github.com/vxcontrol/pentagi

🎯 Major Features

🧠 Latest Reasoning Models Support - Complete integration of cutting-edge AI models with native reasoning capabilities:

• Gemini 2.5/3.0 family with thinking tokens support
• Anthropic Claude Sonnet 4+ with extended reasoning
• DeepSeek R1 and Kimi K2.5 in reasoning mode
• OpenAI o-series models with signature thoughts
• OpenRouter and OpenAI-compatible endpoints with reasoning content preservation

💰 Token Caching & Cost Optimization - Intelligent prompt caching reduces input token costs by 40-70% in multi-turn agent conversations:

• Native caching support for Anthropic (ephemeral cache controls) and Gemini (pre-created content caching)
• Automatic cache hit tracking with detailed analytics
• Particularly effective for long-context penetration testing sessions
• Standardized cache token reporting across all providers

📊 Usage Analytics & Monitoring - Comprehensive REST API endpoints for detailed resource utilization tracking:

• Token usage breakdown by agent type (researcher/developer/executor)
• Cost analysis with cache read/write separation
• Execution time metrics per flow and subtask
• Tool call frequency statistics
• Foundation for visual analytics dashboard (coming in v1.3)

🔑 API Token Management - JWT-based API authentication enables programmatic access to PentAGI:

• Generate and manage API tokens through web interface
• Full REST and GraphQL API access for automation
• OpenAPI specifications for client code generation in any language
• Integration-ready for n8n, OpenClaw, Claude Desktop, and custom solutions
• Foundation for official MCP server (planned for future releases)

🔍 Sploitus Integration - Experimental support for vulnerability search engine:

• Cloudflare-protected service requires IP reputation verification
• Use built-in ftester utility to check your IP reputation before enabling
• Configure via SPLOITUS_ENABLED environment variable

📡 Langfuse v3 Observability - Complete migration to Langfuse v3 standard with enhanced LLM operations tracking:

• Observation type separation: Spans, Generations, Agents, Tools, Chains, Retrievers, Evaluators, Embeddings, Guardrails
• Enhanced message chain visualization with Playground mode navigation
• Detailed Score metrics and execution time logging
• Improved variable and metadata tracking across all observation types

🚀 New Features

• Reasoning Content Preservation: Smart message chain summarization that maintains reasoning signatures for models requiring strict conversation structure
• Tool Call ID Templates: Configurable tool call ID format enforcement for LLM backends with strict validation requirements
• User Preferences System: Favorite flows management with persistent preferences storage
• GraphQL Subscriptions: Real-time flow updates with user-specific event publishing
• Docker Build Versioning: Embedded version and revision information in container images with dedicated build scripts for Linux/macOS/Windows
• Enhanced Error Diagnostics: Stop reason included in error messages (e.g., length indicates need to increase max_tokens)
• PDF Report Generation: Export flow results to PDF using @react-pdf/renderer library
• User Favorites: Add and manage favorite flows with dedicated GraphQL mutations
• Podman Support: Official documentation for running PentAGI with Podman in rootless mode

🎨 UI/UX Improvements

• Enhanced Theme Handling: Improved dark/light/system theme switching with automatic system preference detection
• Better Authentication Flow: Safe return URL handling with validation to prevent open redirect vulnerabilities
• Google OAuth Fix: Resolved CORS issues and improved cookie handling for Google OAuth integration
• Flow Subscriptions: Real-time flow updates in UI via GraphQL subscriptions with user-scoped events
• Settings Form Validation: Stronger password requirements with visibility toggles
• Enhanced Report Generation: Fixed markdown rendering issues in flow reports

🐛 Key Fixes

• Resource Leak Prevention: Fixed response body leaks in browser tool, added tar header size validation in terminal operations, properly close tarWriter to prevent incomplete archives (#101)
• Security Hardening:
  • OAuth state parameter validation with explicit CSRF checks (#101)
  • Session expiry enforcement in authentication middleware
  • SameSite cookie attributes for CSRF protection
  • Browser tool HTTP client timeout (30s) to prevent indefinite hangs
  • Authorization string typos fixed (trailing quotes causing ACL failures)
• TLS Configuration: Respect EXTERNAL_SSL_INSECURE config in Langfuse client, load custom CA certificates from EXTERNAL_SSL_CA_PATH, use system cert pool as base (#132)
• Terminal Command Logic: Corrected terminal command handling logic (#124)
• Swagger Documentation: Fixed missing closing quotes in OpenAPI annotations
• Code Quality: Removed debug console.log statements from production code
• Traversaal API: Updated integration after vendor-side API specification changes
• Nil Pointer Checks: Added nil checks for Langfuse client before ForceFlush operations

🔧 Infrastructure Improvements

• LangChainGo v0.1.14-update.1: Major dependency update with 6 months of accumulated improvements:
  • Signature thoughts support for Anthropic, Gemini, OpenAI providers
  • Message chain caching for Gemini and Anthropic with token savings tracking
  • Standardized usage format across all providers with unified field names
  • Comprehensive test coverage for LLM scenarios including multi-turn conversations, function calling, caching validation
  • Migrated Google AI provider to google.golang.org/genai from deprecated SDK
  • Bedrock Converse API support for Anthropic Claude models
  • Enhanced streaming with proper resource cleanup (memory leak fixes)
• Alpine 3.23.3: Updated base Docker image with latest security patches
• Model Updates: Switched from deprecated gemini-2.0-flash-lite to gemini-2.5-flash-lite with adjusted pricing
• GitHub Actions Modernization: Upgraded all workflows for Node 24 compatibility
• Dependency Security Updates:
  • axios 1.13.2 → 1.13.5
  • lodash 4.17.21 → 4.17.23
  • diff 5.2.0 → 5.2.2
  • jspdf 4.1.0 → 4.2.0
• External Network Access: Comprehensive documentation for configuring PentAGI accessibility from other machines with firewall setup instructions
• Entrypoint Script: SSL certificate generation management for enhanced security setup

🔄 Performance & Architecture

• Standardized Token Usage: All LLM providers now return consistent token fields (PromptTokens, CompletionTokens, TotalTokens, CacheCreationTokens, CacheReadTokens)
• Enhanced Logging: Enriched log fields with flow/task/subtask IDs for better traceability
• Observation Framework: Refactored observability with W3C Trace Context compliance (newSpanID/newTraceID functions)
• Chain Summarization: Enhanced algorithm with critical guarantees preserving last N QA sections even if exceeding size limits, ensuring reasoning signatures retention
• Improved Metadata Handling: Stop reason tracking in generation metadata for better observability

📚 Documentation

• Typo Fixes: Comprehensive typo corrections across documentation and code comments (#121):
  • "PegtAGI" → "PentAGI" in frontend README
  • "Depp Infra" → "Deep Infra", "Traversal" → "Traversaal" in EULA
  • OAuth environment variable names aligned with .env.example
  • Fixed filename typos (sreenshots.go → screenshots.go, wizard-integation → wizard-integration)
• External Access Guide: Step-by-step instructions for PENTAGI_LISTEN_IP, PUBLIC_URL, CORS_ORIGINS configuration
• Podman Documentation: Running PentAGI with Podman in rootless mode with non-privileged ports

📖 Documentation: For detailed setup instructions, visit the README and Quick Start Guide

New Contributors

• @mason5052 made their first contribution in #120
• @Priyanka-2725 made their first contribution in #124
• @SkyFlyingMouse made their first contribution in #128
• @Vaibhavee Singh made their first contribution (documentation for external network access)
• @salmanmkc made their first contribution in #111
• @s-b-repo made their first contribution in #83

Full Changelog: v1.1.0...v1.2.0

🔧 Bug Fixes & Improvements

LiteLLM Passthrough Support

• Fixed Gemini provider compatibility issues preventing proper LiteLLM integration
• All providers now support LiteLLM passthrough mode with standardized endpoints:
  • OpenAI: http://litellm:4000/openai/v1
  • Anthropic: http://litellm:4000/anthropic/v1
  • Gemini: http://litellm:4000/gemini
• Tested and verified with LiteLLM v1.80.11-stable.1
• Enhanced Gemini provider with custom HTTP transport for API key injection and URL rewriting

Windows File Path Compatibility

• Changed file mounting scheme in PentAGI container to resolve Windows path format issues
• Migrated from host path mapping to fixed container paths for better cross-platform compatibility
• Updated volume mounts:
  • PENTAGI_LLM_SERVER_CONFIG_PATH → /opt/pentagi/conf/custom.provider.yml
  • PENTAGI_OLLAMA_SERVER_CONFIG_PATH → /opt/pentagi/conf/ollama.provider.yml
  • PENTAGI_DOCKER_CERT_PATH → /opt/pentagi/docker/ssl
• Migration: Installer v1.0.0 automatically migrates old settings to new schema
• Users can now specify absolute paths in their host filesystem through installer forms

Ollama Single Model Configuration

• Added OLLAMA_SERVER_MODEL environment variable to select a single model for all agents
• Eliminates need to create custom provider configuration files for simple setups
• Additional fine-tuning options:
  • OLLAMA_SERVER_PULL_MODELS_ENABLED - Control automatic model downloads (default: false)
  • OLLAMA_SERVER_LOAD_MODELS_ENABLED - Query available models on startup (default: false)
  • OLLAMA_SERVER_PULL_MODELS_TIMEOUT - Timeout for model pulls in seconds (default: 600)
• Default model: llama3.1:8b-instruct-q8_0

Installer v1.0.0

• Bumped installer version to 1.0.0 with comprehensive stability improvements
• Full Windows support with all configuration scenarios matching Linux and macOS
• Disabled ANSI formatting in Docker Compose commands on Windows for cleaner console output
• Automatic settings migration from old path variables to new schema:
  • DOCKER_CERT_PATH → PENTAGI_DOCKER_CERT_PATH
  • LLM_SERVER_CONFIG_PATH → PENTAGI_LLM_SERVER_CONFIG_PATH
  • OLLAMA_SERVER_CONFIG_PATH → PENTAGI_OLLAMA_SERVER_CONFIG_PATH
• Enhanced error handling and validation throughout installation process
• Recommended: Download latest installer, run "Apply changes" to migrate to new file mounting scheme, then navigate to Maintenance tab and execute "Update PentAGI" to download the new version that supports these options

Enhanced Terminal Command Handling

• Improved agents' understanding of empty results from synchronous terminal commands
• Enhanced background command processing with asynchronous result capture
• Introduced quick check timeout for background command execution
• Clearer feedback on command failures and silent successes
• More accurate success messages reflecting actual command execution outcomes

Additional Improvements

• Fixed nil pointer dereference in Graphiti client methods
• Enhanced error handling for invalid server and proxy URLs during provider initialization
• Improved Docker Compose command handling on Windows systems
• Added comprehensive tests for Gemini API key injection and URL rewriting

Full Changelog: v1.0.1...v1.1.0

🐛 Bug Fixes & Improvements

Enhanced Error Diagnostics

• Added stop reason to error messages when LLM fails to generate tool calls
• If stop reason is length, increase max_tokens parameter for the affected agent in provider settings
• Improves troubleshooting and configuration optimization

DuckDuckGo Search Stability

• Migrated to new DuckDuckGo API with HTML response parsing
• Added comprehensive test coverage with real-world search scenarios
• Significantly improved reliability and result quality

Provider Guardrails Bypass

• Added explicit authorization framework to all agent prompts
• Prevents blocking by OpenAI, Anthropic, and Google Gemini content filters
• Clarified penetration testing context as pre-authorized activity

OpenAI Configuration Updates

• Temporarily switched from gpt-5 to o4-mini for primary agent and assistant due to OpenAI prompt evaluation instability
• Increased max_tokens limits across multiple agents for better output capacity
• Recommendation: Enable Human-in-the-loop mode (ASK_USER=true in .env) when using OpenAI provider for improved stability

Additional Improvements

• Enhanced message formatting in vector store communications with document match scores
• Improved clarity in generator and refiner prompts for user task interpretation
• Added customer interaction protocol for AskUser tool

Full Changelog: v1.0.0...v1.0.1

🎯 Major Features

🧠 Graphiti Knowledge Graph Integration - Revolutionary memory system using Graphiti, a temporal knowledge graph that maintains context across penetration testing sessions. Configure deployment modes (embedded, external, or disabled) and leverage graph-based reasoning for more intelligent agent decisions.

⚙️ Interactive Installer - Professional setup wizard with comprehensive system checks, Docker volume detection, and step-by-step configuration for all services including LLM providers, search engines, and observability stack. Available for Linux, macOS, and Windows.

🎨 Modern Frontend Redesign - Complete UI/UX overhaul with React 19, Tailwind CSS v4, and enhanced architecture:

• Advanced flow management with filters by agents, tasks, tools, and vector stores
• Improved settings interface with tabular data views and form validation
• Real-time toast notifications and responsive design
• Enhanced favorites system and sidebar navigation

🔧 Provider Management System - Unified configuration for LLM providers with support for:

• AWS Bedrock (with temporary credentials and session tokens)
• Google Gemini (2.5 Flash and Pro models)
• Ollama (local deployment)
• Custom OpenAI-compatible endpoints

🔍 Enhanced Search Ecosystem - Integrated SearXNG meta-search engine with privacy-focused searching, complementing existing Perplexity and DuckDuckGo providers.

⚡ Patch Refiner - Intelligent result refinement system that automatically improves agent outputs, validates findings, and ensures accuracy before presenting final results.

🚀 New Features

• Prompt & Agent Management: Create, edit, and test custom AI agent configurations through the web interface
• Provider Testing UI: Built-in testing functionality for validating LLM provider configurations with detailed reports
• SSL/TLS Configuration: External certificate support with custom CA paths and insecure mode for development
• Enhanced Container Management: Configurable Docker images for penetration testing with improved isolation
• Installation ID & Licensing: PentAGI Cloud API integration with license key management
• Volume Persistence Detection: Automatic Docker volume existence checks for Pentagi and Langfuse services

🎨 UI/UX Improvements

• React 19 Migration: Upgraded to latest React version with improved performance and new features
• Tailwind v4: Modern styling system with better customization and smaller bundle size
• Flow Components Refactoring: Renamed and restructured chat components to flow-based architecture
• Responsive Filter Forms: Advanced filtering UI with input groups for agents, tools, and vector stores
• Delete Confirmation Dialogs: User-friendly confirmation prompts for destructive actions
• Hybrid Model Selector: Combined input/dropdown for flexible model selection

🐛 Key Fixes

• Long Subtask Descriptions: Fixed issue #72 with truncating overly detailed subtask descriptions
• Large Result Storage: Resolved database issues when storing extensive task and subtask results
• Provider Configuration: Fixed empty provider config creation in web UI (issue #63)
• Manual Task Stopping: Improved handling when stopping tasks during refiner operations
• URL Resolution: Enhanced browser tool logic for local domain handling
• UTF-8 Sanitization: Moved database UTF-8 sanitization to common package for consistency

🔧 Infrastructure Improvements

• Go 1.24: Updated to latest Golang version with performance improvements
• Docker Optimization: Removed unnecessary cleanup steps, optimized layer caching
• Dependency Updates:
  • Docker SDK 28.2.2 → 28.3.3
  • Ollama 0.9.6 → 0.10.0
  • golang.org/x/crypto security updates
  • Frontend dependencies (Vite, axios, jsPDF)
• Alpine 3.22.1: Latest base image with security patches
• Enhanced Logging: Improved logging throughout the application with better context

🔄 Performance & Architecture

• Graphite Docker Compose: Separate docker-compose-graphiti.yml for modular deployment
• Parallel Workers: Increased default from 8 to 16 for improved testing performance
• Apollo Cache Optimization: Added keyFields normalization for better provider handling
• Agent Configuration: Refactored to use AgentConfigType enum for clarity
• Settings Refactoring: Streamlined provider, prompt, and agent management architecture

📚 Documentation

• Installer Documentation: Comprehensive guide for installation wizard components
• Flow Execution Guide: Enhanced launch configuration documentation
• Graphiti Setup: Instructions for running knowledge graph stack
• Provider Examples: Updated configuration examples for all supported providers
• Prerequisites Guide: Detailed Docker installation and permissions documentation

📖 Documentation: For detailed setup instructions, visit the README and Quick Start Guide

New Contributors

• @stoykovstoyk made their first contribution in #53
• @PeterDaveHello made their first contribution in #50
• @kaikreuzer made their first contribution in #90
• @zavgorodnii made their first contribution in #93

Full Changelog: v0.3.0...v1.0.0

🎯 Major Features

🤖 Assistant Mode - Complete interactive AI assistant with streaming responses, persistent chat sessions, and intelligent agent delegation. Create multiple chat sessions and seamlessly switch between manual assistance and automated penetration testing workflows.

🧪 Professional Testing Suite - Three specialized testing utilities:

• ctester: Test LLM agent configurations with parallel execution and detailed reporting
• etester: Manage vector embeddings with provider testing and database optimization
• ftester: Debug individual functions and AI behaviors with interactive mock modes

🔍 Enhanced Search Capabilities - Integrated Perplexity AI and DuckDuckGo search engines alongside existing providers, plus multi-provider embedding system supporting OpenAI, Ollama, Mistral, Jina, HuggingFace, GoogleAI, and VoyageAI.

🛡️ Custom Kali Linux Environment - Dedicated Docker image optimized for penetration testing with enhanced security tools and network admin capabilities. The open-source build configuration is available under MIT license with automated multi-platform builds and security attestations.

⚡ Enhanced LLM Integration - PentAGI now uses a custom fork of langchaingo with significant improvements for better LLM provider compatibility, enhanced function calling, streaming responses, and optimized external service integrations.

🚀 New Features

• Community Launch: Official Discord and Telegram channels for community support, knowledge sharing, and collaboration between security researchers and AI enthusiasts
• Flexible LLM Configuration: YAML/JSON configuration system for custom providers with per-agent model specifications (examples)
• Advanced Report Generation: Comprehensive Markdown and PDF reports for flows, tasks, and subtasks
• Smart Context Management: Enhanced conversation summarization with configurable preservation settings
• Message Copy & Search: Copy messages in Markdown format with text highlighting across all interfaces
• Provider Management: Visual icons and improved status indicators for OpenAI, Anthropic, and custom providers

🎨 UI/UX Improvements

• Streamlined Assistant Interface: New tab with chat creation, management, and persistent state
• Enhanced Navigation: Improved breadcrumbs with status and provider information
• Better Authentication: Enhanced GitHub/Google OAuth with password change functionality
• Improved Flow Management: Better status handling with proper state transitions and input blocking
• Professional Tooltips: Fixed positioning and enhanced visual feedback

🐛 Key Fixes

• Flow Status Synchronization: Resolved issues with status updates when switching between flows
• Assistant Integration: Fixed problems launching assistants on new and completed flows
• Terminal Synchronization: Improved command execution display between automated and manual agents
• Message Chain Consistency: Enhanced restoration and context handling after interruptions
• Configuration Issues: Resolved Docker, environment variables, and provider setup problems

🔧 Infrastructure Improvements

• Enhanced Container Security: Improved isolation with controlled network capabilities
• Environment Flexibility: ASK_USER interactive mode, proxy support, and SSL/TLS enhancements
• Build Optimization: Golang 1.24 upgrade, dependency updates, and improved Docker builds
• Configuration Management: Pre-built provider configs for OpenRouter, DeepInfra, and DeepSeek
• Custom Docker Images: Open-source Kali Linux containers with automated builds, multi-platform support, and security attestations

🔄 Performance & Architecture

• Agent System Refactoring: Major improvements to core execution logic with better modularity
• Memory Optimization: Enhanced context management and chain summarization for reduced footprint
• Database Performance: Optimized queries and improved vector storage operations
• Enhanced Prompt System: Unified templates with shared components and simplified handling
• LLM Library Improvements: Migration to custom langchaingo fork with enhanced streaming, function calling, and provider compatibility

📖 Documentation: For detailed setup instructions, visit the README and Quick Start Guide

New Contributors

• @dependabot made their first contribution in #4
• @hhktony made their first contribution in #32

Full Changelog: v0.2.0...v0.3.0

🚀 New Features

Frontend Architecture

• ✨ Implemented modern React 18 architecture with TypeScript for enhanced type safety
• 🎨 Added shadcn/ui components with Radix UI primitives for consistent design
• 🌓 Introduced dark/light theme support with Tailwind CSS
• 📱 Added responsive design support for mobile, tablet, and desktop layouts
• ⚡ Optimized build process with Vite and module chunking

Core Features

• 💬 Real-time chat interface with AI agents using WebSocket subscriptions
• 🤖 Multi-agent system with specialized roles (Researcher, Developer, Executor)
• 📊 Terminal integration with real-time output monitoring
• 🎯 Task tracking system with subtasks and progress monitoring
• 🔍 Integrated search capabilities with vector store
• 📸 Screenshot capture and management system

Security & Authentication

• 🔐 Multi-provider authentication support
• 🔑 OAuth integration with GitHub and Google
• 🛡️ SSL/TLS support for secure communications
• 🔒 Environment-based configuration management

🐛 Bug Fixes

• Fixed WebSocket connection handling for GraphQL subscriptions
• Improved error handling in terminal output
• Resolved theme switching persistence issues
• Fixed mobile layout responsiveness

🔄 Changes

• Migrated from CRA to Vite for better build performance
• Updated all dependencies to latest stable versions
• Improved code organization with feature-based structure
• Enhanced type definitions for better TypeScript support

📚 Documentation

• Added comprehensive frontend documentation
• Included development setup instructions
• Added component architecture documentation
• Updated environment configuration guide

🛠️ Technical Details

• React 18.3.1
• TypeScript 5.6.2
• Vite 5.4.7
• GraphQL 16.9.0
• Tailwind CSS 3.4.13

🔜 Coming Soon

• Enhanced performance monitoring
• Improved error reporting
• Extended test coverage
• Additional UI components

🙏 Acknowledgments

• Thanks to @sirozha for new frontend version

What's Changed

• Feature/frontend by @sirozha in #1

New Contributors

• @sirozha made their first contribution in #1

Full Changelog: v0.1.0...v0.2.0

🎯 Current State

PentAGI is in early alpha stage, focusing on core functionality and system stability. This release demonstrates the basic capabilities of our autonomous penetration testing system while actively being developed and improved.

✨ Available Features

Core Functionality

• 🤖 Multi-agent system (Researcher, Developer, Executor)
• 🛡️ Integration with essential security testing tools
• 🧠 Basic memory system with vector storage
• 🔄 Autonomous decision-making capabilities

Technical Implementation

• 🐳 Docker-based deployment
• 📊 Basic monitoring (Grafana + OpenTelemetry)
• 📝 LLM operations tracking (Langfuse)
• 🔌 Support for OpenAI/Anthropic APIs

⚠️ Important Notes

• This is an alpha release intended for testing and feedback
• Not recommended for production use
• Expect frequent updates and changes
• Some features may be unstable or incomplete
• Limited documentation available

🚀 Quick Start

mkdir pentagi && cd pentagi
curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/vxcontrol/pentagi/main/.env.example
# Configure your .env file
docker compose up -d

For detailed documentation and latest updates, please visit README file.