It connects to Kali and breaks things on purpose

What it does Pentest Copilot is a browser-based AI agent that autonomously runs penetration tests through a linked Kali Linux instance. You define the target; the system selects tools from a curated registry of over 100 capabilities, executes commands, reads the output, and decides on the next step for up to 25 iterations per turn. It is designed for real-world engagements, boot-to-root challenges, and CTFs, with integrations for Burp Suite, browser automation, and VPN management built into the loop.

The interesting bit The agent isn’t just running shell commands in a vacuum. It can spawn parallel subagents to brute-force directories while enumerating subdomains, proxy browser traffic through Burp Suite to test JavaScript-heavy login flows, and manage multiple VPN connections from the UI. Even in full auto-run mode, dangerous commands like recursive deletes or fork bombs trigger an explicit approval gate, which is a rare admission that giving an LLM shell access is inherently terrifying.

Key highlights

• Autonomous agent loop with up to 25 iterations per turn, directly executing bash, Python, and security tools on the connected attack box.
• 16 built-in agent tools including Burp Suite proxy/repeater/intruder access, browser automation via Magnitude, Google search, and subagent spawning.
• Curated registry of 100+ security tools and Python packages across network, reverse engineering, forensics, and other categories; the agent installs missing ones on demand.
• Bring-your-own-model support for OpenAI, Anthropic, Google, Mistral, or any OpenAI-compatible endpoint.
• MCP server exposure so external clients like Claude Code can command the agent, with actions logged back to the Pentest Copilot session.

Caveats

• Requires Docker and at least 8 GB of RAM (10 GB with the built-in Kali container), so it is not a lightweight browser tool.
• The MCP endpoint exposes broad control over the attack box, Burp, browser automation, and VPN flows; the README explicitly warns to treat its bearer token as local admin access.

Verdict Worth a look if you are a pentester or CTF player who wants to automate reconnaissance and tool-chaining, but probably overkill if you only need to run one-off commands or lack the RAM to host the stack.