High-risk tools in Pentest Ai

run_probe

Start a reconnaissance scan against a target. Returns immediately with an engagement_id while the recon agent runs asynchronously. Poll get_engagement_status(engagement...

Run a specific security tool against a target. Returns structured results that are automatically stored in the findings database.

Start a multi-target campaign. Creates one engagement per target. Accepts a list of IPs, hostnames, or URLs.

Start a new pentest engagement against a target. AUTHORIZED TARGETS ONLY. This initiates reconnaissance and begins the automated assessment. All findings are stored and...

Run a deterministic authenticated web scan (no LLM required). Logs in, crawls same-host pages, probes each parameterized endpoint with SQLi/XSS/command-injection payloa...

Run built-in security scans without requiring any external tools. Works immediately after install. Scan types: all, ports, headers, ssl, paths, dns, secrets. Includes: ...

ensure_tools_installed

http_request

Perform DNS enumeration (built-in).

Scan common ports on a target (built-in, no nmap required).

Run Active Directory security assessment. Includes: BloodHound enumeration, Kerberoasting, AS-REP roasting, privilege escalation paths, delegation attacks, and domain d...

Run API security testing (REST + GraphQL) following OWASP API Top 10. Tests for: BOLA/IDOR, JWT alg-confusion, OAuth callback validation, rate-limit bypass, mass assign...

Run cloud security assessment. Providers: aws, azure, gcp Tests for: Misconfigurations, exposed secrets, overly permissive IAM, vulnerable services, and privilege ...

Run authentication testing (default creds, password spray, MFA bypass). Lockout-aware. Prefers spraying over brute force on production targets. Returns immediately with...

Run mobile app security testing (Android or iOS). Static + dynamic analysis. OWASP Mobile Top 10 coverage. Returns immediately with engagement_id; agent runs asynchrono...

Run privilege escalation enumeration on a compromised host. Platforms: linux, windows, container. Uses linpeas/winpeas/deepce plus kernel-exploit-suggester. Enumeration...

Run a social engineering assessment (phishing simulation, OSINT, DMARC audit). Returns immediately with engagement_id; agent runs asynchronously.

Run vulnerability scanning (Nuclei + RouterSploit + nikto + dirb). De-duplicates against findings already in the engagement, filters false positives, scores by CVSS + E...

test_web_app

Run wireless security assessment (WiFi + Bluetooth). Returns immediately with engagement_id; agent runs asynchronously.

Validate a specific finding with a safe, non-destructive proof of concept. Confirms the vulnerability is real and exploitable without causing damage. Runs asynchronousl...

plan_tools

Resume an interrupted engagement from its last checkpoint. Returns immediately with status='running' and runs the resume in a background task — same async-task pattern ...