Pentest Swarm AI AI Agent

by Armur-Ai• 3.1k•• Scanned•Claim this listing•Request removal

Security & Testingai agentsbug bountycybersecurityoffensive securitypenetration testing

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.

Pentest Swarm AI is an open-source ai agent by Armur-Ai, written mainly in Go, with 3,100 GitHub stars and the AGPL-3.0 license. Its code was last updated Nov 1, 2026.

about README security reviews

<img src="banner/hero.svg" alt="Pentest Swarm AI — the first open-source pentesting tool built on a real swarm" width="880"> <h1 align="center">The open-source XBOW alternative — an autonomous API & web-app pentester.</h1> Dozens of AI agents don't just scan — they exploit. They chain attacks (BOLA/IDOR, JWT forgery, mass assignment, SSRF, injection), build and score attack paths, and prove real vulnerabilities at machine speed. Built for pentesters · bug bounty hunters · red teamers · security researchers <a href="https://armur-ai.github.io/Pentest-Swarm-AI/">📖 Documentation</a> · <a href="#quick-start">Quick Start</a> · <a href="#use-cases">Use Cases</a> · <a href="#pentest-swarm-vs-xbow">vs. XBOW</a> · <a href="#what-makes-this-a-swarm">Swarm vs. Multi-Agent</a> · <a href="#how-the-swarm-works">How It Works</a> · <a href="#our-mission">Mission</a> · <a href="docs/COVERAGE.md">Coverage</a> · <a href="ROADMAP.md">Roadmap</a>

Pentest Swarm AI is an autonomous, open-source API & web-app pentester built on a real swarm. Dozens of AI agents coordinate through a shared stigmergic blackboard to exploit, chain, and prove vulnerabilities at machine speed.

🐝 A real swarm, not a pipeline — dozens of agents work your surface concurrently, coordinating via pheromone-weighted findings; attack chains emerge instead of being scripted.

💥 Exploits, doesn't just scan — chains BOLA/IDOR, JWT forgery, mass assignment, SSRF, SQLi/NoSQLi, GraphQL abuse — then captures evidence and writes the report.

🧠 Any model, self-hosted — Claude, Together AI (GLM/Qwen/DeepSeek), Gemini, OpenAI-compatible, or fully local Ollama / LM Studio. We're the harness that gives models hands.

✅ Proof over maybes — non-LLM verification oracles (OOB / differential / timing) confirm findings against the live target; proven ones get a VERIFIED badge.

🛡️ Safe by construction — fail-closed scope, egress guard, an authorization gate, and a full audit trail.

🎯 Drop-in use cases — bug bounty, external ASM, CI/CD, internal network, CTF, GraphQL, OWASP Top 10 — each a one-command playbook.

<a href="https://www.blackhat.com/"><img src="https://img.shields.io/badge/Black%20Hat%20Arsenal-India-000000?style=for-the-badge&logo=hackaday&logoColor=white" alt="Presented at Black Hat Arsenal — India"></a> <a href="https://armur-ai.github.io/Pentest-Swarm-AI/"><img src="https://img.shields.io/badge/Docs-read-0b7285?style=for-the-badge&logo=readthedocs&logoColor=white" alt="Documentation"></a> <a href="https://discord.gg/6qtkhpW8tk"><img src="https://img.shields.io/badge/Discord-join%20the%20swarm-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord"></a> <img src="https://img.shields.io/github/stars/Armur-Ai/Pentest-Swarm-AI?style=for-the-badge&color=f59e0b" alt="Stars"> <img src="https://img.shields.io/badge/Go-1.24-00ADD8?style=for-the-badge&logo=go" alt="Go"> <img src="https://img.shields.io/badge/License-AGPL%203.0-blue?style=for-the-badge" alt="License"> <img src="https://img.shields.io/badge/AI-Claude%20%7C%20Ollama-purple?style=for-the-badge" alt="AI"> <img src="https://img.shields.io/badge/status-alpha-orange?style=for-the-badge" alt="Status"> 🏴 Presented at <a href="https://www.blackhat.com/">Black Hat Arsenal — India</a> · the open-source pentest swarm, demoed live. ⚠️ Authorized use only. This is an autonomous offensive tool that sends real attack traffic to live targets. Use it only against systems you own or have explicit written authorization to test. Unauthorized use is a crime, and you are solely responsible. Scope is enforced fail-closed, and the tool makes you affirm authorization before it attacks a real target. Read the <a href="docs/RESPONSIBLE_USE.md">Responsible Use Policy</a> before you run anything.  <img src="docs/demo-flashy.gif" alt="Pentest Swarm AI — live campaign demo" width="900">

Hack at machine speed.

📖 New here? Start with the documentation — quickstart, provider setup, CLI reference, and troubleshooting. (Or run pentestswarm docs to open it.)

XBOW proved a point: AI can top the bug-bounty leaderboards. But XBOW is a closed, hosted SaaS — one agent, on their cloud, on their model, at their price. We think the future of offense is open, self-hosted, and a swarm — so we built it.

Pentest Swarm vs. XBOW

	Pentest Swarm AI	XBOW
Open source	✅ AGPL, fork it	❌ closed
Self-hosted	✅ your infra, your model, $0 floor	❌ their cloud, their bill
A real swarm	✅ dozens of agents, concurrent	❌ single agent

Three structural wins — and the swarm is the one that compounds. This isn't a single planner LLM walking recon → classify → exploit → report down a fixed line. Dozens of agents work your surface at once, coordinating through a shared stigmergic blackboard: the instant a finding lands it wakes whichever agent it's relevant to, so a 1,000-subdomain target gets hit in parallel — attacking at machine speed. And unlike a scanner that spits out unverified "maybes," the swarm exploits what it finds, proves it with captured evidence, then writes the report.

Who it's for: pentesters covering a whole scope overnight · bug bounty hunters racing to first-blood on a fresh target · red teamers who need breadth fast · researchers pushing autonomous offense.

Run it on any model — Claude, anything OpenAI-compatible (incl. Together AI's hosted Llama/Qwen/DeepSeek), the new security-tuned open models (Pentest-R1 and the wave behind it), or fully local Ollama / LM Studio. We don't compete with those models — we're the harness that gives them hands: real tools, swarm coordination, scope safety, and evidence-backed reports. Air-gapped, zero API cost, and not one byte of your data leaving your box.

For authorized testing only — see the full legal disclaimer and Responsible Use Policy.

The model is the engine. The harness is the car.

Frontier models are getting absurdly powerful, and they'll keep getting better. But raw capability is an engine on a test stand: it revs, it roars, and it moves nothing. A 1,000-horsepower engine with no transmission, no chassis, no tires, and no traction doesn't win races — it doesn't even leave the garage. To put that power on the road, you need the rest of the car.

Pentest Swarm is that car. The model is the engine you drop in; everything around it is what turns horsepower into a finished pentest:

The car	Pentest Swarm	Why the power needs it
Engine	the frontier model you choose — Claude, GLM / Qwen / DeepSeek, local Ollama	raw reasoning, and fully interchangeable
Drivetrain (the hands)	real tool execution — recon, exploitation, PoC generation	a model can describe an attack; the harness runs it against a live target
Transmission	the stigmergic swarm	spreads the power across dozens of agents instead of one planner redlining a single thread
Tires & traction	non-LLM verification oracles (OOB / differential / timing)	proof the power actually hit the road — a `VERIFIED` finding, not a confident guess
Chassis	the shared pgvector blackboard + memory	holds every finding together so attack chains emerge and nothing is lost between agents
Brakes & seatbelts	fail-closed scope, egress guard, authorization gate, full audit trail	power you can't stop is a liability, not a feature
The finish line	captured evidence + the graded report	the whole point — a proven result, not a chat transcript

And here's the part that compounds: a better engine makes a better car — but only if the car can use it. Every time the frontier moves, Pentest Swarm gets better for free, because the harness is model-agnostic: swap the engine, keep the car. We don't compete with the labs building the engines — we're the layer that lets anyone put that power on the road, on their own infra, for authorized offense.

No matter how good the model gets, something still has to give it hands, aim it at a target safely, coordinate it at scale, and prove what it found. That's the harness. That's the hard part. That's us.

What makes this a swarm?

Most "multi-agent" pentesting tools are a single planner LLM dispatching to specialist agents in a fixed order — recon → classify → exploit → report. That's a pipeline, not a swarm.

Pentest Swarm AI is built around three swarm-intelligence primitives:

Stigmergy — agents coordinate by reading and writing findings on a shared blackboard, not by a central planner telling them what to do. A finding's pheromone weight biases other agents toward it and decays over time, so stale paths die naturally.
Emergence — attack chains appear that no single agent planned. A recon finding wakes the classifier; a high-severity classification wakes the exploit agent; exploit results feed back into the board and wake the report agent. Order isn't prescribed — it emerges from the blackboard state.
Decentralization — each agent runs its own trigger predicate. Add a new agent with its own predicate and it joins the swarm without anyone rewriting the orchestrator.

Why it wins: a pipeline is sequential (one stage at a time), can't fold a mid-run discovery back into recon, and is bounded by its slowest stage. A swarm works your surface concurrently, reacts to every new finding, lets attack chains emerge instead of scripting them, and lets stale paths decay and die. The payoff on stage is breadth — a long list of proven findings, because many agents chew on the surface at once.

📖 Full write-up: Architecture — Swarm vs. Pipeline (the blackboard, pheromone decay, emergent chains, and why concurrency stays cheap). Diagrams also live in docs/.

We built this because the category was empty. Every tool marketed as "swarm" was actually a pipeline. If you find a counter-example, open an issue — we'll add them to the comparison table.

Quick Start

One command to install. One command to run. No API key, no cloud, no bill to start.

1 · Install (pick one)

npm install -g @armurai/pentestswarm                                       # npm (Node ≥16)
curl -fsSL https://raw.githubusercontent.com/Armur-Ai/Pentest-Swarm-AI/main/scripts/install.sh | sh   # any macOS/Linux
brew install Armur-Ai/tap/pentestswarm                                     # Homebrew
go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@latest    # Go toolchain
docker run --rm ghcr.io/armur-ai/pentestswarm:latest --help                # Docker

2 · Run it

pentestswarm run

That's it. run opens the interactive TUI launcher — no flags to memorize:

Pick your AI provider and paste a key right in the UI — Together AI (hosted Llama / Qwen / DeepSeek), Claude, OpenAI, Gemini, or fully local Ollama / LM Studio (no key at all).
Point it at a target — a URL, or a bundled vulnerable lab (crAPI, Juice Shop, VAmPI, DVGA) that spins up, gets attacked, and tears down after. Legal, safe, zero setup.
Choose your live view — a web dashboard on localhost:7777 and a full-screen terminal TUI with live charts, a swarm-topology diagram, and a graded findings stream. Both, by default.
Then launch and watch the swarm work at machine speed.

A readiness check runs right in the launcher (Go, Docker, tools, provider) — it never blocks; anything missing is shown as a note you can fix or ignore.

Prefer flags? (scripting / CI)

run just wraps scan, so everything is scriptable too:

# watch it find a real vuln in ~2 min — bundled lab, local model, no key
pentestswarm scan --lab --lab-target crapi --provider ollama --swarm --tui

# a real target, cloud model for max quality
export PENTESTSWARM_ORCHESTRATOR_API_KEY=your-key-here
pentestswarm scan <authorized-target> --scope <target> --swarm --follow

# prove findings, don't just report them: confirm each high-stakes finding
# against the live target with a non-LLM oracle (OOB / differential / timing)
pentestswarm scan <authorized-target> --scope <target> --swarm --verify

New here? pentestswarm demo plays the whole campaign offline — that's the GIF above. Running inside GitHub Actions? See deploy/github-action/example-workflow.yml.

Use cases

Each use case is a one-command playbook — a curated swarm configuration for a specific job. List them with pentestswarm playbook list; run one with pentestswarm playbook run <name> --target <t> --scope <scope>.

Use case	What the swarm does	Playbook	Example
Bug bounty — first blood	race a fresh target: recon → classify → exploit → proof, breadth-first	`bug-bounty`	`pentestswarm playbook run bug-bounty --target https://app.example.com --scope example.com`
External ASM	enumerate a whole external surface and prove the exploitable edges	`external-asm`	`pentestswarm playbook run external-asm --target example.com --scope example.com`
CI/CD gate	fast, scriptable scan with SARIF output for a pipeline	`ci-cd-security`	`pentestswarm playbook run ci-cd-security --target $STAGING_URL --scope $STAGING_HOST`
API security (BOLA/IDOR/BFLA)	object-level & function-level authz abuse across an API	`api-security`	`pentestswarm playbook run api-security --target https://api.example.com --scope api.example.com`
GraphQL audit	introspection, field-level authz, injection, batching abuse	`graphql-audit`	`pentestswarm playbook run graphql-audit --target https://api.example.com/graphql --scope api.example.com`
OWASP Top 10	broad web-app coverage mapped to the Top 10	`owasp-top10`	`pentestswarm playbook run owasp-top10 --target https://app.example.com --scope example.com`
Internal network	authorized internal-range sweep and service exploitation	`internal-network`	`pentestswarm playbook run internal-network --target 10.0.0.0/24 --scope 10.0.0.0/24`
CTF solver	autonomous flag hunting on a CTF target	`ctf-solver`	`pentestswarm playbook run ctf-solver --target http://ctf.local:8000 --scope ctf.local`
Try it with no target	attack a bundled vulnerable lab (crAPI, Juice Shop, VAmPI, DVGA) that spins up and tears down	—	`pentestswarm scan --lab --lab-target crapi --swarm --tui`

Full walkthroughs with sample output live in the documentation and the coverage catalog.

How the swarm works

Key behaviours:

Agents are independent. Any one of them can be removed, replaced, or added without rewiring the others.
Pheromones decay per-finding-type. A PORT_OPEN stays hot for hours; a SESSION for minutes. Config-driven half-lives.
Scope is enforced at the tool layer and again at the executor. Defence in depth — --scope is not bypassable.
Cleanup is always registered before execution. SIGINT, crashes, and budget exhaustion all trigger reverse-order cleanup. See internal/pipeline/cleanup_memory.go and cleanup.go.
Prompt caching on Claude cuts cost and latency on repeated system prompts (enabled by default for recon + classifier).

The Armur offensive suite — Pentest-Swarm in the middle

Pentest-Swarm isn't a monolith. It's the orchestrator at the centre of a suite of independent tools, each shippable and usable on its own, that exchange evidence as versioned JSON envelopes defined once in armur-contracts. That shared vocabulary is the only thing they depend on each other for — no tool imports another's code, so any one of them upgrades, ships, or runs standalone without touching the rest.

flowchart TB
    classDef center fill:#0b3d2e,stroke:#39ff14,stroke-width:2px,color:#eafff0;
    classDef tool fill:#141414,stroke:#555,color:#e8e8e8;
    classDef bus fill:#1a1030,stroke:#a06bff,color:#f0e9ff;

    HAY["<b>Hayagriva</b><br/>discovery &amp; recon"]:::tool
    PSW["<b>Pentest-Swarm</b> ★<br/>autonomous exploitation<br/>— the orchestrator —"]:::center
    ENG["<b>Engira</b><br/>triage &amp; CVE intel"]:::tool
    DHA["<b>Dhantra</b><br/>remediation plans"]:::tool
    AKI["<b>Akira</b><br/>scenario replay"]:::tool

    HAY -- "DiscoveryBundle" --> PSW
    PSW -- "AssessmentSnapshot" --> ENG
    PSW -- "AssessmentSnapshot" --> DHA
    PSW -- "AssessmentSnapshot" --> AKI

    BUS["<b>armur-contracts</b> — the shared evidence vocabulary<br/>versioned envelopes · schema-compatibility gated · the only shared dependency"]:::bus
    HAY -.->|speaks| BUS
    PSW -.->|speaks| BUS
    ENG -.->|speaks| BUS
    DHA -.->|speaks| BUS
    AKI -.->|speaks| BUS

Tool	Role	Produces → consumes
Hayagriva	discovery & recon front-end	emits a `DiscoveryBundle` → warm-starts the swarm's blackboard (skip rediscovery, straight to proving)
Pentest-Swarm ★	autonomous exploitation	consumes discovery; emits a verified `AssessmentSnapshot` (`scan --format snapshot`)
Engira	triage & vulnerability intel	consumes the snapshot → prioritized triage + CVE enrichment
Dhantra	remediation	consumes the snapshot → a `RemediationRequest` → authorized fix plan
Akira	scenario replay	consumes the snapshot → a replayable attack scenario

Every edge is a contract, not a call: a producer whose schema major Pentest-Swarm can't read is rejected at the seam (CheckEnvelope), never mis-parsed — so the suite stays honest as each tool version-skews on its own cadence. Offense is a composition of tools; this is the backbone that lets them compose.

Defending, not attacking? The same pattern runs in reverse for defense, with Heramba as the centrepiece orchestrating agat, byakugan, sharingan, and skillscan. See the Heramba README.

Comparison

How we position vs. the rest of the ecosystem. We'll ship real benchmark numbers in a future release (see the benchmarks roadmap).

Tool	Open / self-host	Architecture	Executes vs. suggests	Memory	Tools wired	MCP	Swarm?
Pentest Swarm AI	✅ open, self-hosted	Stigmergic blackboard	Executes	pgvector + pheromones	8 ProjectDiscovery + nmap; sqlmap / Burp MCP / Metasploit in roadmap	Yes	✅ real
XBOW	❌ closed SaaS	Autonomous agent (hosted)	Executes	Hosted	Managed	No public API	No
PentestGPT	✅ open	Single-agent ReAct	Suggests	None	None native	No	No
HackingBuddyGPT	✅ open	Single-agent	Executes	Run logs	Shell passthrough	No	No
PentAGI	✅ open	4 agents + planner	Executes	pgvector	40+ via MCP/shell	Partial	Pipeline
Shannon	✅ open	White-box + browser	Executes	Session state	Browser DOM	No	Pipeline
HexStrike	✅ open	MCP tool wrapper	Delegates to client LLM	None (stateless)	150+ via MCP	Yes	No
Pentest-R1	✅ open (model)	RL-tuned LLM	Executes	Trajectory	CTF-scope	No	No

If any entry here is wrong or out of date, please open a PR — we want this table to stay honest.

Feature status

Honesty labels: stable means shipped + tested, beta means works but rough edges, alpha means experimental, planned means in the roadmap.

Feature	Status	Notes
Sequential 5-phase runner	stable	Default mode; battle-tested core
Stigmergic swarm scheduler	alpha	`--swarm` flag; memory-backed blackboard wired
ProjectDiscovery toolchain	stable	subfinder, httpx, nuclei, naabu, katana, dnsx, gau
`nmap` adapter	stable	XML parsed; scope-validated
Cleanup registry	stable	Always runs on SIGINT / exit / budget-cancel
Claude prompt caching	stable	Enabled for recon + classifier by default
`--strict` LLM mode	stable	Promotes LLM errors to fatal
CVSS v3.1 scoring	stable	FIRST spec
Jev false-positive filter	beta	`--jev`; optional second-opinion pass via TypeSafe's Jev — off by default, fails open. Docs
Jev adaptive attack-path scoring	beta	`--jev-adaptive`; the swarm scores its candidate attack strategies with Jev in real time and pursues the best first (graded pheromone). Off by default, fails open.
External verification oracles	beta	`--verify`; confirm a finding against the live target with a non-LLM signal — out-of-band callback, differential response, or timing — and trust that verdict over the model. Proven findings get a VERIFIED badge and a 1.0 attack-graph edge. Scope-guarded; off by default; ignored under `--dry-run`/`--safe-mode`. Docs
Exploit chains	beta	`chain run/list/update`; a growing library of named, CVE-tied exploit chains (SSRF→RCE, auth-bypass→RCE…) — fingerprint + safe verify + report. Lean binary + on-demand updates. Docs
Chain Forge	beta	`chain forge`; draft a new exploit chain from an advisory using any configured reasoning model (Ollama/Together/Claude/Muse Spark…) — safe verification, validated, human-reviewed before it ships.
Postgres blackboard backend	beta	Migration shipped; runner uses memory-board for now
MCP server	beta	`pentestswarm mcp serve`
VS Code extension	beta	`deploy/vscode/`
GitHub Action	beta	`deploy/github-action/action.yml` with SARIF
Swarm playbooks (5)	beta	`playbooks/{bug-bounty,external-asm,ci-cd,internal-network,ctf-solver}.yaml`
Live dashboard	alpha	`web/`; UI built, wiring to live campaigns in progress
Burp MCP bridge	planned	Wave 2
Metasploit / ZAP / sqlmap adapters	planned	Wave 2
Fine-tuned Pentest-Swarm model	planned	Wave 3 (Pentest-R1 recipe)
Cybench / AutoPenBench benchmarks	planned	Wave 3

CLI

pentestswarm run                                        # ⭐ Interactive TUI — pick options + target, no flags
pentestswarm scan <target> --scope <scope> --swarm      # Scriptable: stigmergic swarm scheduler
pentestswarm scan <target> --scope <scope> --tui        # Full-screen live TUI (charts + swarm topology)
pentestswarm scan --lab --lab-target crapi              # Attack a bundled vulnerable lab, no setup
pentestswarm playbook run <name> --target <t>           # Run a community playbook
pentestswarm doctor                                     # System health check
pentestswarm install-tools                              # Fetch the recon/exploit toolchain
pentestswarm mcp serve                                  # MCP server for Claude/Cursor
pentestswarm serve                                      # Start API server + dashboard

pentestswarm run is the front door — an interactive launcher (provider + key entry, target or bundled lab, live-view choice, readiness checks) so you never have to remember flags. The scan form stays fully scriptable for CI.

LLM Providers

All agents inherit from a single provider config. Set one key, the entire swarm works.

See the model comparison and recommendations to choose by quality, cost, privacy, refusal behaviour, and setup effort.

Bring your own model — we're the harness, not the model. A new wave of open models is topping the cyber-offense benchmarks — GLM (5.3), Qwen (3.x), DeepSeek, and security-tuned fine-tunes like Pentest-R1. Pentest Swarm turns any of them — or a frontier model, or a fully-local one — into an operating pentester: real tools, swarm coordination, scope enforcement, and evidence-backed reports. The model does the reasoning; the swarm does the work.

Together AI is first-class — pick together (in pentestswarm run or --provider together) and just add your key; the endpoint is handled for you. Any other OpenAI-API-compatible endpoint (OpenAI, DeepSeek, Groq, …) works via openai + a base-URL, plus first-party Gemini. The only hard requirement is native tool/function calling, which GLM, Qwen, and DeepSeek all support.

Provider	`provider:`	Setup	Privacy	Best for
Claude (default)	`claude`	`export PENTESTSWARM_ORCHESTRATOR_API_KEY=...`	Cloud	Best quality, zero setup, prompt caching
Together AI	`together`	Just set the key — endpoint auto-configured	Cloud	Open cyber-benchmark leaders: GLM `zai-org/GLM-5.3`, Qwen `Qwen/...`, DeepSeek, Kimi
OpenAI-compatible	`openai`	Set key + the vendor's `/v1` endpoint	Cloud	OpenAI, DeepSeek, Groq, or any Chat-Completions API
Gemini	`gemini`	`export PENTESTSWARM_ORCHESTRATOR_API_KEY=AIza...`	Cloud	Large context, free tier
Ollama	`ollama`	Install Ollama + pull models	100% local	Full privacy, air-gapped (GLM / Qwen builds available)
LM Studio	`lmstudio`	Load model, enable server	100% local	GUI model management
OrcaRouter	`orcarouter`	`export PENTESTSWARM_ORCHESTRATOR_API_KEY=sk-orca-...`	Cloud	One endpoint for Claude/GPT + other frontier models, gateway-level security

Together AI example — run the whole swarm on GLM 5.3:

orchestrator:
  provider: "together"             # first-class — endpoint defaults to Together's API
  model: "zai-org/GLM-5.3"        # or Qwen/..., deepseek-ai/..., etc. — see together.ai/models
  api_key: ""                      # or export PENTESTSWARM_ORCHESTRATOR_API_KEY
  context_window: 128000

Tech Stack

Component	Technology	Why
Platform	Go 1.24	Single binary, goroutine concurrency, native security tools
CLI	Cobra + bubbletea	Beautiful TUI with multi-panel agent view
LLM	Claude / Together AI (GLM · Qwen · DeepSeek) / Gemini / OrcaRouter / Ollama / LM Studio	Best quality cloud + open cyber-bench leaders + full privacy local
Security Tools	subfinder · httpx · nuclei · naabu · katana · dnsx · gau · nmap	ProjectDiscovery Go libs + nmap subprocess
Blackboard	Postgres 16 + pgvector	Transactional writes, vector similarity, pheromone decay in SQL
Cache	Redis 7	Rate limiting, session state
Dashboard	Next.js 15 + shadcn/ui + tremor	Dark-first, chart-heavy
MCP	JSON-RPC stdio	Claude Desktop + Cursor integration

Development

git clone https://github.com/Armur-Ai/Pentest-Swarm-AI.git
cd Pentest-Swarm-AI
./scripts/setup.sh    # Install tools, start Postgres/Redis/Ollama
make build            # Compile binary
make test             # Run tests
make dev              # Hot-reload development

Regenerate the demo GIF after any CLI change:

brew install vhs      # one-off
vhs docs/demo-flashy.tape

Roadmap

Wave 1 (in flight): real swarm architecture (done), dashboard wire-up, Burp MCP
Wave 2: sqlmap / Metasploit / ZAP adapters, bug-bounty + ASM + CI/CD playbook polish, official GitHub Action in Marketplace
Wave 3: fine-tuned Pentest-Swarm model (Pentest-R1 recipe), Cybench / AutoPenBench / CVE-Bench numbers, agent-memory poisoning hardening (MINJA / MemoryGraft defences)

🧠 The Adaptive Swarm — headline releases

Today the swarm reacts to findings and runs verified attack playbooks (BOLA/IDOR, mass assignment, NoSQL injection, excessive data exposure) end-to-end. Next, we make it think — three major capabilities, each shipping as its own release:

① Runtime reaction to discoveries (planned) — stigmergic emergence: the swarm mines every response for object references (ids, UUIDs, emails), writes them to the blackboard, and other agents react by probing those objects across endpoints. Find one leaked id and the swarm turns it into cross-user BOLA/IDOR attacks nobody scripted.
② Self-correcting attacks (planned) — closed-loop replanning: a failed step (401/403/415, an odd response body) feeds back into the planner, which adjusts the request and retries. Attacks heal themselves instead of dead-ending.
③ On-demand specialist sub-agents (planned) — the swarm spawns purpose-built agents at runtime (an auth agent to hold a session, a fuzzing agent for a discovered parameter, a chain-builder for a specific API) and tears them down when done.

Together these turn a reactive swarm into an adaptive one — attack surface it has never seen, handled without anyone writing a plan. Generalization beyond curated targets and full LLM-driven chaining ride on top of these.

Follow the GitHub Project board for live status.

Why "Swarm"?

Single agents are tools. Pipelines dressed up as agents are slightly fancier tools. A swarm is different: agents share an environment, each agent's writes influence other agents' behaviour, and the useful work is emergent rather than prescribed. That's what lets a swarm handle a 1,000-subdomain target without anyone writing a plan for it.

One agent is a tool. A swarm is a platform.

Our Mission

Offense is going autonomous — the defense of it should be open. XBOW proved AI can top the bug-bounty leaderboards; it did so as a closed, hosted SaaS. We believe the capability to find and prove vulnerabilities at machine speed shouldn't be locked behind one vendor's cloud and price — it should be open-source, self-hosted, and inspectable, so defenders, researchers, and independent testers can run it on their own infrastructure and their own models.

So our mission is to build the first real open-source pentest swarm in the open: a harness that turns any model — frontier or fully-local — into an operating pentester, with the safety rails (fail-closed scope, egress guard, an authorization gate, a full audit trail) that keep autonomous offense accountable. Powerful real-world-harm capabilities stay gated behind verified, contracted operators — on purpose.

If a real open-source swarm is something you want to exist, help us build it.

Community

Join the swarm on Discord → 🐝

We're building the first real open-source pentest swarm in the open — come build it with us. In Discord you can share findings, request a tool adapter, argue about stigmergy and pheromone decay, get help running your first scan, or grab a good first issue and ship a PR. Researchers, red-teamers, and the AI-security-curious all welcome.

⭐ If a real open-source swarm is something you want to exist, drop a star. Star velocity is the fuel that keeps this shipping — it's the single biggest thing you can do in ten seconds.

Who's using Pentest Swarm?

Running Pentest Swarm — internally, on client engagements, in CI, or embedded in your own workflow? Add your org to ADOPTERS.md with a quick PR — it helps others trust the project and helps us prioritize what to build. Not ready to be listed publicly? A hello in Discord still helps.

Contributors

Every PR, issue, tool adapter, and playbook makes the swarm better. Thank you to everyone building this in the open. 💛

New contributor? Grab a good first issue and read CONTRIBUTING.md to get started.

Editions — Free · Commercial · Enterprise

Pentest Swarm AI is free and open source (AGPL-3.0), and always will be. The open-source edition is a fully capable, defensive-grade autonomous API/web-app pentester — it exploits and chains attacks (BOLA/IDOR, JWT, SSRF, SQLi, GraphQL, BFLA…), builds and scores attack paths, ships a large library of attack-path + CVE chains, and includes every safety guardrail (fail-closed scope, egress guard, the authorization gate, and a full audit trail).

More aggressive offensive capabilities are deliberately not in the open-source tool. Post-exploitation and host takeover, credential testing at scale, red-team detection-evasion tradecraft, and similar high-impact capabilities are reserved for the Commercial and Enterprise tiers — and are gated behind identity verification and a signed authorized-use agreement. This is intentional, not a paywall trick: capabilities that are trivially abused for real-world harm should not be handed to anonymous users. Access requires completing verification so there is an accountable, contracted operator behind every powerful action.

	Free / Community (OSS)	Commercial (verified)	Enterprise
Autonomous web/API exploitation + chaining	✅	✅	✅
All safety guardrails (scope · egress · authorization · audit)	✅	✅	✅
Multi-target batch · context ingestion · local memory · coverage catalog	✅	✅	✅
Advanced offensive reach — post-exploitation & host takeover, credential testing at scale, red-team evasion tradecraft, and more	—	✅ (verified + contracted)	✅
Fleet & platform — parallel fleet dashboard, RBAC/SSO, scheduling, managed/hosted	—	—	✅
Compliance & assurance — signed/tamper-evident audit, SIEM/SOAR, PCI/SOC2/HIPAA reporting	—	—	✅
Live chain feed + integrations (Jira/ServiceNow, Burp, CI/CD, cloud, API/webhooks)	large, each release	✅ live feed	✅ live feed + full integrations
Support	community / Discord	priority	✅ SLA · onboarding · custom chains · managed service

Want Commercial or Enterprise access? It requires identity verification and a signed authorized-use agreement — a deliberate safety gate so powerful offensive capability only reaches accountable, authorized operators. Reach out and we'll walk you through verification.

📧 akhil@armur.ai — tell us your setup and what you're trying to do, and we'll get you set up.

Legal & Credits

Legal Disclaimer: Pentest Swarm AI is designed exclusively for authorized security testing, bug bounty programs, CTF competitions, and educational research. You must obtain explicit written permission from the target system owner before running any scan. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and equivalent laws worldwide. The authors and contributors of this project accept no liability for misuse, damage, or any illegal activity conducted with this tool. By using this software, you agree that you are solely responsible for ensuring your use complies with all applicable laws and regulations. Do not use this tool against systems you do not own or have explicit authorization to test. The tool enforces scope fail-closed and requires you to affirm authorization before attacking a real target — see the full Responsible Use Policy.

Credits & Inspiration

This project stands on the shoulders of giants. We credit and thank these projects for pioneering AI-powered offensive security:

PentestGPT — the OG that proved LLMs can pentest

PentAGI — fully autonomous agent architecture

Strix — AI hackers that find and fix vulns

CAI — cybersecurity AI framework, 3600x faster than humans

HackingBuddyGPT — LLM hacking in 50 lines of code

Shannon — white-box AI pentester

BlacksmithAI — multi-agent pentest framework

PentestAgent — black-box AI security testing

Their open-source contributions made tools like this possible.

Licensing and commercial editions

Pentest Swarm AI follows an open-core model. The Community Edition is licensed under GNU AGPL-3.0-only; see LICENSE. Commercial use of the Community Edition is permitted subject to that license. Armur AI also offers commercial, enterprise, and hosted products, which may include separately licensed components.

For the planned separate-control-plane product, the Community Edition will run as a separately executed, pinned, unmodified public release under AGPL. This product architecture does not depend on proprietary relicensing of existing community contributions.

A signed contributor license agreement may grant Armur AI additional rights, including rights to distribute covered contributions under proprietary terms, while contributors retain copyright. Earlier contributions are not covered by a new CLA merely because the policy is introduced. See CONTRIBUTING.md for the applicable policy and effective date.

Distribution and modification can create notice and corresponding-source obligations. AGPL section 13 addresses remote interaction with modified versions. The license text controls; the price charged for a product or service does not determine its obligations.

Built by Armur AI.

Pentest Swarm AI alternatives

View more →

Similar ai agents in Security & Testing, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

Name	Stars	Licence	Last updated	Scan
Pentest Swarm AI (this page) Armur-Ai	3.1k	AGPL-3.0	Nov 1, 2026	Scanned, no flagged issues
ECC affaan-m	294k	MIT	Oct 30, 2026	Scanned, no flagged issues
Strix usestrix	73k	Apache-2.0	Oct 30, 2026	Scanned, no flagged issues
Goose aaif-goose	56k	Apache-2.0	Nov 1, 2026	Scanned, no flagged issues
Anthropic Cybersecurity Skills mukul975	35k	Apache-2.0	Aug 31, 2026	Scanned, no flagged issues
Pentagi vxcontrol	33k	MIT	Oct 22, 2026	Scanned, no flagged issues