## https://sploitus.com/exploit?id=E30450AA-5503-53F8-9C56-8244F3A45677
# Pentest Automation Toolkit
A fully open-source pentest automation pipeline for running **authorized
engagements** (signed pentest agreements assumed in place). n8n-orchestrated,
AI-assisted, covering recon → scan → exploit → report.
Single-operator, loopback-only — built for a sole pentester to automate
their own workflow against client-defined scope, not as a multi-tenant
platform.
**Forked from** the original `agent automation` personal portfolio project,
which targeted only fixed lab containers. This fork generalizes that
foundation into a real engagement tool while keeping the original as a
standalone portfolio piece.
**Start here**: [`CLAUDE.md`](CLAUDE.md) — full project context, scope
boundary, agent architecture, and current status. If you're a Claude Code
session picking this up cold, read that file first.
## What this is
- An n8n workflow (self-hosted, Docker) orchestrating open-source pentest
tooling (Nmap, Nuclei, OWASP ZAP, Metasploit Framework via msfrpcd RPC,
sqlmap, and friends — see [`docs/tool-stack.md`](docs/tool-stack.md)).
- A local-LLM AI layer (Ollama) for triage, exploit confirmation, and
report drafting — no cloud API calls with client data.
- Targets are defined per-engagement via `engagements/.json` configs
— scope, testing window, and technique permissions are machine-enforced
before any tool runs.
- The `lab/docker-compose.yml` intentionally-vulnerable containers are kept
as a standing dev/regression suite (`engagements/lab-dev.json`).
## What this is NOT
- A multi-tenant platform or SaaS — n8n is bound to `127.0.0.1:5678` only.
- Authorized to touch anything not explicitly scoped in an active
`engagements/.json` config — see
[`docs/rules-of-engagement.md`](docs/rules-of-engagement.md).
- A vehicle for real client findings or target data in version control —
engagement configs are `.gitignored`; only `example.schema.json` and
`lab-dev.json` are committed.
## Status
Fresh fork — the inherited pipeline (01–04 + 00 orchestrator) is fully
built and verified against the lab. Pivot phases (see
`docs/real-tool-pivot-plan.md`) are in progress to generalize from
lab-only to engagement-config-scoped operation.