The first open-source pentesting tool built on a real swarm — not just multiple agents in a row.

Quick Start · Swarm vs. Multi-Agent · How It Works · Compare · Roadmap

Attackers automate. Most pentests don't.

Security teams are stuck between scanners that flag thousands of unverified "maybes" and consultants who actually exploit — but cost five figures and show up once a year. Neither keeps pace with an attack surface that changes every day.

Pentest Swarm AI is the only open-source pentester built on a real swarm. Not a single planner LLM calling recon → classify → exploit → report down a fixed line — dozens of agents work your surface concurrently, coordinating through a shared stigmergic blackboard. The moment a finding lands it wakes whichever agent it's relevant to, so a 1,000-subdomain target gets worked in parallel, at machine speed. And unlike a scanner, the swarm exploits what it finds and proves it with captured evidence — then writes the report.

Run it on any model — Claude, anything OpenAI-compatible, the new security-tuned open models (Pentest-R1 and the wave behind it), or fully local Ollama / LM Studio. We don't compete with those models — we're the harness that gives them hands: real tools, swarm coordination, scope safety, and evidence-backed reports. Air-gapped, zero API cost, and not one byte of your data leaving your box.

For authorized testing only — see the disclaimer below.

Credits & Inspiration

This project stands on the shoulders of giants. We credit and thank these projects for pioneering AI-powered offensive security:

• PentestGPT — the OG that proved LLMs can pentest
• PentAGI — fully autonomous agent architecture
• Strix — AI hackers that find and fix vulns
• CAI — cybersecurity AI framework, 3600x faster than humans
• HackingBuddyGPT — LLM hacking in 50 lines of code
• Shannon — white-box AI pentester
• BlacksmithAI — multi-agent pentest framework
• PentestAgent — black-box AI security testing

Their open-source contributions made tools like this possible.

Legal Disclaimer: Pentest Swarm AI is designed exclusively for authorized security testing, bug bounty programs, CTF competitions, and educational research. You must obtain explicit written permission from the target system owner before running any scan. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and equivalent laws worldwide. The authors and contributors of this project accept no liability for misuse, damage, or any illegal activity conducted with this tool. By using this software, you agree that you are solely responsible for ensuring your use complies with all applicable laws and regulations. Do not use this tool against systems you do not own or have explicit authorization to test.

What makes this a swarm?

Most "multi-agent" pentesting tools are a single planner LLM dispatching to specialist agents in a fixed order — recon → classify → exploit → report. That's a pipeline, not a swarm.

Pentest Swarm AI is built around three swarm-intelligence primitives:

• Stigmergy — agents coordinate by reading and writing findings on a shared blackboard, not by a central planner telling them what to do. A finding's pheromone weight biases other agents toward it and decays over time, so stale paths die naturally.
• Emergence — attack chains appear that no single agent planned. A recon finding wakes the classifier; a high-severity classification wakes the exploit agent; exploit results feed back into the board and wake the report agent. Order isn't prescribed — it emerges from the blackboard state.
• Decentralization — each agent runs its own trigger predicate. Add a new agent with its own predicate and it joins the swarm without anyone rewriting the orchestrator.

We built this because the category was empty. Every tool marketed as "swarm" was actually a pipeline. If you find a counter-example, open an issue — we'll add them to the comparison table.

See IMPLEMENTATION_PLAN.md for the technical deep-dive on stigmergy, pheromone decay, the Postgres-backed blackboard, and why we didn't build on Google ADK / CrewAI / AutoGen.

Quick Start

Start free — no API key, no cloud, no bill.

# install (pick one)
brew install Armur-Ai/tap/pentestswarm                                    # macOS
go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@latest    # Go
docker run --rm ghcr.io/armur-ai/pentestswarm:latest --help                # Docker

Watch it find a real vuln in 2 minutes — no target, no key, all local. --lab spins up a bundled, intentionally-vulnerable app (OWASP Juice Shop) on your machine, points the swarm at it, and tears it down after. Legal, safe, zero setup:

pentestswarm scan --lab --provider ollama --swarm --follow

Ready for a real target? Same command, your model:

# local model — 100% on your box, zero API key
pentestswarm scan <authorized-target> --scope <target> --provider ollama --swarm --follow

# or a cloud model for max quality
export PENTESTSWARM_ORCHESTRATOR_API_KEY=sk-ant-your-key-here
pentestswarm scan <target> --scope <target> --swarm --follow

One command. Your model, your infra, your rules. New here? pentestswarm demo plays the whole campaign offline — that's the GIF above.

Running inside a GitHub Actions workflow? There's an action for that — see deploy/github-action/example-workflow.yml.

How the swarm works

Key behaviours:

1. Agents are independent. Any one of them can be removed, replaced, or added without rewiring the others.
2. Pheromones decay per-finding-type. A PORT_OPEN stays hot for hours; a SESSION for minutes. Config-driven half-lives.
3. Scope is enforced at the tool layer and again at the executor. Defence in depth — --scope is not bypassable.
4. Cleanup is always registered before execution. SIGINT, crashes, and budget exhaustion all trigger reverse-order cleanup. See internal/pipeline/cleanup_memory.go and cleanup.go.
5. Prompt caching on Claude cuts cost and latency on repeated system prompts (enabled by default for recon + classifier).

Comparison

How we position vs. the rest of the ecosystem. We'll ship real benchmark numbers in a future release (see Phase 3.3).

If any entry here is wrong or out of date, please open a PR — we want this table to stay honest.

Feature status

Honesty labels: stable means shipped + tested, beta means works but rough edges, alpha means experimental, planned means in the roadmap.

CLI

pentestswarm scan <target> --scope <scope>              # Launch the swarm
pentestswarm scan <target> --scope <scope> --swarm      # Use the stigmergic scheduler
pentestswarm scan <target> --scope <scope> --strict     # Fail on LLM errors
pentestswarm campaign watch <id>                        # Live TUI — watch agents work
pentestswarm campaign explore <id>                      # Browse attack surface interactively
pentestswarm playbook run <name> --target <t>           # Run a community playbook
pentestswarm doctor                                     # 8-point system health check
pentestswarm mcp serve                                  # MCP server for Claude/Cursor
pentestswarm serve                                      # Start API server + dashboard

LLM Providers

All agents inherit from a single provider config. Set one key, the entire swarm works.

Bring your own model — we're the harness, not the model. A new wave of open models is being fine-tuned specifically for offensive security (Pentest-R1 and others). Pentest Swarm turns any of them — or a frontier model, or a fully-local one — into an operating pentester: real tools, swarm coordination, scope enforcement, and evidence-backed reports. The model does the reasoning; the swarm does the work.

Tech Stack

Development

git clone https://github.com/Armur-Ai/Pentest-Swarm-AI.git
cd Pentest-Swarm-AI
./scripts/setup.sh    # Install tools, start Postgres/Redis/Ollama
make build            # Compile binary
make test             # Run tests
make dev              # Hot-reload development

Regenerate the demo GIF after any CLI change:

brew install vhs      # one-off
vhs docs/demo-flashy.tape

Roadmap

See IMPLEMENTATION_PLAN.md for the full phased plan. Short version:

• Wave 1 (in flight): real swarm architecture (done), dashboard wire-up, Burp MCP
• Wave 2: sqlmap / Metasploit / ZAP adapters, bug-bounty + ASM + CI/CD playbook polish, official GitHub Action in Marketplace
• Wave 3: fine-tuned Pentest-Swarm model (Pentest-R1 recipe), Cybench / AutoPenBench / CVE-Bench numbers, agent-memory poisoning hardening (MINJA / MemoryGraft defences)

Why "Swarm"?

Single agents are tools. Pipelines dressed up as agents are slightly fancier tools. A swarm is different: agents share an environment, each agent's writes influence other agents' behaviour, and the useful work is emergent rather than prescribed. That's what lets a swarm handle a 1,000-subdomain target without anyone writing a plan for it.

One agent is a tool. A swarm is a platform.

Community

Join the swarm on Discord → 🐝

We're building the first real open-source pentest swarm in the open — come build it with us. In Discord you can share findings, request a tool adapter, argue about stigmergy and pheromone decay, get help running your first scan, or grab a good first issue and ship a PR. Researchers, red-teamers, and the AI-security-curious all welcome.

⭐ If a real open-source swarm is something you want to exist, drop a star. Star velocity is the fuel that keeps this shipping — it's the single biggest thing you can do in ten seconds.

Who's using Pentest Swarm?

Running Pentest Swarm — internally, on client engagements, in CI, or embedded in your own workflow? Add your org to ADOPTERS.md with a quick PR — it helps others trust the project and helps us prioritize what to build. Not ready to be listed publicly? A hello in Discord still helps.

Enterprise & Commercial Support

Pentest Swarm AI is free and open source (AGPL-3.0), and always will be. If your team wants a hand getting it into production, Armur AI — the team behind the project — offers commercial services:

• Managed deployment on your infrastructure — cloud, on-prem, or fully air-gapped (no data leaves your environment)
• Integration & customization — wire it into your SIEM, ticketing, and CI, or build custom tools and playbooks for your stack
• Priority support & SLAs — a direct line to the maintainers
• Training & onboarding — get your security team productive fast

Especially useful for startups and enterprises that want the control of self-hosting without doing the plumbing themselves.

📧 akhil@armur.ai — tell us your setup and what you're trying to do.

License

GNU Affero General Public License v3.0 (AGPL-3.0) — see LICENSE.

What this means for you

The AGPL exists specifically to prevent the SaaS-fork loophole: anyone who improves Pentest Swarm and offers it commercially must share their improvements with the community. We made it open source; we want it to stay open source even as it scales.

If you have a use case the table doesn't cover, open an issue and ask.

Built by Armur AI.