The wedge · 8 min
AI pentest: audit your app without sending the code away.
People search “AI pentest” because a scanner dumps 200 lines, a human pentester costs a week, and Claude sometimes refuses to audit. The kit runs a squad on your machine. Eight modes. A report only if QA signs.
- When to open it
- You want a security audit of YOUR site, SaaS or MCP server
- You open Claude, Codex, Cursor or Hermes on your machine
- You will not upload the repo to a hosted scanner
- Agents
- 12 agents, 10 specialists — the mode picks who runs
- Outside this mode
- Not an offensive pentest: no exploit, no payload
- Not a SOC 2 certificate
- Without written authorization, nothing runs on a system that is not yours
What people are actually asking for
“AI pentest” mixes three jobs. Audit a model. Use a model to audit an app. Buy a tool that claims both. This is the second: a squad that reads YOUR system — pages, auth, API, isolation, MCP tools — and writes a report with evidence.
The kit is a ZIP. You open it in Claude, Codex, Cursor or Hermes. Karukera never sees the target, the code, or your keys. If the model refuses the audit, an OpenRouter key routes to models that will. Your credits stay yours.
Scanner, human pentest, agent kit
- A scanner lists headers and CVEs. It will not decide an IDOR between two orgs.
- A human pentest is the right tool for a long adversarial exercise, not for a founder who wants a held report this weekend.
- The kit chains 12 agents, refuses to invent evidence, and writes the report only if QA signed.
Eight modes, not one magic button
You do not pick an internal mode. You name the project, the depth, and whether you give access. The orchestrator maps:
- Express — first signal on a public origin (30–45 min).
- Full Web — site or app, cookies, same-origin API (one day).
- Full SaaS — orgs, roles, isolation. Two tenants to confirm an IDOR.
- Agents / MCP — tools, skills, delegation. Agent 09 runs first.
- Delta — what moved after the fixes.
- Continuous — periodic guardrail on an existing baseline.
- Light red team — active non-destructive tests, written mandate required.
- Board report — executive synthesis. No new tests. QA already signed.
What you get
An evidence journal, findings with six measurement statuses (Confirmed is not Hypothesis), an exec report, an implementation report, and tickets. Each ticket carries the prompt to paste into your LLM to fix. If QA refuses, there is no report. That is the product.
Launch phrase
Audit this project on my machine. URL: https://app.example.tld. Code: ./my-app. Full. Outside + inside. Accounts are in the brief, not here.
Before you launch
- Is this a “real” pentest?
- It is an observation audit, with a light red-team mode if you have a written mandate. The ZIP writes no exploit. A Confirmed finding has journaled evidence, or it is not Confirmed.
- Do I need to code?
- No. Prompts, configs, templates. You open the ZIP in the agent. YOUR target’s code stays on your machine.
- Why not Claude alone?
- Many models refuse the audit. Even when they accept, they invent findings. The kit enforces the evidence chain, the statuses, and a blocking Double QA.
The kit, not the guide.
Open source, MIT. Clone it, open it in Claude, Codex, Cursor or Hermes. A held report — or QA’s silence.