# AI use cases for Autonomous Pentest Agent (kutukam/autonomous-pentest-agent) Repo: [kutukam/autonomous-pentest-agent](https://github.com/kutukam/autonomous-pentest-agent) | Use cases: 3 | Page: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/ Autonomous Pentest Agent is an open source Go and Next.js system where LLM agents run penetration tests autonomously, with a web UI for tasks, assets, findings, and approvals. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Install the pentest agent locally and reach the web UI: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/install-and-first-login-locally/ - Import asset data from ScopeSentry into the asset graph: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/sync-scope-assets-from-scopesentry/ - Retest a fixed vulnerability and record whether it still reproduces: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/retest-fixed-findings-after-patching/ ## How to install the pentest agent locally and reach the web UI with Autonomous Pentest Agent Repo: [kutukam/autonomous-pentest-agent](https://github.com/kutukam/autonomous-pentest-agent) | Difficulty: Intermediate | Time: 60 minutes | Basis: From the README Clone the repo, run the install script, and open the admin setup page on localhost. **Who it is for:** A security engineer setting up the tool on a workstation or lab server for the first time. **The problem:** The system has several parts (Go backend, Next.js UI, PostgreSQL, LLM config), and the setup choices are easy to get wrong by hand. **The outcome:** A running instance at http://localhost:8787 with an admin password set through /setup. ### Steps 1. Run `git clone https://github.com/kutukam/autonomous-pentest-agent.git` and then `cd autonomous-pentest-agent`. 2. Run `./install.sh`, then choose ① 全部 Docker for the container path or ② 本地编译运行 for a local binary. 3. Enter a Postgres password when asked, or press Enter to generate one. 4. Open http://localhost:8787 and go to /setup to set the admin password. 5. Open the LLM 配置 page or export ANTHROPIC_API_KEY or OPENAI_API_KEY before starting a task. ### Prompt to paste into your agent ```text Using the repo kutukam/autonomous-pentest-agent, clone it, run ./install.sh, and choose the all-Docker option. Report the URL that responds on port 8787 and confirm the /setup page loads. Verify that the process is listening with a plain HTTP request before you report success. ``` ### Caveat The README says the Docker deploy source no longer works and asks you to build locally with AI, so the Docker Compose image pull may fail. Risk, remote script: The install script detects and installs Docker and writes config files, so read it before running it on a machine you care about. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/install-and-first-login-locally/ ## How to import asset data from ScopeSentry into the asset graph with Autonomous Pentest Agent Repo: [kutukam/autonomous-pentest-agent](https://github.com/kutukam/autonomous-pentest-agent) | Difficulty: Intermediate | Time: 90 minutes | Basis: From the README Connect ScopeSentry with its address and API key, then import domains, IPs, and ports by project or task. **Who it is for:** A pentest lead who already collects assets with ScopeSentry and wants the agent to start from that inventory. **The problem:** Re-collecting the same domains, subdomains, and ports by hand wastes time and can miss what the scanner already found. **The outcome:** Assets in the Autonomous Pentest Agent asset graph, grouped by company scope, ready for the agent to explore. ### Steps 1. Make sure a running ScopeSentry instance is reachable and you have its API key. 2. Open the 资产同步 page in the agent UI. 3. Enter the ScopeSentry address and API key to connect the data source. 4. Choose a project or task, then select the asset types to sync such as 域名, 子域, IP, 端口, 站点, or 端点. 5. Click import and check the 资产 page for the new assets. ### Prompt to paste into your agent ```text Using the repo kutukam/autonomous-pentest-agent, connect it to a ScopeSentry instance at with the API key . Import the assets from project and report the count of assets in the asset graph. Verify by listing the imported assets in the 资产 page before you start any exploration. ``` ### Caveat This use case needs a separate ScopeSentry deployment, which the README links to but does not set up for you. Risk, credentials: The ScopeSentry API key is stored in the agent so it can sync, so use a key with the least access you need. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/sync-scope-assets-from-scopesentry/ ## How to retest a fixed vulnerability and record whether it still reproduces with Autonomous Pentest Agent Repo: [kutukam/autonomous-pentest-agent](https://github.com/kutukam/autonomous-pentest-agent) | Difficulty: Intermediate | Time: 90 minutes | Basis: From the README Start a retest on one finding and get a result of still reproducible, fixed, or cannot confirm. **Who it is for:** A security reviewer checking whether a developer fixed a finding from an earlier task. **The problem:** Confirming a fix usually means rerunning the whole scan, which is slow and can change the original task. **The outcome:** A retest session with a verdict, evidence, and a link to the session, saved in the finding details. ### Steps 1. Open the task detail page and select the 复测 tab. 2. Find the finding in the list and click 复测, or open the finding and click 发起复测 in the 漏洞复测 area. 3. Enter the fixed version and any test conditions or limits, then start the retest. 4. Wait for the 复测中 status to finish and open the session link to read the evidence. 5. Check the verdict: 仍可复现, 已修复, or 无法确认. ### Prompt to paste into your agent ```text Using the repo kutukam/autonomous-pentest-agent, start a retest for finding in task with the fixed version . Report the verdict and the session link. Verify that the verdict and the evidence are saved in the finding details before you close the task. ``` ### Caveat A retest sends live traffic to the target again, so run it only on systems you are authorized to test and that are safe to probe. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/kutukam-autonomous-pentest-agent/retest-fixed-findings-after-patching/