peaktwilight/pwnkit
Let autonomous AI agents hack you so the real ones can't. Attacks LLM endpoints, web apps, npm packages, and source code. Blind PoC verification to minimize false positives.
Platform-specific configuration:
{
"mcpServers": {
"pwnkit": {
"command": "npx",
"args": [
"-y",
"pwnkit"
]
}
}
}Add the config above to .claude/settings.json under the mcpServers key.
<p align="center"> </p>
<h1 align="center">pwnkit</h1>
<p align="center"> <strong>Let autonomous AI agents hack you so the real ones can't.</strong><br/> <em>Fully autonomous agentic pentesting framework. Blind PoC verification to minimize false positives.</em> </p>
<p align="center"> <a href="https://www.npmjs.com/package/pwnkit-cli"></a> <a href="https://github.com/peaktwilight/pwnkit/blob/main/LICENSE"></a> <a href="https://github.com/peaktwilight/pwnkit/actions"></a> <a href="https://github.com/peaktwilight/pwnkit/stargazers"></a> <a href="https://pwnkit.com"></a> </p>
<p align="center"> </p>
<p align="center"> <a href="https://docs.pwnkit.com">Docs</a> · <a href="https://pwnkit.com">Website</a> · <a href="https://pwnkit.com/blog">Blog</a> · <a href="#benchmark">Benchmark</a> </p>
---
Autonomous agents that discover, attack, and verify vulnerabilities across LLM endpoints, web apps, npm packages, and source code. Every finding is independently re-exploited by a blind verify agent to kill false positives.
npx pwnkit-cli# Scan an LLM endpoint
npx pwnkit-cli scan --target https://your-app.com/api/chat
# Pentest a web app
npx pwnkit-cli scan --target https://example.com --mode web
# Audit an npm package
npx pwnkit-cli audit lodash
# Review source code
npx pwnkitLoading reviews...