The pentest orchestrator that actually finds things .
A real toolkit, not a prompt wrapper.
nmap, nuclei, httpx, subfinder… every tool runs through one rate-limited, scope-checked executor.
The local nuclei index ships with every checkpoint. AEGIS picks templates by detected tech.
Timing oracles, CSRF, SSTI, prototype pollution, race conditions, OAuth flows.
Pre-engagement → passive recon → active recon → fingerprinting → vuln analysis → verification → reporting.
Most "AI pentesters" prompt an LLM to write commands.
AEGIS hands the LLM a real tool surface and a scope guard, then watches it work.
PTES, end to end.
AEGIS executes the seven PTES phases as a state machine. Each phase has its own budget, prompt template, and exit criteria. Claude picks tools; AEGIS runs them, parses results, updates the engagement DB, and decides when to advance.
How the state machine works →Three tiers. One budget.
AEGIS routes work to the cheapest model that can do it. Parsing tool output goes to Haiku. Planning the next phase goes to Sonnet. Reasoning about an attack chain across services goes to Opus.
Run your first
engagement.
Five minutes from pip install to a verified findings report.
Open source, Apache 2.0, authorised targets only.