PentestGPT
Open-source agent framework that uses an LLM backend to run staged penetration testing tasks.
How the 6.2 was reached
- Quality of output7/10
15,647 GitHub stars and MIT licence, with recent activity; covers multiple challenge categories, though no benchmark results were found. github.com
- Ease of use5/10
Requires Python 3.12+, the uv package manager, and an authenticated Claude Code or Codex CLI; docs are the README only. github.com
- Pricing value7/10
Free MIT-licensed code, but it needs a paid Claude Code or Codex subscription or model API. github.com
- API and integration quality6/10
Pluggable backends for Claude Code and Codex, with legacy support for many model providers and Ollama; no formal API. github.com
- Solves the problem it claims to solve6/10
Staged recon, exploit and walkthrough pipeline matches the claim; 15,647 stars show interest, but no independent results on real pentests. github.com
6.2/10 is the mean of the 5 criteria that apply. Scored on the five-criteria rubric v1, 29 September 2026. How scoring works
Pricing
- MIT licence
- Needs a paid Claude Code or Codex subscription or model API
Key Features
- Multi-stage pipeline of recon, exploit and walkthrough
- Findings from each stage feed the next
- Covers Web, Crypto, Reversing, Forensics, PWN and Privilege Escalation challenges
- Pluggable backends for Claude Code and Codex
- Legacy mode for OpenAI, Anthropic, Gemini, DeepSeek, xAI, Qwen, Moonshot and Ollama
Pros & Cons
Pros
- Free MIT-licensed code with 15,647 GitHub stars
- Staged workflow matches how many pentests are structured
- Backend choice, including local Ollama in legacy mode
- Recent repository activity
Cons
- Needs Python 3.12+, uv and an authenticated Claude Code or Codex CLI
- Docs are the README only
- No benchmark results or independent real-pentest evidence found
- Model usage costs come on top of the free code
PentestGPT fits security practitioners and CTF players who already have Claude Code or Codex and want a guided pipeline. Anyone needing proven results on real engagements, or a formal API, should look elsewhere.
Try PentestGPT →Added to scored.tools on
Competitors to PentestGPT
Other tools in the automation category worth comparing.
Strix
7.0/10Autonomous security platform that tests code, APIs, and infrastructure with validated findings and fix PRs.
HexStrike AI
6.8/10AI-powered offensive security framework with autonomous penetration testing and vulnerability analysis capabilities.
CAI
4.2/10AI framework for security professionals with multi-agent systems and specialized tools