DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to run an authorized pentest workspace on your own machine with Pentest Harness

Start a local AI agent workspace in Pentest Mode for an authorized engagement.

Authorization notice. Pentest Harness is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Credentials. Your provider API key is entered into the app, so keep the local credential store owner-only and never paste the key into shared logs or settings files.

Who it is forA penetration tester who has a signed scope for a client engagement and wants an AI agent workspace that keeps session data local.

The problemEngagement notes, commands, and AI conversations need a dedicated workspace that the tester controls, not a generic chat tab.

The outcomeA running Web UI at http://127.0.0.1:2323 with Pentest Mode available for the engagement.

What you need first

  • Node.js 20+ (Node 22 recommended) and pnpm installed
  • An API key from a supported provider such as OpenAI, Anthropic, DeepSeek, or any OpenAI-compatible gateway
  • Written authorization for every target you point the agent at

Steps

  1. Clone the repository with git clone https://github.com/S1N6H/pentest-harness.git.
  2. Enter the folder with cd pentest-harness and install dependencies with pnpm install.
  3. Build the project with pnpm build.
  4. Start the Web UI with pnpm dsh web and open http://127.0.0.1:2323 in your browser.
  5. Open Settings, then Models, connect your AI provider, and pick a model in the composer before starting the engagement.

Prompt for your agent

Clone https://github.com/S1N6H/pentest-harness, run `pnpm install`, `pnpm build`, and `pnpm dsh web`, then confirm http://127.0.0.1:2323 returns a page. Report the URL and the output of the start command. Only use this workspace against <target> after written authorization for that target is confirmed.

Caveat. The README does not describe which targets or actions Pentest Mode permits, so the authorization check stays with you.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page