pensarai/apex
AI-powered penetration testing CLI that uses autonomous agents to perform pentesting, combining traditional pentest tooling with modern LLMs for targeted, explainable results.
What's novel
AI-powered penetration testing CLI that uses autonomous agents to perform pentesting, combining traditional pentest tooling with modern LLMs for targeted, explainable results.
Code Analysis
7 files read · 3 roundsAn AI-powered penetration testing CLI that orchestrates autonomous LLM agents (with browser automation, shell execution, and multi-provider inference) to perform blackbox/whitebox security assessments, document findings with CVSS 4.0 scoring, and generate proof-of-concept exploits.
Strengths
Exceptionally deep implementation with a full CVSS 4.0 calculator, sophisticated multi-agent orchestration (orchestrator/worker pattern), comprehensive tool ecosystem (browser, shell, auth, workspace), and production-grade error handling including rate-limit retry, stream idle timeout, and fail-closed tool repair. The codebase demonstrates genuine security engineering expertise with scope guards, destructive action guards, and materiality checklists for findings.
Weaknesses
The codebase is extremely large (600+ source files) with some very large files (offensiveSecurityAgent.ts at 53KB, pentest/agent.ts at 94KB, ai.ts at 63KB) that could benefit from further decomposition. The workspace tool gating uses complex regex-based NLP that, while clever, is fragile and hard to maintain compared to a proper intent classification approach.
Score Breakdown
Signal breakdown
Innovation
Craft
Traction
Scope
Evidence
Commits
413
Contributors
9
Files
1014
Active weeks
23
Repository
Language
TypeScript
Stars
49
Forks
12
License
Apache-2.0