Pentest-AI — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Revisit the documented MCP penetration-testing workflow as its reproducible finding and machine-verification evidence evolves.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Authorized security teams validating web applications with evidence-backed penetration testing.

What we know

An AI penetration-testing tool combining model-driven investigation with verification oracles, reproducible proofs and scope enforcement.

Maintenance / activity evidence

Observed Sep 13, 2026 (UTC)Refresh public documentation and installation guidance ( 57)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Scope-enforced target probing plus installed scanners. Writes: Scanning; Exploit reproduction; Campaign actions.
Provider-specific model auth
Sensitive access: Target data, Credentials, Findings

Offensive-security capabilities require explicit authorization, fail-closed scoping and careful handling of target evidence.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,715 repository stars · 1.2k package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Do updated pentest workflows preserve reproducible evidence for findings and keep execution scoped to authorised targets?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Offensive-security capabilities require explicit authorization, fail-closed scoping and careful handling of target evidence.
Scope-enforced target probing plus installed scanners.
Provider-specific model auth
Findings stored locally; model/scanner/OAST calls may send data externally.
Reviewed write actions: Scanning; Exploit reproduction; Campaign actions
Sensitive access: Target data, Credentials, Findings
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Authorized targets only.
Coverage is incomplete and findings require human interpretation.
Scanners, OAST and model providers have their own network behavior.

Original activity observations

2026-09-13T07:44:23Z: Refresh public documentation and installation guidance ( 57)

Technical identity

github.com/0xsteph/pentest-ai

Exact implementation source: https://github.com/0xsteph/pentest-ai ↗
Reviewed resource type: Testing / Debugging
Repository identity: 0xSteph/pentest-ai
Package identity: pypi:ptai

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
0xsteph/pentest-ai
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
pypi.org/project/ptai/
Source material retained for this review.
Includes references whose attribution is not established.
Evidence source ↗
pentestai.xyz/aup
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Testing / Debugging setup

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Requires Python 3.10–3.14 and pipx. Run pipx install ptai, preview ptai setup --mcp --dry-run, then intentionally approve client registration using ptai setup --mcp. The wizard changes user-wide MCP settings.
pipx install ptai
ptai setup --mcp --dry-run
ptai setup --mcp
Configure / authenticate
Publisher instructions
Python 3.10–3.14 and pipx. Wizard asks before registering detected clients in user-wide settings; dry-run before apply. Authorization/scope must be explicit before any security scan.
Check connection
Suggested check
Run `codex mcp get pentest-ai` or `claude mcp get pentest-ai` for registration, then inspect available read-only tools in the host. Registration check does not establish permission for penetration testing.
Remove / uninstall / revoke
MCP100 setup guide
If configured via Codex, run `codex mcp remove pentest-ai`; if via Claude Code, `claude mcp remove pentest-ai`. To remove the CLI installed by pipx, run `pipx uninstall ptai`. Do not launch a scan to verify removal.
codex mcp remove pentest-ai

Official Documentation & Sources

What it does

An AI penetration-testing tool combining model-driven investigation with verification oracles, reproducible proofs and scope enforcement.

Capability: Security & Testing
Resource type: Testing / Debugging
Industry: Cybersecurity
Best fit: Authorized security teams validating web applications with evidence-backed penetration testing.

Representative uses

Run scoped web engagements
Verify candidate vulnerabilities
Replay proof capsules
Connect via MCP/CLI/CI

Limitations

Authorized targets only.
Coverage is incomplete and findings require human interpretation.
Scanners, OAST and model providers have their own network behavior.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Provider-specific model auth
Permissions: Scope-enforced target probing plus installed scanners.
Data handling: Findings stored locally; model/scanner/OAST calls may send data externally.
Cost: unknown
Risk and cautions: Offensive-security capabilities require explicit authorization, fail-closed scoping and careful handling of target evidence.

Access scope and cautions

Write actions: Scanning Exploit reproduction Campaign actions
Sensitive access: Target data Credentials Findings
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Run scoped web engagements; Verify candidate vulnerabilities; Replay proof capsules; Connect via MCP/CLI/CI.

What setup and authentication are documented?

Recorded installation/entrypoint step: pipx install ptai; ptai setup --mcp. Recorded transport: stdio. Recorded environment-variable notes: PENTEST_AI_LLM_PROVIDER; PENTEST_AI_MODEL. No configuration values are supplied here. Prerequisites: Python 3.10–3.14; pipx; Authorized target. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Model-provider specific; explicit target authorization/scope required.

Can it modify data or perform write operations?

Documented write actions include: Scanning; Exploit reproduction; Campaign actions. Recorded permission boundary: Scope-enforced target probing plus installed scanners.

What data-handling boundary should I consider?

Findings stored locally; model/scanner/OAST calls may send data externally. Recorded sensitive-access context: Target data; Credentials; Findings.

What limitations and risks should I check before use?

Offensive-security capabilities require explicit authorization, fail-closed scoping and careful handling of target evidence. Authorized targets only. Coverage is incomplete and findings require human interpretation. Scanners, OAST and model providers have their own network behavior. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

0xSteph is listed as Community implementation in MCP100’s current evidence.