# PentAGI Documentation

> Self-hosted autonomous penetration testing platform: Docker deployment, multi-agent flows, BYOK LLM providers, REST and GraphQL APIs, sandbox tools, and optional observability stacks for security engineers and operators.

This is a Grok-Wiki source-grounded repository documentation set. Use the complete Markdown link when an agent needs the full repo context.

## Context Links

- [Complete Markdown docs](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/llms-full.txt)
- [Complete Markdown alias](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5.md)
- [Human interactive docs](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5)
- [GitHub repository](https://github.com/vxcontrol/pentagi)

## Repository

- Repository: vxcontrol/pentagi

- Generated: 2026-07-10T07:13:57.068Z
- Updated: 2026-07-10T07:37:54.306Z
- Runtime: Grok CLI
- Format: Documentation
- Pages: 26

## Pages

- [Overview](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/01-overview.md): What PentAGI exposes: autonomous multi-agent pentests in Docker, BYOK LLM providers, web UI, REST and GraphQL under /api/v1, and the shortest path from deploy to first flow.
- [Installation](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/02-installation.md): Prerequisites, Docker Compose core stack, .env from .env.example, SSL and data volumes, and compose overlays for observability, Langfuse, and Graphiti.
- [Quickstart](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/03-quickstart.md): First successful run: set at least one LLM key, docker compose up, open https://localhost:8443, change admin@pentagi.com defaults, create a flow, and verify provider and UI health.
- [Interactive installer](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/04-interactive-installer.md): TUI installer wizard: system checks, .env generation, LLM and search setup, SSL hardening, compose deploy, and admin password reset maintenance paths.
- [Flows, tasks, and subtasks](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/05-flows-tasks-and-subtasks.md): Execution hierarchy: Flow lifecycle and StatusType states, Task objectives, Generator and Refiner subtask plans, Assistant mode, and putUserInput, stopFlow, finishFlow boundaries.
- [Agents and supervision](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/06-agents-and-supervision.md): Specialist agents (primary, pentester, coder, installer, searcher, memorist, adviser, reflector, reporter), execution monitor, planning step, and tool-call hard limits.
- [Tools and sandbox execution](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/07-tools-and-sandbox-execution.md): Tool categories, Docker-isolated terminal and file tools, network search tools, barrier tools done and ask, timeouts, and default images for general vs pentest work.
- [Memory and knowledge](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/08-memory-and-knowledge.md): pgvector memory tools, embeddings config, chain summarizer budgets, user knowledge documents API, flow files and resources under /work, and optional Graphiti graph search.
- [Configure LLM providers](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/09-configure-llm-providers.md): Wire OpenAI, Anthropic, Gemini, Bedrock, DeepSeek, GLM, Kimi, Qwen, and Ollama via env keys and server URLs; UI provider profiles for per-agent models; test providers before flows.
- [Local and custom providers](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/10-local-and-custom-providers.md): OpenAI-compatible custom endpoints (LLM_SERVER_*), Ollama local or cloud, config path YAML, legacy and preserve reasoning flags, and aggregator endpoints such as OpenRouter and DeepInfra.
- [Search engines](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/11-search-engines.md): Enable and configure DuckDuckGo, Google CSE, Tavily, Traversaal, Perplexity, Sploitus, and Searxng; scraper URLs; proxy and timeout constraints that gate network search tools.
- [Authentication and API tokens](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/12-authentication-and-api-tokens.md): Local session login, OAuth Google and GitHub, default admin account, password change, Bearer API tokens for REST and GraphQL, and permission-scoped token lifecycle.
- [Observability and Langfuse](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/13-observability-and-langfuse.md): Optional OpenTelemetry path to Grafana, VictoriaMetrics, Jaeger, and Loki; Langfuse LLM analytics compose stack; OTEL_HOST and LANGFUSE_* keys; what each stack measures.
- [Knowledge graph](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/14-knowledge-graph.md): Enable Graphiti with Neo4j via docker-compose-graphiti.yml, GRAPHITI_* settings, graphiti_search tool behavior, and failure modes when the graph backend is down.
- [Docker sandbox and worker nodes](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/15-docker-sandbox-and-worker-nodes.md): Docker socket and network options, DOCKER_INSIDE and NET_ADMIN, default and pentest images, custom OpenVAS image, and multi-host worker_node deployment constraints.
- [Environment variables](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/16-environment-variables.md): Authoritative Config struct and .env.example: core, Docker, server, providers, embeddings, summarizer, search, OAuth, proxy, supervision, Graphiti, Langfuse, and DB pool keys with defaults.
- [REST API](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/17-rest-api.md): Gin routes under /api/v1: auth, flows, tasks, subtasks, files, resources, containers, toolcalls, assistants, logs, knowledge, providers, settings, users, tokens; Swagger at /api/v1/swagger.
- [GraphQL API](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/18-graphql-api.md): schema.graphqls surface: Query, Mutation, and Subscription operations for flows, assistants, providers, prompts, API tokens, knowledge, usage stats, and real-time log streams over WebSocket.
- [Provider configuration schema](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/19-provider-configuration-schema.md): Per-agent YAML and AgentsConfig fields: model, temperature, top_p, top_k, max_tokens, json mode, reasoning, price, extra_body; built-in provider config.yml baselines and UI testAgent/testProvider.
- [Tools reference](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/20-tools-reference.md): Named tool registry: terminal, file, browser, search engines, memory store/search, agent delegation tools, result tools, barrier tools, and assistant flow-control tools with argument shapes.
- [Prompts and templates](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/21-prompts-and-templates.md): PromptType enum, embedded .tmpl templates, validation via validatePrompt, user prompt CRUD, and how agent templates bind to execution context variables.
- [Example provider configs](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/22-example-provider-configs.md): Copy-paste YAML from examples/configs for vLLM, Ollama, OpenRouter, DeepInfra, Azure, and cloud-compatible endpoints mapped to agent config keys.
- [Sample pentest prompts](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/23-sample-pentest-prompts.md): Ready flow inputs from examples/prompts: base web pentest checklist and scope-of-work style engagement prompts with expected report-oriented outcomes.
- [Deploy with vLLM and Qwen](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/24-deploy-with-vllm-and-qwen.md): Air-gapped style local inference: hardware matrix, vLLM serve flags, LLM_SERVER_* wiring, thinking vs non-thinking provider YAML, and supervision flags recommended for sub-32B models.
- [Development and testing](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/25-development-and-testing.md): Backend go build and test, frontend pnpm scripts, gqlgen and graphql:generate, ctester container tests, etester embeddings, ftester tool calling, and local compose for contributors.
- [Contributing](https://grok-wiki.com/public/docs/vxcontrol-pentagi-eca0cf4de5f5/pages/26-contributing.md): License-compatible dependency policy, generate-licenses.sh, PR expectations, and contributor workflow boundaries for backend and frontend changes.

## Source Files

- `.env.example`
- `.github/PULL_REQUEST_TEMPLATE.md`
- `backend/cmd/ctester/main.go`
- `backend/cmd/etester/main.go`
- `backend/cmd/ftester/main.go`
- `backend/cmd/installer/checker`
- `backend/cmd/installer/hardening`
- `backend/cmd/installer/main.go`
- `backend/cmd/installer/processor`
- `backend/cmd/installer/wizard`
- `backend/cmd/pentagi/main.go`
- `backend/docs/config.md`
- `backend/docs/docker.md`
- `backend/docs/flow_execution.md`
- `backend/docs/installer.md`
- `backend/docs/langfuse.md`
- `backend/docs/observability.md`
- `backend/docs/ollama.md`
- `backend/docs/prompt_engineering_pentagi.md`
- `backend/go.mod`
- `backend/gqlgen/gqlgen.yml`
- `backend/pkg/config/config_test.go`
- `backend/pkg/config/config.go`
- `backend/pkg/controller/assistant.go`
- `backend/pkg/controller/flow.go`
- `backend/pkg/controller/prompter.go`
- `backend/pkg/controller/subtask.go`
- `backend/pkg/controller/task.go`
- `backend/pkg/csum/chain_summary.go`
- `backend/pkg/docker/client.go`
- `backend/pkg/flowfiles/files.go`
- `backend/pkg/graph/schema.graphqls`
- `backend/pkg/graph/schema.resolvers.go`
- `backend/pkg/graph/subscriptions/controller.go`
- `backend/pkg/graphiti/client.go`
- `backend/pkg/providers/anthropic/config.yml`
- `backend/pkg/providers/custom/custom.go`
- `backend/pkg/providers/embeddings/embedder.go`
- `backend/pkg/providers/ollama/config.yml`
- `backend/pkg/providers/ollama/ollama.go`
- `backend/pkg/providers/openai/config.yml`
- `backend/pkg/providers/pconfig/config.go`
- `backend/pkg/providers/performer.go`
- `backend/pkg/providers/performers.go`
- `backend/pkg/providers/provider/agents.go`
- `backend/pkg/providers/provider/provider.go`
- `backend/pkg/providers/providers.go`
- `backend/pkg/resources/resources.go`
- `backend/pkg/server/auth/api_token_jwt.go`
- `backend/pkg/server/auth/auth_middleware.go`
- `backend/pkg/server/docs/swagger.yaml`
- `backend/pkg/server/models/providers.go`
- `backend/pkg/server/router.go`
- `backend/pkg/server/services/api_tokens.go`
- `backend/pkg/server/services/auth.go`
- `backend/pkg/server/services/flows.go`
- `backend/pkg/server/services/graphql.go`
- `backend/pkg/server/services/knowledge.go`
- `backend/pkg/server/services/prompts.go`
- `backend/pkg/server/services/providers.go`
- `backend/pkg/templates/prompts`
- `backend/pkg/templates/templates.go`
- `backend/pkg/tools/args.go`
- `backend/pkg/tools/duckduckgo.go`
- `backend/pkg/tools/executor.go`
- `backend/pkg/tools/flow_manager.go`
- `backend/pkg/tools/google.go`
- `backend/pkg/tools/graphiti_search.go`
- `backend/pkg/tools/memory.go`
- `backend/pkg/tools/perplexity.go`
- `backend/pkg/tools/registry_test.go`
- `backend/pkg/tools/registry.go`
- `backend/pkg/tools/searxng.go`
- `backend/pkg/tools/sploitus.go`
- `backend/pkg/tools/tavily.go`
- `backend/pkg/tools/terminal.go`
- `backend/pkg/tools/tools.go`
- `CLAUDE.md`
- `CONTRIBUTING.md`
- `CONTRIBUTORS.md`
- `docker-compose-graphiti.yml`
- `docker-compose-langfuse.yml`
- `docker-compose-observability.yml`
- `docker-compose.yml`
- `Dockerfile`
- `examples/configs/azure-openai.provider.yml`
- `examples/configs/custom-openai.provider.yml`
- `examples/configs/deepinfra.provider.yml`
- `examples/configs/ollama-cloud.provider.yml`
- `examples/configs/ollama-qwen332b-fp16-tc.provider.yml`
- `examples/configs/openrouter.provider.yml`
- `examples/configs/vllm-qwen3.5-27b-fp8-no-think.provider.yml`
- `examples/configs/vllm-qwen3.5-27b-fp8.provider.yml`
- `examples/configs/vllm-qwen3.6-27b-fp8.provider.yml`
- `examples/guides/openvas-custom-image.md`
- `examples/guides/vllm-qwen35-27b-fp8.md`
- `examples/guides/worker_node.md`
- `examples/prompts/base_web_pentest.md`
- `examples/prompts/scope_of_work_pentest.md`
- `examples/reports/ollama_qwen3_32b_fp16_base_web_pentest.md`
- `examples/reports/openai_base_web_pentest.md`
- `examples/tests/openai-report.md`
- `frontend/graphql-schema.graphql`
- `frontend/package.json`
- `frontend/src/app.tsx`
- `frontend/src/lib`
- `frontend/src/pages/flows/new-flow.tsx`
- `frontend/src/pages/login.tsx`
- `frontend/src/pages/settings/settings-api-tokens.tsx`
- `frontend/src/pages/settings/settings-prompts.tsx`
- `frontend/src/pages/settings/settings-providers.tsx`
- `LICENSE`
- `licenses/README.md`
- `observability/otel/config.yml`
- `README.md`
- `scripts/generate-licenses.sh`