Get started Star on GitHub

An agentic network pentest tool you talk to.

Open a terminal session and chat with an agent that discovers hosts, fingerprints services, checks for known issues and reports what it confirms. It runs on your own model or a deterministic fallback, stays locked to the scope you set, and asks before anything intrusive. Read-only by default. Your model, your machine.

Read the docs See the agent loop

Authorized testing only. Every tool is locked to the target you name, and intrusive actions need your approval. Read the rules

~/engagements/acme-demoexample session, fictional lab
sample session, fictional lab. Agent wording and counts are illustrative.
network map/topology
network
├─ 10.0.0.5
│  ├─ 22  ssh   OpenSSH 8.9
│  ├─ 80  http  nginx 1.18
│  └─ [HIGH] exposed admin panel
└─ 10.0.0.8
   └─ 445 smb

The live map the agent builds as it goes, hosts to ports to service and version to findings. Call it up in-session with /topology.

runs on
Python 3.10+macOSLinuxwraps nmap + nuclei
your model
OpenAIDeepSeekAnthropicGeminiOllama (local)none, deterministic(must support tool calling)
output
full-screen terminal TUIfindings: severity + evidence + fixJSON (--json)(example list)
WHAT IT ISin short

A conversation with an agent on a leash.

pwner opens a full-screen terminal session you talk to in plain language. Ask it to scan a host or a range and it reasons about what it sees, calls the right tool, reads the result and keeps going, streaming its thinking as it works. It runs on your own model, local or hosted, or a deterministic fallback with no model at all.

Every tool is locked to the target you named and enforced outside the model, so the agent cannot wander off scope. Discovery, fingerprinting and detection are read-only; brute-force and anything active are denied by default and need your approval. It ships no exploits and no implants.

TOURdetails live on their own pages

The agent

A conversational observe, reason, act, report loop. The model asks for a tool; the tool layer decides whether it runs. Steer it live, cancel a turn, approve or deny a gate.

See the loop

Tools

Port and service scans, OS and banner fingerprinting, DNS, HTTP, known-CVE templates and anonymous-access checks. Every tool is read-only and scope-locked; brute-force is consent-gated.

Browse the tools

Architecture

A small Python core, an agentic tool-calling loop, and a scope and consent layer the model cannot reach.

Read the design
RULESresponsible use
Authorized testing only. If you do not have written permission to test a network, do not point pwner at it.
Read the rules
scope lockEvery host-targeting tool refuses any address outside the target you named, enforced at the tool layer, not by the prompt.
consent gatesBrute-force and other intrusive actions are denied by default and need your y/N. The agent cannot approve itself.
read-only by defaultDiscovery, fingerprinting and detection only. No exploits or implants ship, and the raw nmap escape hatch blocks intrusive scripts.
QUICKSTARTexample commands

Set a key once, then just talk to it.

Install, run pwner once to set your provider and key, then open a session against a lab range and tell the agent what to do. The full walkthrough is in the docs.

Open the docs Read the rules 
pip install -e .

Examples, not live. The PyPI name, Docker image and registry paths are placeholders; nmap and nuclei are separate system binaries.

quickstart.shexample
pwner                        # first run: set provider + key, opens the session
pwner chat 10.0.0.0/24         # talk to the agent; it scans when you ask
pwner scan 10.0.0.5 --no-ai    # deterministic suite, no model needed