This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+12 more
Affected surfaces
Summary
AI summaryPENTEST_AI_MODEL env var now honoured across all four providers fixing model-mismatch failures.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Add docs/llm-providers.md with configuration recipes and troubleshooting guidance. Add docs/llm-providers.md with configuration recipes and troubleshooting guidance. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Honour PENTEST_AI_MODEL env var across all four LLM providers. Honour PENTEST_AI_MODEL env var across all four LLM providers. Source: llm_adapter@2026-05-26 Confidence: high |
— |
Full changelog
Issue #12 follow-up. A 0.16.1 user (poeylizn) was pointing ptai at DeepSeek deployed in the cloud and still hit a failure because the OpenAI provider hardcoded gpt-4o regardless of what their endpoint actually served. Two changes plus a new docs page close the loop.
Fixed
PENTEST_AI_MODELenv var now honoured across all four providers (engine/llm/factory.py). Previously only the LiteLLM path read it; the openai / anthropic / ollama paths used hardcoded defaults. A user withOPENAI_BASE_URL=https://api.deepseek.com/v1and a DeepSeek key got a 404 because the factory still asked forgpt-4o. Now settingPENTEST_AI_MODEL=deepseek-chat(or any model your endpoint actually serves) routes through cleanly. Same env var works for pinning Claude / Llama / Qwen variants on the other paths. Closes the silent-mismatch class for the OpenAI-compatible-endpoint case.
Added
docs/llm-providers.md— concrete configuration recipes for every supported path: Anthropic, OpenAI, OpenAI-compatible third-parties (DeepSeek cloud, Groq, Together AI, local llama.cpp/vLLM/LM Studio), Ollama, and LiteLLM (Azure, Bedrock, Vertex, OpenRouter). Each recipe is a copy-pasteable env block. Also covers troubleshooting (gpt-4o404s, Ollama hangs, 401s, LiteLLM ImportErrors) and the--no-llmescape hatch. Linked from the README's Path 3 section.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About pentest-ai
Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.
Related context
Related tools
Beta — feedback welcome: [email protected]