MCP Observatory
6m ago Tracked 53,340 Last 6m ago 24h 2,739
github Python re-analysis due

0xSteph/pentest-ai

github

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

maintainer
0xSteph
license
MIT
first seen
2026-05-24
last seen
2026-09-05
releases · 30d
4
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 52 tools
transport stdio · http · sse counts 52 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • authenticated_scan
  • browser_inspect
  • builtin_scan
  • close_engagement
  • discover_attack_chains
  • ensure_tools_installed
  • generate_detection_rules
  • generate_report
  • get_attack_chains
  • get_campaign_summary
  • get_config
  • get_engagement_status
  • get_engagement_summary
  • get_evidence
  • get_findings
  • health
  • http_request
  • kill_process
  • list_engagements
  • list_plugins
  • list_probes
  • list_processes
  • list_tools
  • plan_tools
  • poll_oob
  • prove_attack_chain
  • query_compliance
  • resume_engagement
  • run_probe
  • run_recon
  • run_tool
  • scan_dns_builtin
  • scan_headers_builtin
  • scan_paths_builtin
  • scan_ports_builtin
  • scan_secrets_builtin
  • scan_ssl_builtin
  • select_agent
  • set_intensity
  • start_campaign
  • start_engagement
  • test_active_directory
  • test_api_security
  • test_cloud
  • test_credentials
  • test_mobile
  • test_privesc
  • test_social_engineering
  • test_vulnerabilities
  • test_web_app
  • test_wireless
  • validate_finding
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7af0b9d · analyzer v33 · 2d ago

skills & prompt files 1

danger signals6

code evidence vv1.4.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 552

filesystem 69

  • fs 0xSteph-pentest-ai-7af0b9d/agents/browser/browser_agent.py :117 with open(out_path, "wb") as fp:
  • fs 0xSteph-pentest-ai-7af0b9d/agents/llm_redteam/agent.py :9 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/agents/llm_redteam/corpus.py :6 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/agents/report/renderer.py :8 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/agents/report/report_agent.py :49 with open(md_path, "w") as f:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/clean_fp_sweep.py :30 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/scoring/juiceshop.py :13 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/scripts/score_juiceshop.py :15 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/cli/_version_check.py :30 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/cli/auth.py :19 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/cli/auth_profiles.py :36 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/cli/ci.py :14 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/cli/credential_resolvers/op.py :16 import shutil
  • fs 0xSteph-pentest-ai-7af0b9d/cli/main.py :161 with open(path) as f:
  • fs 0xSteph-pentest-ai-7af0b9d/cli/mcp_setup.py :5 import shutil
  • fs 0xSteph-pentest-ai-7af0b9d/cli/menu.py :32 import shutil
  • fs 0xSteph-pentest-ai-7af0b9d/config/settings.py :6 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/aup_consent.py :30 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/cache.py :18 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/demo/app.py :20 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/evidence.py :13 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/http_identity.py :8 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/install_preferences.py :27 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/mcp_client.py :40 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/playbook.py :17 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/probes/web/exif_metadata.py :74 img = _PILImage.open(io.BytesIO(data))
  • fs 0xSteph-pentest-ai-7af0b9d/engine/probes/web/path_traversal.py :5 opens the path verbatim, so any handler that does ``open(BASE / name)``
  • fs 0xSteph-pentest-ai-7af0b9d/engine/target_expander.py :13 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/telemetry.py :50 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/engine/tool_installer.py :9 import shutil
  • fs 0xSteph-pentest-ai-7af0b9d/mcp_server/auth_local.py :17 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1562 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/apply_triage_labels.py :35 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/benchmark_juice_shop.py :22 import shutil
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/check_pytest_result.py :27 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/fill-legal.py :20 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/run_dvwa_engagement.py :164 with open(exec_path, "w") as f:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/scripts/triage_sample.py :19 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/cleanapp/server.py :21 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/server.py :38 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_agent_tool_names_resolve.py :84 with open(path, encoding="utf-8") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_api_server.py :34 os.unlink(db_path)
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_api_server_broken_routes.py :36 os.unlink(db_path)
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_aup_consent.py :12 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_cache.py :6 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_ci_result_guard.py :19 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_cli.py :283 with open(out_path) as f:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_cli_auth_coverage.py :5 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_dashboard.py :38 os.unlink(db_path)
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_declared_counts.py :165 with open(os.path.join(_ROOT, path), encoding="utf-8") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_doctor_storage_paths.py :14 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_engagement_lifecycle_e2e.py :19 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_evidence.py :104 with open(files[0], "a") as f:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_client_and_hitl.py :7 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_prove_attack_chain.py :9 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_setup.py :4 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_tool_schema_snapshot.py :35 with open(_SNAPSHOT, "w", encoding="utf-8") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_no_raw_http_call_sites.py :60 with open(path, encoding="utf-8") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_packaging_covers_all_packages.py :46 with open(os.path.join(_ROOT, "pyproject.toml"), "rb") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_parse_cloudfox_certipy.py :11 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_playbook.py :160 pb = self._pb([{"id": "a", "condition": "open('/etc/passwd')"}])
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_playbook_auth_profile.py :5 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_conformance.py :30 with open(path, encoding="utf-8", errors="ignore") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_receipt.py :62 with open(_SNAPSHOT, "w", encoding="utf-8") as fh:
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_tool_bridge_e2e.py :21 import shutil
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_tracing_and_telemetry.py :11 from pathlib import Path
  • fs (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_version_single_source.py :21 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/tools/plugin_loader.py :10 from pathlib import Path
  • fs 0xSteph-pentest-ai-7af0b9d/tools/registry.py :12 import shutil

shell / exec 12

  • shell (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/clean_fp_sweep.py :26 import subprocess
  • shell 0xSteph-pentest-ai-7af0b9d/cli/credential_resolvers/op.py :17 import subprocess
  • shell 0xSteph-pentest-ai-7af0b9d/cli/menu.py :390 import subprocess
  • shell 0xSteph-pentest-ai-7af0b9d/engine/oob/payloads.py :158 "{{ self.__init__.__globals__.os.system('nslookup {OAST}') }}",
  • shell 0xSteph-pentest-ai-7af0b9d/engine/tool_installer.py :10 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/scripts/benchmark_juice_shop.py :25 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/scripts/diag_post_engagement_hang.py :42 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/scripts/run_dvwa_full.py :5 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_ci_result_guard.py :17 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_cli_start_clean_exit.py :53 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_engagement_lifecycle_e2e.py :347 import subprocess
  • shell (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_resolvers_external.py :6 import subprocess

network 132

  • net 0xSteph-pentest-ai-7af0b9d/agents/browser/browser_agent.py :268 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/agents/llm_redteam/adapter.py :8 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/agents/llm_redteam/agent.py :12 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/agents/web/spa_probes.py :35 import urllib.parse
  • net 0xSteph-pentest-ai-7af0b9d/agents/web/web_agent.py :11 from urllib.parse import urlsplit
  • net (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/clean_fp_sweep.py :29 import urllib.request
  • net (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/scoring/common.py :21 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/cli/_version_check.py :102 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/cli/auth.py :21 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/cli/ci.py :17 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/cli/credential_resolvers/vault.py :18 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/cli/main.py :90 from urllib.parse import urlsplit
  • net 0xSteph-pentest-ai-7af0b9d/engine/agents/handlers/meta.py :24 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/agents/handlers/registry_bridge.py :7 2. Calls the probe function under an aiohttp.ClientSession
  • net 0xSteph-pentest-ai-7af0b9d/engine/agents/handlers/web_probes.py :15 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/auth_session.py :26 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/engine/authenticated_scan.py :21 from urllib.parse import parse_qs, urldefrag, urljoin, urlparse, urlunparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/capsule.py :30 from urllib.parse import urlsplit
  • net 0xSteph-pentest-ai-7af0b9d/engine/cve_db.py :28 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/demo/app.py :21 from urllib.parse import urlsplit
  • net 0xSteph-pentest-ai-7af0b9d/engine/llm/factory.py :71 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/engine/llm/providers/anthropic.py :8 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/engine/llm/providers/ollama.py :9 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/engine/llm/providers/openai.py :9 import httpx
  • net 0xSteph-pentest-ai-7af0b9d/engine/oob/client.py :30 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/oob/local_server.py :18 from aiohttp import web
  • net 0xSteph-pentest-ai-7af0b9d/engine/oracles.py :23 from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/orchestrator.py :70 import aiohttp # deferred, matching the caller's import style
  • net 0xSteph-pentest-ai-7af0b9d/engine/playbook_runner.py :12 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/_safety.py :21 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/ad/asrep.py :17 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/auth/runner.py :33 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/payloads/library.py :18 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/primitives.py :32 from urllib.parse import urlencode
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/recon/crawler.py :29 from urllib.parse import urljoin, urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/recon/stealth_crawler.py :28 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/asset_secrets_scan.py :27 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/business_logic_fuzz.py :31 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/coupon_forging.py :35 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/dom_xss.py :26 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/exif_metadata.py :26 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/file_upload_validation.py :32 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/forced_error.py :17 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/hidden_discovery.py :20 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/http_request_smuggling.py :27 from urllib.parse import urlsplit
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/nosql_fuzz.py :23 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/oauth_pkce_downgrade.py :31 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/password_reset_weak.py :21 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/path_traversal.py :34 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/race_condition.py :36 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/reflected_xss.py :23 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/saml_xsw.py :32 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/spa_hash_routes.py :27 from urllib.parse import urljoin, urlparse
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/sqli_fuzz.py :379 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/ssrf_cloud_metadata.py :30 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/ssrf_echo.py :16 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/ssti_fuzz.py :131 from urllib.parse import parse_qsl, urlsplit
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/ssti_polyglot.py :34 from urllib.parse import quote
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/trusted_header_bypass.py :23 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/type_confusion.py :20 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/probes/web/xxe_upload.py :31 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/scanners.py :11 import socket
  • net 0xSteph-pentest-ai-7af0b9d/engine/scope.py :11 import socket
  • net 0xSteph-pentest-ai-7af0b9d/engine/telemetry.py :52 from urllib.error import URLError
  • net 0xSteph-pentest-ai-7af0b9d/engine/verifier.py :238 import aiohttp
  • net 0xSteph-pentest-ai-7af0b9d/engine/webhooks.py :13 from urllib.request import Request, urlopen
  • net 0xSteph-pentest-ai-7af0b9d/mcp_server/probes.py :69 from urllib.parse import urlparse
  • net 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1696 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/scripts/benchmark_juice_shop.py :28 import urllib.error
  • net (weak) 0xSteph-pentest-ai-7af0b9d/scripts/preflight-check.py :15 import urllib.error
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/cleanapp/conftest.py :4 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/cleanapp/server.py :23 from urllib.parse import urlsplit
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/cleanapp/test_clean_fp.py :10 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/conftest.py :10 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/server.py :41 from aiohttp import web
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/test_e2e_dom_xss.py :9 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/test_e2e_probes.py :15 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_api_security_e2e_smoke.py :22 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_auth_runner_form_cookie.py :8 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_auth_scan_e2e_smoke.py :25 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_auth_session.py :7 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_auth_session_bearer_flow.py :7 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_authenticated_scan_coverage.py :15 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_browser_agent_e2e_smoke.py :27 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_capsule.py :6 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_capsule_replay_scope.py :11 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_ci_mode.py :7 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_cli_auth_coverage.py :8 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_csrf_auth_e2e_smoke.py :20 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_demo_app.py :9 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_engagement_lifecycle_e2e.py :18 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_evidence_integration_e2e.py :19 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_handler_meta.py :31 ), patch("engine.agents.handlers.meta.aiohttp.ClientSession"):
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_integration_dvwa.py :16 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_juiceshop_e2e_smoke.py :32 import urllib.error
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_llm_e2e_smoke.py :101 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_llm_factory_validate.py :15 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_llm_redteam.py :7 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_action_surface.py :12 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_auth_profile.py :16 import httpx
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_auth_session_reuse.py :15 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_poll_oob_local.py :10 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_mcp_poll_oob_severity.py :13 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_new_high_roi_probes.py :113 with patch("aiohttp.ClientSession", fake_session_cls), \
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oast_local_server.py :7 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_observation_normalization.py :109 "engine.agents.handlers.registry_bridge.aiohttp.ClientSession"
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oob_client.py :192 # Mock the aiohttp.ClientSession.post path.
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oob_end_to_end.py :24 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oob_local_registry.py :88 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_data_exposure_cookie_isolation.py :3 The orchestrator verifies every finding on one `aiohttp.ClientSession`, and six
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_differential_evidence.py :76 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_leaked_cloud_key.py :11 from urllib.parse import urlparse
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_leaked_credential.py :18 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_nosql.py :26 from urllib.parse import unquote
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_oracle_trusted_header.py :116 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_orchestrator_target_wait.py :19 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_path_param_injection.py :19 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_crawler.py :364 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_primitives.py :51 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_ssrf_recipe.py :17 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_ssti_recipe.py :14 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_stored_xss_recipe.py :15 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_probe_type_confusion_recipe.py :16 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_registry_bridge.py :60 with patch("engine.agents.handlers.registry_bridge.aiohttp.ClientSession"):
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_registry_bridge_hang_guard.py :54 with patch("engine.agents.handlers.registry_bridge.aiohttp.ClientSession"):
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_registry_bridge_safety_parity.py :65 with patch("engine.agents.handlers.registry_bridge.aiohttp.ClientSession"):
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_resolvers_external.py :91 "httpx.get",
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_scanners.py :4 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_spa_probes.py :112 import aiohttp
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_tool_bridge_e2e.py :22 import socket
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_verifier_wiring.py :186 from urllib.parse import unquote
  • net (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_version_check.py :79 with patch("httpx.Client", return_value=fake_client):

secrets 7

  • secrets 0xSteph-pentest-ai-7af0b9d/cli/ci.py :159 token = token or os.environ.get("GITHUB_TOKEN")
  • secrets 0xSteph-pentest-ai-7af0b9d/cli/credential_resolvers/vault.py :30 token = os.environ.get("VAULT_TOKEN", "")
  • secrets 0xSteph-pentest-ai-7af0b9d/cli/main.py :144 os.getenv("PENTEST_AI_API_KEY")
  • secrets 0xSteph-pentest-ai-7af0b9d/config/settings.py :35 self.api_key = self.api_key or os.getenv("OPENAI_API_KEY", "")
  • secrets 0xSteph-pentest-ai-7af0b9d/engine/llm/factory.py :59 return bool(os.getenv("ANTHROPIC_API_KEY", "").strip() or os.getenv("OPENAI_API_KEY", "").strip())
  • secrets 0xSteph-pentest-ai-7af0b9d/engine/oob/registry.py :37 return os.getenv("PTAI_OAST_TOKEN", "")
  • secrets (weak) 0xSteph-pentest-ai-7af0b9d/tests/test_llm_e2e_smoke.py :27 not os.getenv("ANTHROPIC_API_KEY") or os.getenv("PTAI_E2E_LIVE") != "1",

database 4

  • db (weak) 0xSteph-pentest-ai-7af0b9d/benchmarks/clean_fp_sweep.py :25 import sqlite3
  • db 0xSteph-pentest-ai-7af0b9d/engine/demo/app.py :19 import sqlite3
  • db (weak) 0xSteph-pentest-ai-7af0b9d/scripts/benchmark_juice_shop.py :24 import sqlite3
  • db (weak) 0xSteph-pentest-ai-7af0b9d/tests/honeypot/server.py :37 import sqlite3

tool registrations 52

  • list_probes 0xSteph-pentest-ai-7af0b9d/mcp_server/probes.py :84
  • run_probe 0xSteph-pentest-ai-7af0b9d/mcp_server/probes.py :124
  • http_request 0xSteph-pentest-ai-7af0b9d/mcp_server/probes.py :323
  • plan_tools 0xSteph-pentest-ai-7af0b9d/mcp_server/security_tools.py :40
  • ensure_tools_installed 0xSteph-pentest-ai-7af0b9d/mcp_server/security_tools.py :83
  • start_engagement 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :120
  • get_engagement_status 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :208
  • get_findings 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :215
  • health 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :251
  • get_attack_chains 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :290
  • list_tools 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :303
  • run_tool 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :364
  • run_recon 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :401
  • test_web_app 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :457
  • authenticated_scan 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :593
  • test_active_directory 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :756
  • test_cloud 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :831
  • discover_attack_chains 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :902
  • generate_report 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :924
  • generate_detection_rules 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :969
  • validate_finding 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1005
  • test_api_security 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1128
  • test_credentials 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1151
  • test_vulnerabilities 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1174
  • test_privesc 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1197
  • test_mobile 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1220
  • test_wireless 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1242
  • test_social_engineering 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1261
  • browser_inspect 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1286
  • select_agent 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1317
  • list_processes 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1335
  • kill_process 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1348
  • builtin_scan 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1365
  • scan_ports_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1390
  • scan_headers_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1399
  • scan_ssl_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1408
  • scan_paths_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1417
  • scan_dns_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1426
  • scan_secrets_builtin 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1435
  • get_engagement_summary 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1447
  • list_engagements 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1454
  • resume_engagement 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1464
  • close_engagement 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1504
  • query_compliance 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1516
  • get_evidence 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1542
  • list_plugins 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1635
  • poll_oob 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1643
  • prove_attack_chain 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1680
  • get_config 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1740
  • set_intensity 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1748
  • start_campaign 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1775
  • get_campaign_summary 0xSteph-pentest-ai-7af0b9d/mcp_server/server.py :1817

declared dependencies 47

  • fastmcp@>=2.0
  • httpx@>=0.27
  • pydantic@>=2.0
  • rich@>=13.0
  • typer@>=0.9
  • aiosqlite@>=0.20
  • pyyaml@>=6.0
  • python-dotenv@>=1.0
  • jinja2@>=3.1
  • cryptography@>=42.0
  • dnspython@>=2.6
  • scapy@>=2.5
  • paramiko@>=3.4
  • impacket@>=0.11
  • bloodhound@>=1.7
  • requests@>=2.31
  • beautifulsoup4@>=4.12
  • aiohttp@>=3.9
  • tenacity@>=8.2
  • structlog@>=24.1
  • hashids@>=1.3
  • pytest@>=8.0
  • pytest-asyncio@>=0.23
  • pytest-cov@>=4.1
  • pytest-timeout@>=2.3
  • ruff@>=0.3
  • mypy@>=1.8
  • pre-commit@>=3.6
  • types-PyYAML@>=6.0
  • s@/api/import endpoint replicates TaskFlow
  • t@import lxml.
  • 3.11@*
  • boto3@>=1.34
  • azure-identity@>=1.15
  • azure-mgmt-resource@>=23.0
  • google-cloud-storage@>=2.14
  • litellm@>=1.50
  • fastapi@>=0.115
  • uvicorn@>=0.30
  • websockets@>=13.0
  • questionary@>=2.0
  • playwright@>=1.45
  • scrapling@>=0.4.7
  • opentelemetry-api@>=1.27
  • opentelemetry-sdk@>=1.27
  • opentelemetry-exporter-otlp-proto-grpc@>=1.27
  • ptai@*