Credentials. API tokens can start attacks on any configured target; store them as secrets and rotate them.
Who it is forA security team that wants scheduled lab scans feeding its tracker.
The problemClicking through a UI does not scale to recurring checks.
The outcomeScripts that start PentAGI flows and fetch reports automatically.
What you need first
- Docker and Docker Compose (an interactive installer sets it up on Linux, macOS or Windows)
- An LLM provider key or a local model via Ollama or vLLM
- Written authorization to test every target
Steps
- Create an API token in PentAGI
- Call the REST or GraphQL API with Bearer token authentication
- Start a flow for an authorized target and poll for completion
- Fetch the report and file findings in your tracker
Prompt for your agent
Write a script that uses vxcontrol/pentagi's REST API with a token from an environment variable to start a flow on <authorized lab target>, wait for it, and save the Markdown report.
Caveat. Authorized targets only.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for vxcontrol/pentagi and "Start and collect pentest flows from your own tooling via API"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer