pentest

claude-pentest

A full penetration testing framework for Claude Code — 15 agents, 6 skill coordinators, 63 attack categories.
Structured, human-in-the-loop, evidence-driven.

---

For authorized security testing only. Always obtain written permission before testing any system you do not own.

---

What this is

claude-pentest is a Claude Code plugin that gives Claude structured penetration testing capabilities. It is not a script or scanner — it is an agent coordination framework: a top-level orchestrator deploys specialized executor agents, each following a strict 4-phase workflow, requiring operator approval before any active exploitation begins. Every finding ships with a working PoC, captured HTTP evidence, and a Playwright screenshot.

Key principles:

• Human-in-the-loop at every escalation point — Claude cannot proceed to exploitation without your confirmation
• Evidence-first — no theoretical findings, only verified PoCs with poc.py and poc_output.txt
• Structured outputs — every engagement writes machine-readable JSON + markdown analysis to outputs/{engagement}/
• Breadth — 11 attack domains, 63 sub-categories, 25+ security tools referenced

---

Install

First Add Marketplace

# Add marketplace from inside claude code
/plugin marketplace add Stickman230/claude-pentest

Then Install plugin

# Install plugin from inside claude caude
/plugin install claude-pentest@claude-pentest

The plugin installs into your project's .claude/ directory. Once installed, the Pentester Orchestrator agent is available in any Claude Code session.

---

Quick Start

Open Claude Code in your project directory and type:

Start a pentest engagement on https://example.com

The Pentester Orchestrator will:

1. Ask you to confirm scope (target, in-scope, out-of-scope, Rules of Engagement)
2. Run web application mapping to build an inventory
3. Present a test plan for your approval
4. Deploy executor agents in parallel
5. Aggregate findings and present a summary
6. Write the final report to outputs/example-com/pentest-report.json

---

Slash Commands

Two slash commands are included for guided session management. They are auto-discovered by Claude Code and invoked by name.

/pentest:pentest

Purpose: Replaces the plain-text "Start a pentest…" workflow with a structured on-ramp that collects scope before handing off to the orchestrator.

Invoke: Type /pentest:pentest in Claude Code.

Flow:

1. Displays ASCII art banner
2. Asks whether to isolate the session to the pentest plugin (recommended)
3. Collects 5 scope fields one at a time: target URL/IP, engagement name, out-of-scope restrictions, testing window, and authentication credentials
4. Outputs an engagement summary for review
5. Automatically deploys Pentester Orchestrator at Phase 1 (Recon) — Phase 0 scope confirmation is skipped because scope was already collected

Isolation note: If "Yes" is selected in step 2, Claude constrains itself to pentest plugin agents and skills for the duration of the session. This constraint is lifted when /pentest:exit-pentest runs or /clear resets the context.

/pentest:exit-pentest

Purpose: Structured session close — reads findings, flushes unsaved notes, outputs a severity-bucketed summary, and lifts the isolation constraint.

Invoke: Type /pentest:exit-pentest at the end of an engagement.