## https://sploitus.com/exploit?id=CCADF4BE-7E8E-5D5B-8F8B-E5EDD3BA8F5A
# claude-pentest
A local pentesting toolkit built for Claude Code โ recon, scanning,
exploit-validation, and reporting, entirely on this machine, with Claude
Code itself as the reasoning agent instead of a separate LLM process.
Built by reverse-engineering [`usestrix/strix`](https://github.com/usestrix/strix)
(an open-source AI pentesting agent, Apache-2.0) and reimplementing its
capability on top of Claude Code's own tools. See `LICENSE-NOTICE.md` for
exactly what was copied verbatim vs. adapted, and `CLAUDE.md` for how Claude
Code should actually use this project.
> [!WARNING]
> Only test targets you own or have explicit written authorization to test.
## Why this exists, and how it's different from Strix
Strix is a full standalone product: it spins up its own LLM agent loop
(via LiteLLM, needing `STRIX_LLM` + `LLM_API_KEY`) that drives a Kali Docker
sandbox through a custom `agents`-SDK tool set (`exec_command`,
`agents_graph`, `create_vulnerability_report`, ...).
This project keeps the *capability* (sandbox + skills + reporting) but
drops the separate agent runtime โ **Claude Code is the agent**. No second
API key, no billing account beyond your existing Claude Code session.
## Quick start
1. **Start the sandbox** (builds on first run if the image doesn't exist yet):
```
sandbox\build.ps1 # or sandbox/build.sh
sandbox\run.ps1 -Target mytarget # or sandbox/run.sh mytarget
```
This starts `claude-pentest-sandbox-mytarget`, bind-mounting
`runs\mytarget\workspace\` to `/workspace` in the container.
2. **Open Claude Code in this folder.** `CLAUDE.md` and the 35 skills under
`.claude/skills/` should load automatically.
3. **Ask Claude to assess a target.** It will decompose scope, pick a scan
mode, run tools via `docker exec`/`docker run`, and file findings.
4. **Findings and reports land under** `runs\mytarget\`:
- `vulnerabilities\.md` โ one file per finding
- `vulnerabilities.json` / `.csv` โ machine-readable index
- `findings.sarif` โ SARIF 2.1.0, GitHub-code-scanning compatible
- `penetration_test_report.md` โ the final executive report
## Strix โ Claude Code tool mapping
| Strix concept | This project |
|---|---|
| `exec_command` (sandbox shell) | `docker exec claude-pentest-sandbox- ` |
| Per-tool CLI (nmap, ffuf, sqlmap...) installed in one Kali image | Core tools (nmap, ffuf, curl, python3...) in the slim sandbox image; heavier scanners (trivy, nuclei, semgrep, trufflehog, zaproxy, nikto, grype, syft) run as separate on-demand `docker run --rm ` containers โ see `sandbox/tool-images.md` |
| `strix/skills/*.md` (flat, loaded via `load_skill`) | `.claude/skills//SKILL.md` (Claude Code's actual project-skill format), loaded via the `Skill` tool |
| `agents_graph` (`create_agent`, `send_message_to_agent`, `wait_for_message`) | Claude Code's `Agent` tool (ad hoc subagents) and `Workflow` tool (structured multi-stage fan-out) |
| `create_vulnerability_report` (real CVSS scoring, validation, dedup-judge, SARIF) | `reporting/new_finding.py` + `reporting/vendor/{cvss_calc,validation,dedupe_prompt,sarif}.py` |
| `finish_scan` (four-section executive report) | `reporting/finish_report.py` + `reporting/templates/executive_report.md.j2` |
| Caido HTTP proxy (`list_requests`/`view_request`/`repeat_request`) | mitmproxy inside the sandbox + the `claude-pentest-proxy` MCP server (`mcp_server/proxy_server.py`) exposing the same three tools, reading `runs//workspace/.proxy/flows.jsonl` |
| `STRIX_LLM` / `LLM_API_KEY` | Not needed โ Claude Code is the agent |
## Folder structure
```
claude-pentest\
CLAUDE.md โ orchestration instructions Claude Code auto-loads
README.md โ this file
LICENSE-NOTICE.md โ Apache-2.0 attribution for vendored/adapted Strix content
requirements.txt โ cvss, jinja2 (for reporting/)
.venv\ โ Python venv for reporting/ scripts
.claude\skills\\SKILL.md โ 35 skills (28 verbatim, 7 adapted)
sandbox\
Dockerfile, docker-entrypoint.sh, build.ps1/.sh, run.ps1/.sh
tool-images.md โ docker run --rm invocation per on-demand scanner
reporting\
new_finding.py โ file a vulnerability finding
finish_report.py โ render the final executive report
vendor\ โ sarif.py, cvss_calc.py, validation.py, dedupe_prompt.py
templates\ โ vulnerability.md.j2, executive_report.md.j2
sample_finding.json, sample_sections.json โ worked examples used to verify Phase 3
mcp_server\
proxy_server.py โ MCP server: list_requests/view_request/repeat_request
over the sandbox's captured HTTP(S) traffic
.mcp.json โ registers claude-pentest-proxy (see "Enabling the proxy
MCP server" below โ needs a one-time approval)
runs\\ โ per-engagement output (workspace + findings + reports)
```
## Enabling the proxy MCP server (one-time step)
`.mcp.json` registers `claude-pentest-proxy`, but Claude Code requires
explicit approval the first time a project-scoped MCP server is seen โ
it won't load silently. Run `claude` interactively in this folder and
approve it via `claude mcp list` (or the prompt Claude Code shows on
startup) before expecting the `list_requests`/`view_request`/
`repeat_request` tools to actually be reachable through `ToolSearch`.
## What's not here yet
- A handful of Strix's tooling skills for tools not installed here: `naabu`,
`subfinder`, `httpx`, `katana`, `sqlmap`, `agent_browser` โ see
`.claude/skills/README.md` for why and how to add them back if needed.
- The proxy MCP server only sees traffic from *inside* the sandbox
container (via `docker exec`) โ it doesn't intercept a host browser
unless you separately point one at `127.0.0.1:8080` on a running
container (mitmdump's port isn't exposed to the host by default; add
`-p 127.0.0.1:8080:8080` to `run.ps1`/`run.sh` if you want that).
## Environment this was built/verified against
- Docker Desktop, 12 CPUs, 8 GB allocated to Docker, ~896 GB free disk.
- Python 3.13 (sandbox container) / 3.12 (host venv).
- Verified: core sandbox tools respond (`nmap`, `ffuf`, `python3`, `uv`,
curl/wget/git/jq/whois/dig/ripgrep); one on-demand scanner image pulls and
runs (`trufflehog`); a sample finding produces a correct CVSS score and all
four report artifacts; the executive report template renders correctly;
mitmproxy intercepts both HTTP and HTTPS from inside the sandbox (CA
trust confirmed working, not just present) and the proxy MCP server's
`list_requests`/`view_request`/`repeat_request` all verified against real
captured traffic, including a header-modified replay.