PentestGBT - AI Security Agent
AI agent which can replace Security team Problem: People vibecode, don't care about Security until they got HACKED!
Core trick
Crawls same-origin pages with GET requests and heuristic checks, adds an async port scan, and has an LLM write the summary and PDF report.
Description
AI agent which can replace Security team
Problem: People vibecode, don't care about Security until they got HACKED!
README excerpt
## AI Pentest Agent (FastAPI) Minimal, non‑invasive OWASP Top 10 heuristic scanner with GPT summary and PDF export. ### What it does - Crawls target site (same‑origin) and runs heuristic checks for OWASP Top 10 areas - Optional async TCP port scan of the target host - Generates an AI executive summary and prioritized remediation (requires OpenAI key) - Exports a PDF report (with severity chart and, if enabled, open ports section) ### IMPORTANT and Legal - Non‑invasive by design (GET requests + static analysis + safe probes). No destructive payloads. - Only scan assets you own or are explicitly authorized to test. - Results are heuristic; use as a quick triage, not a substitute for a formal pentest. ### Requirements - Python 3.10+ - Optional: `OPENAI_API_KEY` env var for AI summaries ### Setup ```bash python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt # Optional for AI summaries export OPENAI_API_KEY=sk-... # do NOT commit this # Optional: choose model (defaults to gpt-5, fallback gpt-4o-mini) export OPENAI_MODEL=gpt-5 ``` ### Run ```bash uvicorn app.main:app --reload --port 8000 ``` Browse: `http://localhost:8000` ### Using the App - Enter the target URL - Optionally provide an OpenAI API key (masked, sent only for this request) - Optionally enable Port Scan (uses a curated common set if ports are blank) - Submit and wait for the report; you can preview and download the PDF ### Output - PDF report is saved under `reports/` (ignor