PentestGPT
Open-source agent framework that uses an LLM backend to run staged penetration testing tasks.
How the 6.2 was reached
- Quality of output7/10
15,647 GitHub stars and MIT licence, with recent activity; covers multiple challenge categories, though no benchmark results were found. github.com
- Ease of use5/10
Requires Python 3.12+, the uv package manager, and an authenticated Claude Code or Codex CLI; docs are the README only. github.com
- Pricing value7/10
Free MIT-licensed code, but it needs a paid Claude Code or Codex subscription or model API. github.com
- API and integration quality6/10
Pluggable backends for Claude Code and Codex, with legacy support for many model providers and Ollama; no formal API. github.com
- Solves the problem it claims to solve6/10
Staged recon, exploit and walkthrough pipeline matches the claim; 15,647 stars show interest, but no independent results on real pentests. github.com
6.2/10 is the mean of the 5 criteria that apply. Scored on the five-criteria rubric v1, 29 September 2026. How scoring works
Pricing
- MIT licence
- Needs a paid Claude Code or Codex subscription or model API
Key Features
- Multi-stage pipeline of recon, exploit and walkthrough
- Findings from each stage feed the next
- Covers Web, Crypto, Reversing, Forensics, PWN and Privilege Escalation challenges
- Pluggable backends for Claude Code and Codex
- Legacy mode for OpenAI, Anthropic, Gemini, DeepSeek, xAI, Qwen, Moonshot and Ollama
Pros & Cons
Pros
- Free MIT-licensed code with 15,647 GitHub stars
- Staged workflow matches how many pentests are structured
- Backend choice, including local Ollama in legacy mode
- Recent repository activity
Cons
- Needs Python 3.12+, uv and an authenticated Claude Code or Codex CLI
- Docs are the README only
- No benchmark results or independent real-pentest evidence found
- Model usage costs come on top of the free code
PentestGPT fits security practitioners and CTF players who already have Claude Code or Codex and want a guided pipeline. Anyone needing proven results on real engagements, or a formal API, should look elsewhere.
Try PentestGPT →Added to scored.tools on
Show this score
Free for any tool, at any score. It shows the live score, so it changes when the score does. Paste this where you want it:
<a href="https://scored.tools/tools/pentestgpt/"><img src="https://scored.tools/badge/pentestgpt.svg" alt="PentestGPT on scored.tools: 6.2/10" width="160" height="40"></a>Do you run PentestGPT? Claim this page to confirm the facts, correct one or respond. It is free and never changes the score.
Competitors to PentestGPT
Other tools in the automation category worth comparing.
Strix
7.0/10Autonomous security platform that tests code, APIs, and infrastructure with validated findings and fix PRs.
HexStrike AI
6.8/10AI-powered offensive security framework with autonomous penetration testing and vulnerability analysis capabilities.
CAI
4.2/10AI framework for security professionals with multi-agent systems and specialized tools