H-mmer/pentest-agents

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

815Stars on the repository
205Mods indexed here, across every type
2mo agoLast push, which is what freshness is scored on
noneNo LICENSE: all rights reserved, so bodies are not copied

analyze

01

H-mmer/pentest-agents

Command Gemini CLI

Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze.

not rated 815 2mo ago A 0 tokens

autopilot

02

H-mmer/pentest-agents

Command Gemini CLI

Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent…

not rated 815 2mo ago B 0 tokens

brain

03

H-mmer/pentest-agents

Command Gemini CLI

Manage the engagement brain. Subcommands: 'init' to set up, 'brief ' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.

not rated 815 2mo ago A 0 tokens

chain

04

H-mmer/pentest-agents

Command Gemini CLI

Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A).

not rated 815 2mo ago A 0 tokens

correlate

05

H-mmer/pentest-agents

Command Gemini CLI

Run the finding correlation engine to discover attack chains from individual findings.

not rated 815 2mo ago A 0 tokens

cost

06

H-mmer/pentest-agents

Command Gemini CLI

Show cost tracking and ROI for this engagement.

not rated 815 2mo ago A 0 tokens

dupcheck

07

H-mmer/pentest-agents

Command Gemini CLI

Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck e.g. /dupcheck XSS in search endpoint.

not rated 815 2mo ago A 0 tokens

fullscan

08

H-mmer/pentest-agents

Command Gemini CLI

Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.

not rated 815 2mo ago A 0 tokens

hunt

09

H-mmer/pentest-agents

Command Gemini CLI

Active vulnerability hunting on a target. Loads scope, reads brain, detects tech stack, runs targeted tests with concrete payloads. Usage: /hunt target.com [--vuln-class idor|xss|ssrf|sqli|ssti|oauth|rce|race|graphql|upload|business-logic|llm-ai].

not rated 815 2mo ago F 0 tokens

learn

10

H-mmer/pentest-agents

Command Gemini CLI

Record a platform response and update learning. Usage: /learn [--bounty 500] [--vuln-type XSS].

not rated 815 2mo ago A 0 tokens

mindmap

11

H-mmer/pentest-agents

Command Gemini CLI

Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap.

not rated 815 2mo ago A 0 tokens

monitor

12

H-mmer/pentest-agents

Command Gemini CLI

Monitor targets for changes. Usage: /monitor baseline (first run), /monitor check (detect changes), /monitor scope (check platform for scope updates).

not rated 815 2mo ago A 0 tokens

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: