PentAGI is a self-hosted, AI-powered penetration-testing platform for security professionals, researchers, and ethical hackers. It uses a multi-agent system with specialized researcher, developer, executor, adviser, planner, and reflector roles to investigate targets, plan and execute testing tasks, operate professional security tools, and generate vulnerability reports.
The platform runs operations in isolated Docker containers and includes more than 20 security tools, an isolated web scraper, external search integrations, PostgreSQL with pgvector for persistent results and semantic memory, and an optional Graphiti/Neo4j knowledge graph. Its agents use long-term, working, and episodic memory; chain summarization converts conversation chains into a structured ChainAST, summarizes older sections and oversized pairs, and rebuilds the chain when the result is smaller. Optional execution monitoring detects repeated or excessive tool calls and invokes a mentor for alternative strategies, while task planning decomposes a request into actionable subtasks before specialist agents execute it.
PentAGI provides a React and TypeScript web interface, Go-based REST and GraphQL APIs with Bearer-token authentication, flow-scoped file management, Markdown and PDF report downloads, and monitoring integrations built around OpenTelemetry, Grafana, VictoriaMetrics, Jaeger, and Loki. It supports multiple hosted and local LLM providers, including OpenAI, Anthropic, Google Gemini, AWS Bedrock, Ollama, DeepSeek, GLM, Kimi, Qwen, and MiniMax, and can be deployed with Docker Compose or Podman. The project states that it is an autonomous and assistant-guided penetration-testing platform rather than a CALDERA-style breach-and-attack-simulation system with predefined campaigns; testing should be limited to systems for which the operator has authorization.