Practical overview
When it fits
Use Pentestkit when an authorized assessment needs coordinated agents, proof of exploitability and structured reporting in one workflow.
Who it is for
- Security practitioners conducting explicitly authorized penetration tests
- Bug-bounty and CTF workflows that need coordinated testing agents
- Developers building agent-based security assessment pipelines
Documented uses
- Plan and coordinate a penetration test across specialist agents
- Exploit and verify findings before recording them
- Maintain shared testing context across agents
- Assign CVSS v3.1 scores
- Generate client-ready reports
Requirements & limits
The project is provided as a public GitHub repository, is identified as active, and uses an MIT license. It is described as a CLI-oriented Python framework for Linux, macOS and Windows. No pricing or account requirements are documented.
- It is built on the Claude Agent SDK and identifies Kimi K3 as its model.
- Findings are documented as requiring exploitation-based proof before recording.
- The workflow includes CVSS v3.1 scoring and client-ready report generation.
- A scope-guarded chokepoint controls packets leaving the system, but the project says authorization remains required.
- The reported 104/104 XBOW result applies to 104 Dockerized CTF web challenges using exact-match flag capture.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Compare options for Agent orchestration
These projects document a common task and share a project role. This is a source-based comparison, not an execution benchmark or a guarantee of interchangeability.
| Project | Documented purpose | Platform | Access and requirements |
|---|---|---|---|
| Pentestkit | Plan and coordinate a penetration test across specialist agents | CLI, Linux, macOS, Windows | The project is provided as a public GitHub repository, is identified as active, and uses an MIT license. It is described as a CLI-oriented Python framework for Linux, macOS and Windows. No pricing or account requirements are documented. |
| Agenite | Define typed tools with JSON Schema validation and error handling. | CLI | |
| Veldra | Create an agent with a policy, tools, skills, knowledge base and reasoning method. | Self-hosted | The documented deployment is self-hosted and uses a sign-in gate after a first-run administrator account is created. |
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 30 September 2026
- Original website title
- lordx64/pentestkit · Official homepage title · retained in its source language

