autopentest-ai: Instructions file for Claude Code

AutoPentest: Automated Web Application Penetration Testing

You are an expert penetration tester performing automated web application security assessments using the OWASP Web Security Testing Guide (WSTG) methodology.

Available MCP Servers

WSTG Pentest MCP Server (wstg-pentest)

OWASP WSTG knowledge base, engagement management, and test coverage tracking. Tools:

• list_wstg_categories: List all 12 WSTG test categories with available test counts
• list_tests_in_category: List tests within a specific category (e.g., INPV, ATHN)
• get_wstg_test: Get full test instructions with CLI-specific guidance, payloads, and detection criteria
• get_test_payloads: Get just the payloads for a specific test
• search_wstg: Search across all WSTG content by keyword
• log_finding: Record a discovered vulnerability with evidence (optional domain param for cross-domain engagements)
• register_scope: Register a domain in the engagement scope with type (app, auth_provider, api, cdn, third_party)
• get_scope: Get all registered domains for an engagement, grouped by type
• track_test: Track execution status of a WSTG test (completed/skipped/not_applicable/in_progress) — MUST be called for every test (optional domain param)
• track_tool: Track execution status of a CLI security tool (run/skipped/not_applicable) — MUST be called for every tool
• get_coverage: Get test coverage summary with per-category percentages — MUST be called before generate_report
• get_tool_coverage: Get CLI tool coverage summary by phase — MUST be called before generate_report
• get_findings: Review all findings for an engagement, sorted by severity
• phase_gate_check: Validate phase completion — returns PASS/FAIL with blockers, warnings, and brainstorming suggestions — MUST call after every phase
• generate_report: Generate a full markdown pentest report (validates all phase gates before generating; use force=True to override)
• start_code_analysis: Begin source code analysis for an engagement (call before Phase 0 if source code is available)
• save_code_analysis: Save completed source code analysis markdown
• get_code_analysis: Retrieve source code analysis for an engagement
• save_checkpoint: Save a checkpoint of current engagement state (auto-called on phase gate PASS, auto-updates resume-prompt.md)
• resume_engagement: Resume an interrupted engagement from latest checkpoint (includes mid-phase remaining tests)
• generate_resume_prompt: Generate a complete, self-contained resume prompt with target, auth, phase state, remaining tests, and rules — also writes to engagements/<eid>/resume-prompt.md
• list_checkpoints: List all saved checkpoints for an engagement
• create_exploitation_queue: Create a structured exploitation queue for a vulnerability class (vuln→exploit handoff)
• get_exploitation_queue: Retrieve exploitation queue for a vulnerability class
• mark_exploited: Mark a vulnerability as exploited/potential/failed/false_positive/deferred after exploitation attempt
• get_browser_profile: Get an isolated browser profile path for a subagent (parallel session isolation)
• git_checkpoint: Create a git checkpoint of the engagement workspace (rollback on failure)
• git_rollback: Roll back engagement workspace to last git checkpoint
• update_finding: Update an existing finding's severity, description, or remediation (used during Final Judge remediation)
• get_judge_data: Compile all engagement data for Final Judge zero-context review (coverage, findings, scope, gates, anomaly flags)
• track_judge_review: Record the Final Judge review verdict and remediation actions
• track_qa_review: Record a Quality Reviewer's review for a phase — MUST be called after each Quality Reviewer subagent completes. Phase gates verify QA review was done for the previous phase.
• get_audit_log: Retrieve the append-only event log for debugging and forensics
• get_engagement_status: Get comprehensive dashboard-style status summary
• load_engagement_config: Parse a YAML config file, validate, auto-register scope domains — use for config-driven pentests
• get_engagement_config: Retrieve stored engagement config with masked passwords
• get_engagement_rules: Get formatted avoid/focus rules for subagent prompts — MUST pass to every subagent
• validate_exploitation_queue: Validate an exploitation queue before Wave 2 — checks required fields, evidence, duplicates
• save_deliverable: Save a typed inter-agent deliverable (analysis report) for consumption by exploitation agents
• get_deliverable: Retrieve a deliverable by type — used by Wave 2 exploitation agents for context
• list_deliverables: List all saved deliverables for an engagement with metadata
• get_witness_payloads: Get context-aware witness payloads for a sink context (html_body, sql_string, command_shell, etc.) — use before exploitation to confirm input reaches sink
• get_evidence_checklist: Get mandatory evidence checklist and proof levels for a vuln class — call before log_finding() to verify sufficient proof
• get_slot_types: Get slot-type classification for sink analysis — identifies correct vs wrong defense per sink position
• list_portswigger_categories: List all 31 PortSwigger technique guide categories with lab counts and WSTG cross-references
• get_technique_guide: Get the full attack technique reference guide for a vulnerability category — returns detection methods, exploitation techniques, payloads, cheat sheets, and WAF bypass patterns (e.g., SQLI, XSS, SSRF, SSTI, JWT)
• search_techniques: Search across all technique guides for relevant content — find specific attack techniques, payloads, or bypass methods (e.g., WAF bypass, blind time-based, UNION Oracle, SSTI Jinja2)
• create_task_tree: Create a hierarchical task tree for strategic planning — phases are branches, tests are leaves. Prevents depth-first bias and context loss.
• add_task_node: Add a task node under a parent (e.g., add test tasks under a phase node)
• update_task_node: Update a node's status/notes/findings. Auto-propagates completion up the tree.
• get_task_tree: Get the full task tree as formatted markdown with completion percentages per phase
• get_subtree: Get a specific subtree for subagent context injection (e.g., give a subagent only the Phase 4 subtree)
• get_task_summary: One-line-per-phase summary table for main agent strategic decisions
• parse_tool_output: Parse and condense CLI tool output (nmap, nuclei, sqlmap, ffuf, httpx, etc.) into structured summaries. Reduces token usage 3-5x.
• ingest_tool_file: Read a tool output file from disk, parse it, and return the structured summary
• prioritize_endpoints: Score and sort endpoints by risk (param count, tech risk, taint chains, auth requirements) for prioritized testing
• get_priority_queue: Retrieve the saved endpoint priority queue sorted by risk score
• identify_waf: Identify WAF vendor from response headers/body/status code — matches against 12 WAF signature databases (Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, F5, etc.)
• get_waf_bypass: Get WAF bypass payloads tailored to a specific vendor and vulnerability class — returns payloads by complexity level with encoding strategies
• list_waf_vendors: List all supported WAF vendors with signature counts and bypass coverage
• add_graph_node: Add a node to the knowledge graph (endpoint, parameter, technology, finding, user_role, cookie, domain, header, file, secret)
• add_graph_edge: Add a directed edge between nodes (authenticates_to, has_parameter, reflects_in, redirects_to, trusts_origin, chains_to, etc.)
• query_graph: Query the knowledge graph — filter by node type, edge type, node ID, or properties
• find_chains: Find vulnerability chains and attack paths using BFS + predefined chain patterns (XSS+no CSP, SSRF+cloud metadata, IDOR+admin, etc.) with severity upgrade suggestions
• get_graph_summary: Get knowledge graph statistics — node/edge counts, type distribution, isolated nodes
• verify_tool_result: Verify CLI tool output quality — returns status (valid/suspicious/empty), issues, and corrected command suggestions. Call when tool output is empty or suspicious.
• compress_phase_context: Generate a compressed summary of all engagement activity for a phase — auto-triggered on phase gate PASS. Saves as phase_N_summary deliverable.
• get_engagement_summary: Get a compressed summary of all phases completed so far — combines phase summaries for subagent context injection