Armur-Ai / Pentest-Swarm-AI

The open-source XBOW alternative — an autonomous API & web-app pentester. 
 Dozens of AI agents don't just scan — they exploit . They chain attacks (BOLA/IDOR, JWT forgery, mass assignment, SSRF, injection), build and score attack paths, and prove real vulnerabilities at machine speed. 
 Built for pentesters · bug bounty hunters · red teamers · security researchers 
 📖 Documentation ·
 Quick Start ·
 vs. XBOW ·
 Swarm vs. Multi-Agent ·
 How It Works ·
 Roadmap 
## Hack at machine speed.
> 📖 **New here? Start with the documentation** — quickstart, provider setup, CLI reference, and troubleshooting. (Or run `pentestswarm docs` to open it.)
**XBOW** proved a point: AI can top the bug-bounty leaderboards. But XBOW is a **closed, hosted SaaS** — one agent, on their cloud, on their model, at their price. We think the future of offense is **open, self-hosted, and a swarm** — so we built it.
### Pentest Swarm vs. XBOW
| | **Pentest Swarm AI** | XBOW |
|---|:---:|:---:|
| **Open source** | ✅ AGPL, fork it | ❌ closed |
| **Self-hosted** | ✅ your infra, your model, $0 floor | ❌ their cloud, their bill |
| **A real swarm** | ✅ dozens of agents, concurrent | ❌ single agent |
Three structural wins — and the swarm is the one that compounds. This isn't a single planner LLM walking recon → classify → exploit → report down a fixed line. **Dozens of agents work your surface at once**, coordinating through a shared stigmergic blackboard: the instant a finding lands it wakes whichever agent it's relevant to, so a 1,000-subdomain target gets hit in parallel — **attacking at machine speed.** And unlike a scanner that spits out unverified "maybes," the swarm *exploits what it finds, proves it* with captured evidence, then writes the report.
**Who it's for:** pentesters covering a whole scope overnight · **bug bounty hunters** racing to first-blood on a fresh target · **red teamers** who need breadth fast · **researchers** pushing autonomous offense.
Run it on **any model** — Claude, anything OpenAI-compatible (incl. **Together AI**'s hosted Llama/Qwen/DeepSeek), the new **security-tuned open models** (Pentest-R1 and the wave behind it), or **fully local Ollama / LM Studio**. We don't compete with those models — **we're the harness that gives them hands**: real tools, swarm coordination, scope safety, and evidence-backed reports. Air-gapped, zero API cost, and not one byte of your data leaving your box.
*For **authorized testing only** — see the disclaimer below.*
---
> ### Credits & Inspiration
> This project stands on the shoulders of giants. We credit and thank these projects for pioneering AI-powered offensive security:
>
> - **PentestGPT** — the OG that proved LLMs can pentest
> - **PentAGI** — fully autonomous agent architecture
> - **Strix** — AI hackers that find and fix vulns
> - **CAI** — cybersecurity AI framework, 3600x faster than humans
> - **HackingBuddyGPT** — LLM hacking in 50 lines of code
> - **Shannon** — white-box AI pentester
> - **BlacksmithAI** —