• Almost no Hacker News discussion. The only related submission scored 2 points. Its traction lives on GitHub and in security communities — do not describe it as a broad internet phenomenon.
• "Autonomous" is a product claim, not a free pass. Third-party reviews point out that autonomous security testing still needs human review of the actions, and that model output can contain false positives which must be verified before being treated as real vulnerabilities.
• Automated scoring is unimpressed. One review site scores it 44/100, noting "no safety controls found". That kind of automated rubric is coarse — for an offensive tool, the absence of safety controls is partly expected — but it is a fair reminder that an open-source pentest tool assumes a competent operator.
• Different niche from commercial tools. One comparison notes that deep web-application testing (close HTTP-level inspection, browser integration) is still better served by a dedicated tool such as Burp Suite Professional; PentAGI's strength is network reconnaissance and multi-tool coordination across targets, and compressing operator time.

The fair summary. Think of it as a penetration-testing assistant that never gets tired and keeps notes — but whose work you still have to review, not as a one-click automatic hacker.

Timeline: from v0.1 to v2.2

PentAGI is not a 2026 arrival — the repository dates from 2025-01-06 and has been iterating for nearly two years.

Date	Version	Event
2025-01-06	—	Repository created
2025-01-07	v0.1.0	First public Alpha
2025-01-09	v0.2.0	New frontend
2025-06-25	v0.3.0	First public Beta
2025-12-31	v1.0.0	Production Release
2026-01-06	v1.0.1	Patch
2026-01-17	v1.1.0	Feature release
2026-02-25	v1.2.0	Feature release
2026-04-11	v2.0.0	Major release
2026-05-29	v2.1.0	Feature release
2026-10-05	v2.2.0	Current latest

Worth noting:

• Eleven months from Alpha to production. v0.1.0 (Jan 2025) to v1.0.0 (Dec 2025) is not the profile of a weekend project.
• The v2.x cycle is accelerating. Three major versions shipped between April and October 2026.
• The most recent commit rewrote the README. The 2026-10-09 commit message is "docs: the README says what PentAGI is, who it is for, how it differs…". The team is deliberately sharpening its positioning — which is also why this post can quote unusually precise capability boundaries.

Related links

Official

• GitHub repository: https://github.com/vxcontrol/pentagi
• Website: https://pentagi.com
• VXControl (the developer): https://vxcontrol.com
• Acceptable use requirements (EULA): https://github.com/vxcontrol/pentagi/blob/main/EULA.md
• Installation and configuration guide: https://github.com/vxcontrol/pentagi/blob/main/examples/guides/installation_configuration.md
• Built-in web-testing example prompt: https://github.com/vxcontrol/pentagi/blob/main/examples/prompts/base_web_pentest.md
• Local deployment guide (vLLM + Qwen3.5-27B-FP8): https://github.com/vxcontrol/pentagi/blob/main/examples/guides/vllm-qwen35-27b-fp8.md
• Kali pentest image (200+ tools): https://hub.docker.com/r/vxcontrol/kali-linux
• Overview video: https://youtu.be/R70x5Ddzs1o
• Community: Discord (https://discord.gg/2xrMh7qX6m), Telegram (https://t.me/+Ka9i6CNwe71hMWQy)

Third-party reviews and write-ups

• runany.dev: https://runany.dev/blog/pentagi
• Open Source Alternatives (comparison with Burp Suite Professional): https://www.opensourcealternatives.to/item/pentagi
• PyShine walkthrough: http://pyshine.com/PentAGI-AI-Agent-That-Hacks-So-You-Dont-Have-To
• followagents capability assessment: https://followagents.com/en/agents/pentagi

Background papers (listed in the project's Credits)

• Emerging Architectures for LLM Applications: https://lilianweng.github.io/posts/2023-06-23-agent
• A Survey of Autonomous LLM Agents: https://arxiv.org/abs/2403.08299

Update log (maintained)

This section records only what changes after this post was published, so the README entry does not have to be edited every time.

Date	Change	Source
2026-10-13	Post created. Baseline: v2.2.0 (released 2026-10-05), 27,046 stars / 3,840 forks / 155 watchers, official image pulled 362,698 times, Kali tools image 130,270 times; latest commit 2026-10-09 (README rewrite of the positioning statement).	GitHub · Docker Hub