Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Armur-Ai/Pentest-Swarm-AI/llms.txt

Use this file to discover all available pages before exploring further.

Pentest Swarm AI is an autonomous penetration testing CLI built on a real swarm architecture — not a pipeline pretending to be one. By the end of this guide you will have pentestswarm installed, an API key configured, and a live scan running against an authorized target. The whole process takes under five minutes.
Authorization is required. You must have explicit written permission from the system owner before scanning any target. Unauthorized use of this tool violates the Computer Fraud and Abuse Act, the Computer Misuse Act, and equivalent laws worldwide. The authors accept no liability for misuse.
1
Install pentestswarm
2
Pick the method that matches your environment. All three install the same binary.
3
Homebrew (macOS)
brew install Armur-Ai/tap/pentestswarm
Homebrew handles binary selection (Intel or Apple Silicon) automatically and keeps the tool updated with brew upgrade.
Docker
No local installation needed — pull and run in a single command:
docker run --rm \
  -e ANTHROPIC_API_KEY=sk-ant-your-key-here \
  ghcr.io/armur-ai/pentestswarm:latest \
  scan example.com --scope example.com
The Docker image ships with all 15 security tools pre-installed, so you can skip the prerequisites section entirely.
go install
go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@latest
This always pulls the latest commit from main. Requires Go 1.24 or later. Make sure $(go env GOPATH)/bin is on your PATH.
4
Verify the install:
5
pentestswarm --version
6
Set your API key
7
pentestswarm uses Claude by default. One key is all you need — the entire swarm inherits it.
8
Option A — interactive setup (recommended for first-time users):
9
pentestswarm init
10
init prompts for your Claude API key, stores it in the OS native keychain (macOS Keychain, Linux Secret Service, or Windows Credential Manager), probes your system for security tools, and writes a starter ~/.pentestswarm/config.yaml. It is safe to re-run at any time.
11
Option B — environment variable (CI-friendly):
12
export PENTESTSWARM_ORCHESTRATOR_API_KEY=sk-ant-your-key-here
# or the short form that Claude tooling recognises:
export ANTHROPIC_API_KEY=sk-ant-your-key-here
13
The environment variable takes precedence over the keychain, so it is the right choice for automated pipelines.
14
Run your first scan
15
pentestswarm scan example.com \
  --scope example.com \
  --swarm \
  --follow
16
--swarm activates the stigmergic scheduler — agents coordinate through a shared blackboard instead of running in a fixed sequence. --follow streams live agent events to the terminal as they happen.
17
When the scan starts you will see the banner followed by a live event stream:
18

  ██████  ██     ██  █████  ██████  ███    ███
  ██      ██     ██ ██   ██ ██   ██ ████  ████
  ███████ ██  █  ██ ███████ ██████  ██ ████ ██
       ██ ██ ███ ██ ██   ██ ██   ██ ██  ██  ██
  ███████  ███ ███  ██   ██ ██   ██ ██      ██
  Pentest Swarm AI — swarms of agents, one mission

  Target:     example.com
  Scope:      example.com
  Objective:  find all vulnerabilities
  Mode:       manual
  Provider:   claude

  ─────────────────────────────────────────────────────

  14:02:01 [think]  enumerating subdomains for example.com
  14:02:03 [>>]     subfinder -d example.com
  14:02:07 [<<]     found 12 subdomains
  14:02:07 [think]  probing live hosts with httpx
  14:02:09 [>>]     httpx -l subdomains.txt -threads 50
  14:02:14 [<<]     8 live hosts identified
  14:02:14 [!]      CVE-2024-XXXX matched on api.example.com:443
  ...
  [DONE]  Campaign complete.
19
Preview without executing — dry run:
20
Add --dry-run to see what commands the swarm plans to run without sending a single packet:
21
pentestswarm scan example.com --scope example.com --dry-run
22
The output shows every planned tool invocation and LLM decision step. Nothing touches the network.
23
Preview cost before scanning — estimate:
24
Add --estimate to print the expected LLM spend in USD and exit before any scanning begins. This works even without a valid API key:
25
pentestswarm scan example.com --scope example.com --estimate --target-class medium
26
  [estimate] target class: medium
  [estimate] model:        claude-sonnet-4-6
  [estimate] expected LLM spend: $0.18 – $0.54
  (No packets sent. Remove --estimate to run the scan.)
27
--target-class accepts small, medium, or large to size the estimate.
28
View results
29
Reports are written to ./reports/ by default (override with --output <dir>). The default format is Markdown; use --format to change it:
30
# Markdown (default)
pentestswarm scan example.com --scope example.com --format md

# HTML report
pentestswarm scan example.com --scope example.com --format html

# Machine-readable JSON
pentestswarm scan example.com --scope example.com --format json

# SARIF (for GitHub Code Scanning / CI)
pentestswarm scan example.com --scope example.com --format sarif

# All formats at once
pentestswarm scan example.com --scope example.com --format all
31
Open the Markdown report directly or import the SARIF output into your GitHub repository’s Security tab for triage.

Installation

Detailed install instructions for every platform, including prerequisites and the pentestswarm doctor health check.

Configuration

Configure API keys, LLM providers, per-agent model overrides, scope enforcement, and integrations.

scan reference

Full reference for every flag accepted by pentestswarm scan, including swarm vs. sequential mode.

Bug Bounty guide

Run pentestswarm against a HackerOne or Bugcrowd program with the right scope, mode, and submission settings.

Build docs developers (and LLMs) love

Get started for freeTalk to us