PentAGI coordinates agents, tools, memory, and reports
PentAGI gives an AI system a security target, a set of specialist roles, and containers stocked with more than 20 named testing tools. It stores commands and results in PostgreSQL, uses vector memory to recover earlier findings, and can produce reports through a web interface. The assistant can also inspect and steer running flows. This is aimed at authorized assessments where research, tool execution, and evidence would otherwise sit in separate terminals and notes.
The repository is correspondingly large. Our checkout at commit ea66530 held 1,440 files, about 400,161 lines of source, and occupied 101.4 MB before dependencies. The backend is Go, while the interface uses React and TypeScript. REST and GraphQL APIs support external automation. Optional pieces include search providers, Langfuse analytics, Grafana monitoring, and a Graphiti knowledge graph backed by Neo4j. Each addition creates another credential and service boundary.
The minimum host has 2 vCPUs, 4 GB RAM, and 20 GB free
The recommended installer checks the host, creates an environment file, configures providers, generates credentials and certificates, then starts the Compose deployment. Linux, Windows, and macOS builds are listed. Docker and Docker Compose, or the documented Podman path, remain prerequisites. The installer needs access to the Docker API, and the README explains that joining the docker group grants root-equivalent power on the machine.
Model access is part of setup, not an optional finishing touch. PentAGI documents more than 10 provider families, including OpenAI, Anthropic, Gemini, Bedrock, Ollama, DeepSeek, Qwen, Kimi, and custom endpoints. An embedding service is also needed for memory. Search engines are configurable, while provider credentials, endpoints, Graphiti, and similar integrations remain in environment variables or mounted files even though model profiles can be managed in the UI.
What happened when we ran it
Our sandbox installed 670 packages in 65 seconds and built the Go backend in 140 seconds. The test command ran for 86 seconds and returned exit code 1: 113 tests passed and 4 failed out of 117. That is a useful warning because both dependency resolution and compilation completed before the suite found failures. The repository had 4 CI workflow files, no root Dockerfile, and no tests directory in our scan.
The supplied log tail does not name the 4 failing cases. It shows successful results for packages including server services, templates, terminal tools, and searchers, followed by the final FAIL. We will not infer a database, container, network, or code cause from that output. The defensible result is narrower: commit ea66530 did not pass its complete Go test command in our fresh 3-CPU, 8 GB Debian container.
A separate worker keeps agent Docker access off the main host
PentAGI's production guidance recommends 2 nodes: one for management and one for worker execution. The preferred worker arrangement points sandbox containers at a hardened Docker-in-Docker daemon over TLS. That matters because agents execute commands chosen from model output and may process hostile target content. Separating the worker reduces the damage if a prompt injection convinces an agent to misuse its tools.
The README explicitly warns against mounting the host Docker socket into the sandbox. Socket access lets a process start a privileged container, mount the host filesystem, and compromise every container on that daemon. Open issue 337 described this escape path in June 2026. Current documentation gives a safer TLS configuration and reserves direct socket mounting for trusted single-node development, which is a meaningful response but still leaves deployment choices with the operator.
Worker image selection can follow an unverified model answer
Open issue 392 reports that DOCKER_DEFAULT_IMAGE_FOR_PENTEST is passed into an image-chooser prompt instead of enforced as a fixed default. In the reporter's 2 reproduced flows, a local Qwen model selected node:latest for a security task even though the configured pentest image was vxcontrol/kali-linux. The flow continued without an error or warning, leaving the agent without the intended tools.
That failure mode is more serious than a bad chat answer because it changes the execution environment. Teams using smaller local models should verify the actual image for every new task class and restrict which images the worker may pull. Model choice also affects completion. Issue 344 describes a Qwen 3.5 27B assessment that repeated commands for more than 5 hours and remained below halfway before the user stopped it. Neither report proves all local models fail, but both justify hard limits and supervision.
Release 2.1.0 added files, knowledge, and tool-call records
Version 2.1.0, published in May 2026, added per-user resources, flow files, semantic knowledge search, and live records for agent tool calls. Upload limits include 300 MB per file and 2 GB total. The release also hardened paths against traversal and symlink escapes. Those controls help, although issue 338 reports that multi-file ZIP downloads can buffer an entire archive in memory and exhaust the API process under concurrent requests.
GitHub listed 22,115 stars and 50 combined issues and pull requests, with the last push on August 6, 2026. Issue activity continued on August 27, so development is current even though v2.1.0 is older than the latest commits. PentAGI is best treated as a security platform under evaluation, with its own threat model and operating budget. Its interface is inviting, but the Docker, model, and target permissions deserve the same scrutiny as any other offensive tool.