Pentest Swarm AI is an autonomous, open-source API & web-app pentester built on a real swarm. Dozens of AI agents coordinate through a shared stigmergic blackboard to exploit, chain, and prove vulnerabilities at machine speed.
- 🐝 A real swarm, not a pipeline — dozens of agents work your surface concurrently, coordinating via pheromone-weighted findings; attack chains emerge instead of being scripted.
- 💥 Exploits, doesn't just scan — chains BOLA/IDOR, JWT forgery, mass assignment, SSRF, SQLi/NoSQLi, GraphQL abuse — then captures evidence and writes the report.
- 🧠 Any model, self-hosted — Claude, Together AI (GLM/Qwen/DeepSeek), Gemini, OpenAI-compatible, or fully local Ollama / LM Studio. We're the harness that gives models hands.
- ✅ Proof over maybes — non-LLM verification oracles (OOB / differential / timing) confirm findings against the live target; proven ones get a VERIFIED badge.
- 🛡️ Safe by construction — fail-closed scope, egress guard, an authorization gate, and a full audit trail.
- 🎯 Drop-in use cases — bug bounty, external ASM, CI/CD, internal network, CTF, GraphQL, OWASP Top 10 — each a one-command playbook.
Hack at machine speed.
📖 New here? Start with the documentation — quickstart, provider setup, CLI reference, and troubleshooting. (Or run pentestswarm docs to open it.)
XBOW proved a point: AI can top the bug-bounty leaderboards. But XBOW is a closed, hosted SaaS — one agent, on their cloud, on their model, at their price. We think the future of offense is open, self-hosted, and a swarm — so we built it.
Pentest Swarm vs. XBOW
| Pentest Swarm AI | XBOW |
|---|
| Open source | ✅ AGPL, fork it | ❌ closed |
| Self-hosted | ✅ your infra, your model, $0 floor | ❌ their cloud, their bill |
| A real swarm | ✅ dozens of agents, concurrent | ❌ single agent |
Three structural wins — and the swarm is the one that compounds. This isn't a single planner LLM walking recon → classify → exploit → report down a fixed line. Dozens of agents work your surface at once, coordinating through a shared stigmergic blackboard: the instant a finding lands it wakes whichever agent it's relevant to, so a 1,000-subdomain target gets hit in parallel — attacking at machine speed. And unlike a scanner that spits out unverified "maybes," the swarm exploits what it finds, proves it with captured evidence, then writes the report.
Who it's for: pentesters covering a whole scope overnight · bug bounty hunters racing to first-blood on a fresh target · red teamers who need breadth fast · researchers pushing autonomous offense.
Run it on any model — Claude, anything OpenAI-compatible (incl. Together AI's hosted Llama/Qwen/DeepSeek), the new security-tuned open models (Pentest-R1 and the wave behind it), or fully local Ollama / LM Studio. We don't compete with those models — we're the harness that gives them hands: real tools, swarm coordination, scope safety, and evidence-backed reports. Air-gapped, zero API cost, and not one byte of your data leaving your box.
For authorized testing only — see the full legal disclaimer and Responsible Use Policy.
The model is the engine. The harness is the car.
Frontier models are getting absurdly powerful, and they'll keep getting better. But raw capability is an engine on a test stand: it revs, it roars, and it moves nothing. A 1,000-horsepower engine with no transmission, no chassis, no tires, and no traction doesn't win races — it doesn't even leave the garage. To put that power on the road, you need the rest of the car.
Pentest Swarm is that car. The model is the engine you drop in; everything around it is what turns horsepower into a finished pentest:
| The car | Pentest Swarm | Why the power needs it |
|---|
| Engine | the frontier model you choose — Claude, GLM / Qwen / DeepSeek, local Ollama | raw reasoning, and fully interchangeable |
| Drivetrain (the hands) | real tool execution — recon, exploitation, PoC generation | a model can describe an attack; the harness runs it against a live target |
| Transmission | the stigmergic swarm | spreads the power across dozens of agents instead of one planner redlining a single thread |
| Tires & traction | non-LLM verification oracles (OOB / differential / timing) | proof the power actually hit the road — a VERIFIED finding, not a confident guess |
| Chassis | the shared pgvector blackboard + memory | holds every finding together so attack chains emerge and nothing is lost between agents |
| Brakes & seatbelts | fail-closed scope, egress guard, authorization gate, full audit trail | power you can't stop is a liability, not a feature |
| The finish line | captured evidence + the graded report | the whole point — a proven result, not a chat transcript |
And here's the part that compounds: a better engine makes a better car — but only if the car can use it. Every time the frontier moves, Pentest Swarm gets better for free, because the harness is model-agnostic: swap the engine, keep the car. We don't compete with the labs building the engines — we're the layer that lets anyone put that power on the road, on their own infra, for authorized offense.
No matter how good the model gets, something still has to give it hands, aim it at a target safely, coordinate it at scale, and prove what it found. That's the harness. That's the hard part. That's us.
What makes this a swarm?
Most "multi-agent" pentesting tools are a single planner LLM dispatching to specialist agents in a fixed order — recon → classify → exploit → report. That's a pipeline, not a swarm.
Pentest Swarm AI is built around three swarm-intelligence primitives:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
