Skip to content

pentest-ai

v0.16.2 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-security bug-bounty claude ctf security exploit
+12 more
exploit-chaining hacking-tools mcp model-context-protocol nmap offensive-security osint penetration-testing pentest-ai pentesting python vulnerability-scanning

Affected surfaces

auth

Summary

AI summary

PENTEST_AI_MODEL env var now honoured across all four providers fixing model-mismatch failures.

Changes in this release

Feature Low

Add docs/llm-providers.md with configuration recipes and troubleshooting guidance.

Add docs/llm-providers.md with configuration recipes and troubleshooting guidance.

Source: llm_adapter@2026-05-26

Confidence: high

Bugfix Medium

Honour PENTEST_AI_MODEL env var across all four LLM providers.

Honour PENTEST_AI_MODEL env var across all four LLM providers.

Source: llm_adapter@2026-05-26

Confidence: high

Full changelog

Issue #12 follow-up. A 0.16.1 user (poeylizn) was pointing ptai at DeepSeek deployed in the cloud and still hit a failure because the OpenAI provider hardcoded gpt-4o regardless of what their endpoint actually served. Two changes plus a new docs page close the loop.

Fixed

  • PENTEST_AI_MODEL env var now honoured across all four providers (engine/llm/factory.py). Previously only the LiteLLM path read it; the openai / anthropic / ollama paths used hardcoded defaults. A user with OPENAI_BASE_URL=https://api.deepseek.com/v1 and a DeepSeek key got a 404 because the factory still asked for gpt-4o. Now setting PENTEST_AI_MODEL=deepseek-chat (or any model your endpoint actually serves) routes through cleanly. Same env var works for pinning Claude / Llama / Qwen variants on the other paths. Closes the silent-mismatch class for the OpenAI-compatible-endpoint case.

Added

  • docs/llm-providers.md — concrete configuration recipes for every supported path: Anthropic, OpenAI, OpenAI-compatible third-parties (DeepSeek cloud, Groq, Together AI, local llama.cpp/vLLM/LM Studio), Ollama, and LiteLLM (Azure, Bedrock, Vertex, OpenRouter). Each recipe is a copy-pasteable env block. Also covers troubleshooting (gpt-4o 404s, Ollama hangs, 401s, LiteLLM ImportErrors) and the --no-llm escape hatch. Linked from the README's Path 3 section.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pentest-ai

Get notified when new releases ship.

Sign up free

About pentest-ai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

All releases →

Beta — feedback welcome: [email protected]