AgentCommunity★ 1.9k

Pentest AI Agents

Updated Jul 5, 2026

50 Claude Code subagents for authorized penetration testing, organized across recon, web, Active Directory, cloud, mobile, wireless, C2 operations, payload crafting, reverse engineering, forensics, and reporting. Tier 1 agents are advisory (you run the tools); Tier 2 agents can execute tools directly against declared in-scope targets. For authorized security testing only.

View on GitHub

What it does

engagement-planner
Generate phased pentest plans with MITRE ATT&CK mappings, time estimates, and rules-of-engagement templates.
recon-advisor (Tier 2)
Parse Nmap/Nessus/BloodHound output, prioritize targets, and execute recon tools directly against declared in-scope hosts.
ad-attacker (Tier 2)
Drive BloodHound, Impacket, CrackMapExec, and Certipy for Kerberos, delegation, ACL, and certificate-abuse attacks.
detection-engineer
Generate Sigma, Splunk SPL, Elastic KQL, and Sentinel KQL detection rules with false-positive tuning.
/recommend "task description"
Slash command that routes to the right agent and returns concrete next commands for any pentest task.
db/doctor.sh
Audit which underlying CLI tools (nmap, nuclei, BloodHound, Impacket, etc.) are installed on your machine, grouped by agent.

Files (1)

OVERVIEW.mdprimary · markdown · 2.1 KB

## What it does

50 Claude Code subagents for authorized penetration testing. Each agent carries deep domain knowledge in a specific area. Claude routes to the right specialist automatically based on your task description — no explicit invocation needed.

**Offensive operations (38 agents):** engagement-planner, recon-advisor, osint-collector, web-hunter, api-security, ad-attacker, cloud-security, mobile-pentester, wireless-pentester, social-engineer, phishing-operator, c2-operator, payload-crafter, reverse-engineer, exploit-chainer, attack-planner, poc-validator, llm-redteam, ai-recon, container-breakout, opsec-anonymizer, lateral-movement, persistence-planner, evasion-specialist, data-exfiltrator, scada-attacker, iot-pentester, credential-tester, password-auditor, database-attacker, network-attacker, traffic-analyzer, business-logic-hunter, cicd-redteam, bug-bounty, ctf-solver, vulnerability-scanner, swarm-orchestrator.

**Defense and analysis (8 agents):** detection-engineer (Sigma/Splunk/Elastic/Sentinel rules), threat-modeler (STRIDE/DREAD), forensics-analyst, malware-analyst, stig-analyst, code-auditor (Semgrep/CodeQL/gitleaks), crypto-analyzer, traffic-analyzer.

**Reporting (4 agents):** report-generator (CVSS scoring, remediation roadmaps), compliance-mapper (PCI/NIST/ISO/CIS), risk-scorer (CVSS 3.1/4.0 + EPSS + CISA KEV), engagement-planner.

**Tier 1 vs Tier 2:** All agents provide advisory guidance (Tier 1). Select agents can also compose and execute commands directly (Tier 2) — recon-advisor, vuln-scanner, web-hunter, ad-attacker, exploit-chainer, poc-validator, database-attacker, network-attacker, ai-recon. Tier 2 requires a declared scope; the agent validates every target before executing any command.

## Install

```bash
# One-line install
curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash

# Or as a Claude Code plugin
/plugin marketplace add 0xSteph/pentest-ai-agents
/plugin install pentest-ai-agents@pentest-ai-agents
```

## Legal

For authorized security testing only. Requires signed rules of engagement and defined scope.