Penteos

CH.01 the chaos

Developers have IDEs. Pentesters have 40 terminal tabs.

CH.01 the answer

Now pentesters have one.

penteos - Acme Corp / External web pentest

The Penteos workspace: project overview, coverage and the Maestro asking for approval

LAW I the client stays private

The AI works with your client's data. It never reads it.

Every response from the target passes through Penteos before the model sees it. Names, emails, IDs, cards and tokens become stable pseudonyms: the same person is always the same marker, in every tool and every turn. The agent can still use any value: Penteos puts the real one back only on the way to the target.

01 the client's app answers

HTTP/1.1 200 OK
{
  "order": 1042,
  "customer": "Ana Pérez",
  "email": "ana.perez@acme-corp.test",
  "dni": "30.123.456",
  "card": "4111 1111 1111 1111",
  "session": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIi…",
}

02 what the AI reads

HTTP/1.1 200 OK
{
  "order": 1042,
  "customer": "Ana Pérez",
  "email": "ana.perez@acme-corp.test",
  "dni": "30.123.456",
  "card": "4111 1111 1111 1111",
  "session": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIi…",
}

03 its next request, on the wire

# the AI writes
GET /orders?email=«email:7 @acme-corp.test»
Cookie: sid=«secret:4»

# Penteos sends
GET /orders?email=ana.perez@acme-corp.test
Cookie: sid=eyJhbGciOiJIUzI1NiJ9…

The real value goes back in only on the way to the target, and in the report your client receives.

masked at the source

identity

Names, emails, phones, addresses, dates of birth

national IDs

AR, BR, CL, MX, ES and US, checked by their check digits

financial

Cards, IBAN, CBU

secrets

Session tokens, JWTs, API keys, passwords

health

Medical record numbers and clinical notes, also in free text

0/ 240

measured, not promised

Synthetic people, 240 canary values in 17 kinds of data, served the way real targets serve them: JSON APIs, database rows, logs, HTML, CSV exports, error messages and clinical notes. With masking off, all 240 reach the model. With it on, none do. Run it yourself:

pnpm privacy:measure

Not covered yet: a value with no format and no context, in free prose, the first time it appears (a name in a sentence nobody labelled). A strict mode that masks everything not known to be technical is next.

Not a proxy guessing from the outside: Penteos owns the tool layer, so it knows what each value is (a JSON field, a cookie, a header) and the AI's own tool calls can't leak it back out. Your NDA survives the AI.

LAW II scope is law

Out of scope is impossible.

The scope is enforced by the core, not by asking a model nicely. You, the agent, a plugin or an external client, every action goes through the same gate: hosts, ports and time windows. Above the risk ceiling you set, it stops and asks.

allowedapp.acme-corp.testmatches *.acme-corp.test

allowed203.0.113.12:443inside 203.0.113.0/28

blockedpay.acme-corp.testexcluded, nothing was sent

asks yousqlmap --risk 2above your risk ceiling

LAW III no proof, no finding

Nothing reaches the report without proof. Or without you.

The agent, the Maestro, runs real tools and reads their real output. Every finding points to the exact lines that prove it, a separate verifier tries to reproduce it from scratch, and you approve what your client sees.

Raw output, never lost

nmap, httpx, nuclei, sqlmap. The original output is kept and every claim cites it, line by line.

A second agent tries to break it

The verifier never saw how the finding was reached. If it can't reproduce it, it isn't confirmed.

Autopilot, with an inbox

Let it work without pinging you. Every decision it needs from you waits in one place.

The Penteos guardian crouched over a terminal: in-scope target allowed, out-of-scope target blocked, a finding with evidence waiting for approval

A critical finding with CVSS, evidence and measured impact — **finding** · reproduced, impact measured, evidence attached

The same finding as it appears in the client report — **report** · the same finding, as your client reads it

YOUR AI bring the one you pay for

Any model, turned pentester. On a leash.

Pick the model that works best for offensive work, or the one you already pay for. Whatever runs the agent, its only way to touch a target is through Penteos: masked, in scope, logged. Same rules for every model.

your plan

ChatGPT

api

DeepSeek

Low cost per run and few refusals on offensive tasks. Bring an API key.

local

Local models

Ollama, LM Studio, vLLM. Nothing leaves the machine at all.

any

Any API

Any OpenAI-compatible endpoint. Claude works too, through the API or Claude Code.

also on the workbenchintercepting proxyin-scope browserverified tool catalogCVE intel by versionout-of-band callbacksretests & diffsreports in DOCX · PDF · HTML · MDpluginsMCP server

GET IT download

Linux first. No Docker. No root.

AppImageRECOMMENDEDany distro, one file↓ x86_64 ↓ arm64

.debDebian, Ubuntu, Kali, Mint, Pop!_OS↓ x86_64 ↓ arm64

.rpmFedora, RHEL, Rocky, openSUSE↓ x86_64 ↓ arm64

.tar.gzArch and everything else↓ x86_64 ↓ arm64

# one line: the right package, checked
$ curl -fsSL https://github.com/penteos/penteos/releases/latest/download/install.sh | sh

# or the AppImage by hand
$ chmod +x penteos-x86_64.AppImage
$ ./penteos-x86_64.AppImage

# every file ships with a checksum
$ sha256sum -c SHA256SUMS
penteos-x86_64.AppImage: OK

FIN open source

Read every line that touches your client.

Penteos is free software under the GNU AGPL-3.0. The masking, the scope gate, the agent's rules: all of it is code you can audit.

★ Star on GitHub Follow the launch on X

license: AGPL-3.0
author: Santiago Habib