Zen-Ai-Pentest - 🛡⚔️AI-Powered Penetration Testing Framework with a

项目说明

<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="
<img src=" width="100%" alt="Zen-AI-Pentest">
</picture>
</p>

<p align="center">
<b>Professional AI-Powered Penetration Testing Framework</b><br>
<i>Autonomous security assessment powered by state-of-the-art language models</i>
</p>

<p align="center">
<img src=" alt="Tests">
<img src=" alt="Security">
<a href=" src=" alt="OpenSSF"></a>
<img src=" alt="Python">
<img src=" alt="License">
<a href=" src=" alt="Demo"></a>
</p>

<p align="center">
<a href="#-features">Features</a> •
<a href="#-quick-start">Quick Start</a> •
<a href="#-architecture">Architecture</a> •
<a href="#-ci-cd-pipelines">Pipelines</a> •
<a href="#-security">Security</a> •
<a href="#-documentation">Docs</a>
</p>

---

🔥 O

Zen-AI-Pentest is an autonomous, AI-dri testing framework that combines cutting-edge large language models with 72+ professional security tools. Built for security professionals, bug bounty hunters, and enterprise red teams.

---

✨ Features

<table>
<tr>
<td width="33%">

🤖 Autonomous AI

</td>
<td width="33%">

🎯 Risk Engine

</td>
<td width="33%">

🔒 Exploit

</td>
</tr>
<tr>
<td>

🧠 AI Persona System

</td>
<td>

🗺️ Attack Path Analysis

</td>
<td>

📊 Benchmarking

</td>
</tr>
</table>

🔧 72+ Integrated Security Tools

| Category | Tools |
|----------|-------|
| Network Scanning | nmap · masscan · scapy · tshark · tcpdump · netdiscover · arp-scan |
| Web Security | BurpSuite · SQLMap · Gobuster · OWASP ZAP · FFuF · Nikto · WAFW00F · WhatWeb · Nuclei |
| Exploitation | Metasploit Framework · SearchSploit |
| Brute Force | Hydra · Hashcat · John · Ncrack |
| Reconnaissance | Amass · Nuclei · TheHar · Subfinder · HTTPX · Sherlock · Scout |
| Acti | BloodHound · NetExec · Responder · ldapsearch · enum4linux |
| OSINT | Sherlock · Ignorant · TheHar · Scout |
| Code Analysis | Semgrep · TruffleHog · Gitleaks · Bandit |
| Container | Trivy · Docker · Kubectl |
| Wireless | Aircrack-ng · airmon-ng · airodump-ng · aireplay-ng |
| System | Netcat · Socat · OpenSSL · Proxychains · Tor |

🧩 MCP Ser

8 MCP servers for AI-tool integration, registered in opencode.jsonc:

| Server | Purpose | Tools |
|--------|---------|-------|
| omni-ai | AI chat (free models) | chat, stream, , web_extract, list_models |
| qterminal | Shell/Docker orchestration | spawn, exec, kill, network, images, agents |
| zen-agents | 11-agent orchestration | agent_run, workflow_create, full_audit, agent_list |
| metasploit | Metasploit RPC connector | module_search, module_execute, session_list |
| | Connection-loss failover | check, rotate, status, set_proxy, history |
| obscura | Encrypted secret vault | store, get, list, delete, init, export |
| ip-tracker | IP tracking | check_, resolve_ip, my_public_ip |

📚 Skills System (95 Skills)

| Type | Count | Description |
|------|-------|-------------|
| Framework | 5 | zen-framework, agents-usage, tools, risk-engine, workflow |
| Platform | 9 | de, ci-cd, rag-, browser-automation, multi-language, security-review, bash, ai-delegation, solidity |
| Tools | 39 | nmap, masscan, nuclei, sqlmap, metasploit, ffuf, gobuster, bloodhound, hydra, zap, nikto, amass, subfinder, sherlock, tri, burpsuite, etc. |
| Modules | 42 | exploit modules (xss, sqli, ssrf, lfi, deserialization), osint modules (dns, email, whois, cert), scanners, reporting |

🤖 WhatsApp Bot

🛡️

Automatic connection-loss detection and :

---

🚀 Quick Start

<table>
<tr>
<td width="50%">

🐳 Docker (Full Stack)

| Service | Port |
|---------|------|
| Web Terminal | :8080 |
| OmniRoute AI | :20128 |
| Hermes Agent | — |
| WhatsApp Bot | :23001 |

</td>
<td width="50%">

📦 Local Install

</td>
</tr>
<tr>
<td>

🤖 AI Agents (CLI)

</td>
<td>

📱 WhatsApp Bot

</td>
</tr>
</table>

---

💻 Usage

Python API

REST API

WebSocket (Real-Time)

---

🏗️ Architecture

System Architecture

---

🤖 AI Orchestration Architecture

---

🔄 CI/CD Pipelines

All pipeline diagrams use Mermaid — rendered automatically by GitHub.

1. 🧪 Tests Pipeline

2. 📊 Codeco Pipeline

3. 🔒 Security Scan Pipeline

4. ✅ CodeQL Analysis

5. 🚀 Deploy Pipeline

6. 📦 Release Pipeline

7. ⚙️ CI Pipeline (Legacy)

---

🧪 Test Suite

| Metric | Value | Status |
|--------|-------|--------|
| Test Files | 1,145+ | ✅ |
| Total Tests | 43,000+ | ✅ |
| Co | ~10% | ⚠️ Improving |
| Target | 80%+ | 🎯 Goal |

---

🛡️ Security

Built-in Protections

Risk Levels

| Level | Description | Tools |
|-------|-------------|-------|
| SAFE (0) | Recon only | whois, dns, subdomain |
| NORMAL (1) | Standard scanning | + nmap, nuclei |
| ELEVATED (2) | Light exploitation | + sqlmap, exploit |
| AGGRESSIVE (3) | Full exploitation | + pivot, lateral |

---

🔧 Configuration

Option 1: Obsidian Vault (Recommended)

Option 2: En

---

📁 Project Structure

---

📚 Documentation

| Document | Description |
|----------|-------------|
| Architecture | Complete system design |
| API Reference | REST + WebSocket endpoints |
| Installation | Docker · Local · Production |
| Docker Guide | Deployment & configuration |
| Security Audit | Security assessment |
| Agent Guide | AI de partner guide |
| Benchmarks | Performance results |
| Roadmap 2026 | Future plans |

---

🌐 Community

| Platform | Link |
|----------|------|
| 🎮 Discord | discord.gg/zJZUJwK9AC |
| 🐙 GitHub | github.com/SHAdd0WTAka/Zen-Ai-Pentest |
| 🌍 Website | zen-ai-pentest.pages.dev |
| 📊 Dashboard | li |

<p align="center">
<a href="docs/qr_codes/index.html">
<img src="docs/qr_codes/qr_grid_preview.png" alt="QR Code Gallery" width="400">
</a>
<br>
_{📱 Scan QR codes for instant mobile access}
</p>

---

🤝 Contributing

1. Fork the repository
2. Create feature branch (git checkout -b feature/amazing-feature)
3. Commit changes (git commit -m 'Add amazing feature')
4. Push to branch (git push origin feature/amazing-feature)
5. Open a Pull Request

See CONTRIBUTING.md and CODE_OF_CONDUCT.md.

---

👥 Authors

<table>
<tr>
<td align="center">
<a href="
<img src=" width="80" alt=""/>
<br><b></b>
</a>
<br>Founder · Lead De
</td>
<td align="center">
<img src=" width="120" alt=""/>
<br><b>Kimi AI</b>
<br>AI De Partner
</td>
</tr>
</table>

---

📄 License

MIT License — see LICENSE.

---

<p align="center">
<b>⚠️ IMPORTANT</b>: For authorized security testing only. Always obtain proper permission before testing any system you do not own.
</p>

项目信息

开发语言：Python

Star 数：469

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🛡⚔️AI-Powered Penetration Testing Framework with automated vulnerability scanning, multi-agent system, and compliance reporting🛡⚔️展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。