pentest-ai

Pre-launch patch + small feature batch. The headline is the MCP-side auth-cache fix that makes http_request and run_probe inherit the engagement's authentication automatically, so an LLM driving ptai over MCP doesn't have to re-thread auth_profile on every tool call.

Fixed

• MCP http_request / run_probe inherit engagement auth automatically (mcp_server/auth_cache.py, mcp_server/server.py). A process-local cache keyed by engagement_id stores the auth captured during start_engagement; subsequent tool calls without an explicit auth_profile argument resolve from the cache. Validated end-to-end against Juice Shop v19.2.1: start_engagement(auth_profile="juice_shop") populates the cache, then http_request(engagement_id=..., url="/rest/basket/1") returns the admin basket with no further auth wiring.

Added

• ptai start --auth-profile <name> accepts bearer-flow profiles (cli/main.py). Previously the CLI rejected anything other than form_post; now bearer_static and bearer_dynamic both work and propagate the token through every specialist agent.
• ptai reap --older-than <duration> [--force] [--dry-run] (cli/main.py, engine/findings_db.py:FindingsDB.reap_engagements). Bulk-delete old engagements with cascade safety — skips engagements that still have findings unless --force is passed.

Internal

• Post-publish PyPI smoke test (.github/workflows/release.yml). New smoke job waits for the wheel to propagate, installs it in a fresh venv, verifies ptai --version matches the tag, imports key modules, and runs an MCP initialize handshake. Catches missing-file wheels and broken entry points before users hit them.
• Test hygiene: silenced async-mock warnings in file-upload tests, registered the pytest-timeout marker.
• Reverted a brief regression in the scorer's title-match branch (73e0bd4 reverts 25d041c) that dropped the Juice Shop catch rate ~73% → ~32% on realistic data. Unit tests passed; the realistic benchmark caught it. Adding a corpus-benchmark CI gate is on deck.

Install

pip install ptai==0.15.2

PyPI: https://pypi.org/project/ptai/0.15.2/

Full notes in CHANGELOG.md.