repository·main·Indexed 9 days ago
https://github.com/vxcontrol/pentagiAn autonomous penetration testing platform using AI agents to conduct security assessments. It features a sandboxed environment, a Go library for API interaction, a React-based chat frontend with GraphQL, and a flexible searcher interface supporting engines like Google, DuckDuckGo, and Tavily.
bubbletea, lipgloss, and bubbles to provide a responsive design optimized for terminal environments.The Charm stack is a collection of Go libraries used to build sophisticated Terminal User Interfaces (TUIs). The core packages include:
bubbletea: An event-driven TUI framework based on the Model-View-Update (MVU) pattern.lipgloss: A styling and layout engine for terminal interfaces (similar to CSS).bubbles: A collection of pre-built interactive components like viewports, text inputs, lists, and tables.huh: An advanced form builder for complex user input flows.glamour: A markdown renderer for terminal output.The Charm ecosystem provides a suite of Go libraries for building sophisticated Terminal User Interfaces (TUIs). The core packages are:
bubbletea: An event-driven TUI framework based on the Model-View-Update (MVU) pattern.lipgloss: A styling and layout engine for terminal interfaces.bubbles: A collection of pre-built interactive components like viewports, text inputs, lists, and tables.huh: An advanced form builder for complex user input.glamour: A markdown renderer for the terminal.PentAGI (Penetration testing Artificial General Intelligence) is an automated security testing platform designed for information security professionals and researchers. It uses AI-powered agents to autonomously determine and execute penetration testing steps within a secure, sandboxed Docker environment.
Key Capabilities:
nmap, metasploit, sqlmap).scraper) and integration with multiple search APIs (e.g., Tavily, Firecrawl, Perplexity, DuckDuckGo).pgvector) for persistent storage and support for horizontal scaling.PentAGI Frontend is a React-based chat application designed for intelligent conversations with AI agents. Key capabilities include:
The controller package is the central orchestration layer of the PentAGI backend. It manages the lifecycle and business logic for all core entities, including flows, assistants, tasks, subtasks, and logs. It acts as a high-level service layer that mediates between the database, providers (LLMs), tools, and the event subscription system.
It supports two primary operational modes:
The PentAGI Observability Stack provides a unified monitoring, logging, tracing, and metrics collection system. It is built on OpenTelemetry and integrates several specialized tools:
logrus with context propagation.The stack uses a layered interface approach to abstract underlying technologies, allowing the application to interact with a single Observability interface.
The Docker client package (backend/pkg/docker) provides a secure, isolated, and sandboxed containerized environment for PentAGI's AI agents. It acts as a specialized wrapper around the official Docker SDK to support AI agent workflows, specifically for executing penetration testing operations, managing terminal access, and running security tools in isolation.
Key Capabilities:
PentAGI is licensed under the MIT License.
Note on Cloud Services: While the VXControl Cloud SDK code is MIT licensed, accessing VXControl Cloud Services (including threat intelligence, AI support, and premium features) requires a separate License Key and compliance with the VXControl Terms of Service. The SDK code is free to use, but service access requires registration.
PentAGI uses a specific set of fonts for its web UI and PDF report generation. These fonts are served from the same origin as the application to ensure privacy and reliability, meaning they are never loaded from external servers.
ChainAST is an abstract syntax tree (AST) used to represent and manage Large Language Model (LLM) conversation chains. It organizes messages into a hierarchy to facilitate validation, modification, and size tracking, particularly for complex flows involving tool calls and responses.
ChainSections.Header and multiple BodyPairs.SystemMessage and/or HumanMessage.RequestResponse: An AIMessage containing tool calls followed by one or more ToolMessages.Completion: A simple AIMessage without tool calls.Summarization: A special type containing a tool call to the summarization tool (execute_task_and_return_summary).ChainAST
├── Sections[] (ChainSection)
├── Header
│ ├── SystemMessage (optional)
│ ├── HumanMessage (optional)
│ └── sizeBytes
├── sizeBytes
└── Body[] (BodyPair)
├── Type (RequestResponse, Completion, or Summarization)
├── AIMessage
├── ToolMessages[]
└── sizeBytesWhen interpreting analytics, note which subtask statuses are included in the calculations:
running (duration is created_at to now), finished, and failed.created (not yet started) and waiting (paused for user input).This means if a generator creates 10 subtasks but only 1 has started, your metrics will reflect 1 subtask, not 10.