Pentest Agent Suite: a cross-IDE bug bounty framework that renders itself into seven tools
Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
At a glance
- What is it?
- The repository ships 50 agents, 26 commands and 19 CLI tools for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot and OpenClaw. The interesting part is not the payload count, it is the generated providers tree and the drift check that keeps it honest.
- Who is it for?
- Adopt it if you already hunt from a terminal and want one methodology tree that renders into whichever AI coding tool your team uses, and you are willing to keep the cloned repo on disk because installed bundles reference it by absolute path. Do not adopt it if you need a permissive licence in writing, if you expect CI to catch provider drift, or if you want a scanner that finds issues without a human deciding what to chase.
- Can I use it commercially?
- Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.
- Is it still maintained?
- Yes. The repository last received commits 96 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem is not payloads, it is that every AI coding tool wants a different file layout
A bug bounty workflow written for Claude Code does not move to Cursor by copying a folder. Claude Code reads subagents from .claude/agents/*.md and skills from .claude/skills/<name>/SKILL.md. Codex wants .codex/agents/*.toml plus an AGENTS.md capped at 32 KiB. Gemini wants .gemini/agents/*.md and TOML commands under .gemini/commands/. Copilot wants .github/agents/*.agent.md with a 30,000 character ceiling per agent and prompts under .github/prompts/. Cursor and OpenClaw have no native subagent concept at all, so an agent has to become a skill or a rule. Re-authoring a hunting methodology seven times is the actual cost this project attacks. The README describes the suite as a complete bug bounty framework with a 7-Question Gate validation step, autonomous hunt loops, A to B exploit chain building and a persistent brain with endpoint tracking. Whether those specific steps are the right methodology is a separate argument. The packaging claim is narrower and more checkable: one source tree under .claude/, rules/ and skills/, rendered outward.
How the render step works and why the providers directory is generated, not edited
The README states plainly that providers/ is generated and not edited by hand, and that you re-render after editing .claude/, rules/ or skills/ with python3 -m tools.installer render --targets all. A --check flag exits 1 if the committed output has drifted from the source. The translator does more than copy files. It drops the model: frontmatter field so each target falls back to its own default model. It rewrites Claude-specific prose, turning "Claude Code" into "the AI coding tool" and "the Agent tool" into "the subagent dispatch tool", and removes model: "inherit" entirely. It rewrites $CLAUDE_PROJECT_DIR to .. inside providers/ so bundles resolve relative to the cloned repo, or to absolute paths when installing into a user project. It maps effort: frontmatter onto model_reasoning_effort in Codex TOML. It truncates Copilot agents at 30,000 characters and chunks Windsurf rules at 12,000 characters for workspace scope and 6,000 for global. Orchestrator agents such as chain-builder, correlator and recon-ranker get an agents: list of siblings so Copilot can wire the dispatch graph. That last detail is the one that suggests the author actually ran these targets: a Copilot orchestrator without an explicit sibling list has no dispatch edge.
Two install paths, and the path rewriting that decides which one you want
The README gives a quick start built around scaffolding a workspace rather than installing anything globally. It exports HACKERONE_USERNAME and HACKERONE_TOKEN, runs uv run python3 tools/scaffold.py hackerone tesla, changes into ~/bounties/hackerone-tesla, starts claude, sets /model opus, then runs /sync hackerone tesla, /brain init, /status and /hunt tesla.com. The scaffold step is broader than Claude Code: it generates CLAUDE.md, AGENTS.md, .codex/, .agents/skills/, .gemini/, .cursor/, .windsurf/, .github/ and .vscode/mcp.json from copied workspace assets so paths resolve inside the bounty workspace. The second path is the installer, invoked as python3 -m tools.installer install --targets all --scope project or with --targets codex --scope global. Install mode rewrites paths to absolute references back into the cloned pentest-agents repo, which is what makes it work from an arbitrary project directory and also what makes the clone a runtime dependency rather than a one-time download. There is a pentest-agents list command to detect which targets are installed, a --dry-run flag that previews every file and JSON merge, and a verify command that checks the manifest against disk for drift. MCP servers are launched through uv run --with mcp, so there is no global pip install step.
The licence is unstated, and that is the first thing to resolve
The repository metadata supplied here lists the licence as unknown, and the README excerpt contains no licence section. For a security tool that ships 2,500 payload lines and agent instructions you intend to run against targets you have permission to test, an unstated licence is not a documentation gap you can shrug off. It determines whether you can vendor the agents into a private fork, whether an internal platform team can redistribute the rules, and whether a client engagement can ship the workspace. Do not read this as legal advice; read it as a reason to open the repository and look for a LICENSE file before anything else. The README does describe a deliberate policy choice that sits adjacent to this: there is no GitHub Actions CI, by project policy, and drift detection is enforced locally by a pytest case named test_committed_providers_match_render. That means the guarantee that providers/ matches the source depends on whoever runs the tests, not on a hosted gate.
Where the framework pushes back: targets with no subagent concept
Cursor, Windsurf and OpenClaw have no native subagent concept, so the README states that Claude-format agents render as skills or rules for those targets. That is a lossy translation and the project says so. An agent that in Claude Code would be dispatched as a separate context with its own model now becomes a skill document loaded into a single conversation. The methodology survives as text; the isolation does not. The same flattening shows up in the size caps. A Copilot agent truncated at 30,000 characters is not the same artifact as the untruncated source, and Windsurf rules chunked at 12,000 or 6,000 characters are fragments of a longer rule. The render pipeline handles this deterministically, which is better than silent truncation, but it means the non-Claude bundles are approximations of the source rather than equivalents. If your workflow depends on subagent isolation, the honest reading is that Claude Code is the first-class target and the other six are ports.
The clone is a runtime dependency, and the drift check is local only
Two constraints interact badly for teams. First, installed bundles reference the cloned repo by absolute path, so moving or deleting the clone breaks an install that otherwise looks complete on disk. Second, drift detection runs through pytest locally because there is no hosted CI. Put those together and the failure mode is quiet: someone edits a rule in the clone, forgets python3 -m tools.installer render --targets all, and every installed bundle keeps serving the old text until someone runs the check or pentest-agents verify. The pentest-agents verify command exists precisely for this, checking the manifest against disk, but nothing forces it to run. A team that installs into a shared project and then treats the clone as disposable has built a workflow on a directory nobody is watching. The 760 files and roughly 118k lines also mean a fork is a real maintenance object, not a weekend patch.
How this differs from a scanner or a standalone MCP server
A conventional scanner such as a DAST tool enumerates a target and emits findings from its own rule engine, with the tool owning both the request generation and the verdict. This project inverts that. The agents carry methodology and payloads, the MCP servers connect to bug bounty platforms and an optional writeup search, and the verdict comes from the model plus the 7-Question Gate the README names. The practical difference is where the false-positive cost lands. A scanner's noise is filtered by severity thresholds you configure once. Here, noise is filtered by a model deciding whether a lead is worth chasing, which is cheaper per lead and less predictable per engagement. The optional semantic writeup search is also bring-your-own-index, so the framework ships the query path without shipping a corpus. If you want a tool that produces a report from a URL with no human in the loop, this is the wrong shape. If you want a tool that keeps a persistent brain of endpoints and builds A to B exploit chains across a session, the scanner model has no equivalent.
Who should adopt it, and what to check before the first install
The fit is a solo hunter or a small team that already works from a terminal, already pays for Claude Code or one of the other six targets, and wants one hunting methodology tree rather than seven drifting copies. The cross-IDE installer plus the generated providers/ tree is the part that is hard to rebuild yourself, and the render --check flag plus the pytest drift case are the parts that make it maintainable. The misfit is anyone who needs a written permissive licence before touching the code, anyone who expects a hosted CI gate to catch a stale bundle, and anyone who wants findings without deciding which leads to pursue. Before the first install, do three things: confirm the licence, run python3 -m tools.installer render --check against your clone to see whether the committed providers match the source, and run pentest-agents install --dry-run to read the full file list and JSON merges, including the OpenClaw MCP entry that the README places at user level in ~/.openclaw/openclaw.json rather than inside the project.
Editorial conclusion
Adopt it if you already hunt from a terminal and want one methodology tree that renders into whichever AI coding tool your team uses, and you are willing to keep the cloned repo on disk because installed bundles reference it by absolute path. Do not adopt it if you need a permissive licence in writing, if you expect CI to catch provider drift, or if you want a scanner that finds issues without a human deciding what to chase. Before installing, confirm the licence file, run python3 -m tools.installer render --check against your clone, and check whether the OpenClaw MCP entry lands in ~/.openclaw/openclaw.json at user level rather than inside your project.
Community notes