What is GreyDGL/PentestGPT?

PentestGPT splits into two tools: an autonomous pipeline that drives Claude Code or Codex through fixed stages, and a modernized human-in-the-loop mode that talks to many providers through their own SDKs. The split is the most interesting thing about it.

Can I use GreyDGL/PentestGPT commercially?

Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.

Is GreyDGL/PentestGPT still maintained?

Yes. The repository last received commits 63 days ago.

What programming language is GreyDGL/PentestGPT written in?

Mainly Python, according to GitHub's language statistics.

PentestGPT review: agentic pipeline vs pentestgpt-legacy

At a glance

What is it?: PentestGPT splits into two tools: an autonomous pipeline that drives Claude Code or Codex through fixed stages, and a modernized human-in-the-loop mode that talks to many providers through their own SDKs. The split is the most interesting thing about it.
Who is it for?: Adopt PentestGPT if you already run Claude Code or Codex locally and want a staged wrapper around them, or if you want the legacy three-session mode with a provider you control. Skip it if you need a stable Python API rather than a CLI, or if you cannot install a coding-agent CLI.
Can I use it commercially?: Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
Is it still maintained?: Yes. The repository last received commits 63 days ago.
What is it written in?: Mainly Python, according to GitHub's language statistics.

Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.

DEEP OPEN-SOURCE ANALYSIS

Hysen Labs Editorial · September 10, 2026 · GreyDGL/PentestGPT

Two tools wearing one repository name

PentestGPT is not one program. The README describes an autonomous, staged pipeline that drives Claude Code or Codex, and separately a preserved interactive mode called pentestgpt-legacy, which the project describes as the classic human-in-the-loop PentestGPT from the USENIX Security 2024 paper, modernized. The two do not share a backend story. The autonomous CTF pipeline is backend-pluggable for Claude Code and Codex only. The legacy mode talks natively to OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local Ollama through their official SDKs. That asymmetry is the first thing to understand, because it determines which of the two commands you can actually run with the API key you already have. If you hold a Gemini key and nothing else, the autonomous pipeline is closed to you and pentestgpt-legacy is the entry point. The intended audience is a security practitioner who is comfortable at a shell, already has a coding-agent CLI authenticated, and wants the orchestration layer rather than a library to import.

The staged pipeline and what each stage hands forward

The v1.0 notes list a multi-stage pipeline as the headline change. The stages differ by mode. In CTF mode the sequence is recon, then exploit, then walkthrough. In pentest mode it is asset discovery, then vulnerability identification, then report. The README states that each stage's findings feed into the next, which is the whole mechanism: the pipeline is not a single prompt with a long context window, it is a chain where the output of one phase becomes the input of the following one. The demo material shows a live walkthrough tracking steps as the agent works, described in the feature list as real-time feedback with live activity updates. For the legacy mode the architecture is different and more specific. Three cooperating LLM sessions run at once, labelled reasoning, generation, and parsing, and together they maintain a Pentesting Task Tree while the operator drives the session with the commands next, more, todo, and discuss. That is a genuine design choice worth naming: the task tree is the state, and the three sessions exist to keep it coherent. The autonomous pipeline replaces that with fixed stages and a session file. Whether a fixed stage list is better than a maintained task tree depends on how much the target deviates from the expected shape.

Installing it and the commands that matter

Prerequisites are Python 3.12 or newer, the uv package manager, and the Claude Code CLI plus the Codex CLI installed and authenticated for local runs. The README notes that the Docker flow bundles both CLIs, which matters if you would rather not install them on the host. Installation is three lines: clone the repository, change into the directory, and run make install, which the README says runs uv sync. The Makefile targets are install, test, check, and build, where check runs lint plus typecheck. Running against a target defaults to CTF mode: pentestgpt --target 10.10.11.234. You can attach context with --instruction, for example a WordPress site with a focus on plugin vulnerabilities, and switch pipelines with --mode pentest. Saved sessions are listed with pentestgpt --list-sessions. The Docker path is where the operational detail lives. make docker-build builds the image, make docker-login performs a one-time idempotent login that checks what is missing and logs in only that, and make docker-auth-status reports whether both CLIs are authenticated, with ROUNDTRIP=1 adding a live one-token check. Running is make docker-run with TARGET, BACKEND, MODEL, and MODE variables, for example BACKEND=codex MODEL=gpt-5.5 MODE=ctf or BACKEND=claude MODEL=opus MODE=pentest. The README is explicit that Claude's token is stored in a volume while Codex is not seeded, because ChatGPT refresh tokens are single-use, and that the OAuth callback is forwarded via socat. Logins survive container recreation; make docker-down keeps them and make docker-nuke removes the login volumes to force a fresh login or rotate a token.

The Codex login is the fragile part

That single-use refresh token is the sharpest limitation visible in the material. Claude's setup-token is written into a volume and stays valid, so re-running make docker-login skips it. Codex cannot be handled the same way, so the project runs its own in-container codex login and forwards the OAuth callback through socat. The consequence is that the Codex side of the Docker flow depends on an interactive browser callback reaching a container, and the README's own framing (not seeded, single-use tokens) tells you the maintainers know this is the awkward half. If your environment blocks that callback, the Claude backend is the path of least resistance. There is a second boundary worth stating plainly: the autonomous pipeline is backend-pluggable for Claude Code and Codex only. Anyone expecting to point it at a self-hosted model is directed to pentestgpt-legacy instead, which is a different program with a different interaction model. The material does not describe any sandboxing of the agent's actions, and it does not describe what happens when a stage produces nothing useful. Both are open questions a reader should treat as open.

How pentestgpt-legacy differs from the pipeline in practice

The legacy mode is not a deprecated path kept for sentiment. It is the only mode that reaches the provider list, and it is the only mode where a human stays in the loop by design rather than by interruption. You run pentestgpt-legacy with no arguments to auto-pick the best available models for each session, or you assign them explicitly, for example --reasoning-model claude-opus-4-8 --parsing-model gemini-3.5-flash. A local model goes through Ollama's OpenAI-compatible endpoint with --reasoning-model ollama:qwen3 --base-url http://localhost:11434/v1. Configuration is environment variables or a .env file following .env.example, with keys named OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY (or GOOGLE_API_KEY), DEEPSEEK_API_KEY, GROK_API_KEY, QWEN_API_KEY, and KIMI_API_KEY. The README states that only the providers you configure are enabled, so a missing key disables that provider rather than failing at request time. Two inspection commands exist: --list-models prints every supported model and shows which providers are configured, and a separate invocation is described as a live round-trip against every configured model that prints a pass or fail matrix. The README text for that second command is truncated mid-line, so the exact flag is not confirmed here. The practical difference from the autonomous pipeline is that you supply the judgement between steps. The task tree is only as good as the operator reading it.

Licence and the cost of following the project

PentestGPT is MIT licensed, which permits commercial use, modification, and redistribution provided the copyright notice and permission notice are retained. That is the permissive end of the spectrum and imposes no copyleft obligation on your own code. It says nothing about the terms of the model providers you route through it, and those terms are where the real constraints sit: Claude Code and Codex each carry their own acceptable use policies, and the legacy providers are governed by their own SDK terms. This is not legal advice, and a team deploying against client infrastructure should read the provider terms rather than the MIT text. On maintenance, the release history is uneven. v0.13.0 and v0.14.0 landed a day apart in May 2024, then v1.0.0 arrived on 2025-12-24, roughly nineteen months later, and the repository shows a push in 2026. A jump from 0.14 to 1.0 that far after the previous tag means the upgrade is a rewrite of the operating model, not a patch. Anyone on 0.14 should expect the autonomous pipeline to be new code rather than a configuration change, and should expect the legacy command to be the continuity path. The README also points to docs/docker-dev-plan.md for the Docker design, which is the file to read before changing the login volumes.

Who should pick this up, and what to check first

The honest split is by existing setup. If you already have Claude Code or Codex authenticated on a workstation and you want a staged wrapper that carries findings from reconnaissance into exploitation and produces a report, PentestGPT v1.0 is aimed at exactly you, and the Docker flow with persistent login volumes removes most of the setup friction. If you want to run against a provider you control, or against a local model through Ollama, the autonomous pipeline will not take you there; pentestgpt-legacy will, at the cost of driving the session yourself with next, more, todo, and discuss. If you need a Python library to embed in a larger tool, neither mode appears to offer that, since both are CLI entry points. The wrong tool for a fixed-scope, repeatable scan is the autonomous pipeline, because its stages are fixed and its behaviour depends on a coding agent's reasoning rather than a deterministic rule set. Before adopting, verify two things that the supplied material leaves open. First, confirm the v1.0.0 tag is what you cloned, since the README describes v1.0 behaviour while the repository also carries the 0.14 lineage. Second, run make docker-auth-status with ROUNDTRIP=1 and then recreate the container, because the Codex login is the component the README itself flags as not seeded and single-use, and a login that does not survive recreation changes the cost of every subsequent run.

Editorial conclusion

Adopt PentestGPT if you already run Claude Code or Codex locally and want a staged wrapper around them, or if you want the legacy three-session mode with a provider you control. Skip it if you need a stable Python API rather than a CLI, or if you cannot install a coding-agent CLI. Before committing, run make docker-auth-status with ROUNDTRIP=1 to confirm the login volumes actually survive a container recreation, and check whether v1.0.0 is tagged on the branch you cloned.

Official sources

Community notes