pentestagent and CyberStrikeAI

Both are AI agent frameworks for security testing, making them direct competitors in the black-box security testing and red-teaming space.

pentestagent
73
Verified
CyberStrikeAI
71
Verified
Maintenance 23/25
Adoption 10/25
Maturity 15/25
Community 25/25
Maintenance 25/25
Adoption 10/25
Maturity 13/25
Community 23/25
Stars: 1,740
Forks: 367
Downloads:
Commits (30d): 21
Language: Python
License: MIT
Stars: 2,785
Forks: 453
Downloads:
Commits (30d): 182
Language: Go
License: Apache-2.0
No Package No Dependents
No Package No Dependents

About pentestagent

GH05TCREW/pentestagent

PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

Built on LiteLLM for multi-model LLM support, PentestAgent features a hierarchical agent architecture where instances can spawn isolated child agents via stdio transport (`spawn_mcp_agent`), enabling parallel task delegation without external orchestration. It integrates MCP (Model Context Protocol) servers with automatic RAG-based tool optimization for large tool sets, includes prebuilt attack playbooks for structured assessments, and offers Docker isolation with both minimal and Kali Linux images containing pentesting tools like metasploit and sqlmap.

About CyberStrikeAI

Ed1s0nZ/CyberStrikeAI

CyberStrikeAI is an AI-native security testing platform built in Go. It integrates 100+ security tools, an intelligent orchestration engine, role-based testing with predefined security roles, a skills system with specialized testing skills, and comprehensive lifecycle management capabilities.

Based on the README, here's a technical summary that goes deeper: --- Uses native MCP (Model Context Protocol) with HTTP/stdio/SSE transports and external federation to connect AI agents directly to security tools, enabling conversational control flow through an orchestration engine that supports multi-agent delegation patterns (Eino DeepAgent). Includes vector-search knowledge base, attack-chain graph replay with risk scoring, WebShell management for post-exploitation, and optional Burp Suite integration via plugin architecture; persists all audit trails and task queues in SQLite with password-protected web UI. --- **Word count: ~65 | Key technical details**: MCP protocol variants, multi-agent orchestration, vector search, attack graphs, WebShell C2 capabilities, plugin extensibility, SQLite backend

Scores updated daily from GitHub, PyPI, and npm data. How scores work