VulnClaw is an open-source, AI-agent-driven penetration testing framework that turns natural-language instructions into a full security assessment workflow. It combines a large language model with an MCP (Model Context Protocol) toolchain and orchestrated penetration-testing skills, so a practitioner can describe a target and let the agent drive the process from reconnaissance through to a finished report. The project has gathered roughly 3,800 stars on GitHub and is MIT licensed.
The framework structures an authorised penetration test as a pipeline: information gathering, vulnerability discovery, exploitation validation and report generation. The LLM agent plans each phase, calls security tools exposed through MCP servers, and chains specialised skills for common tasks such as port scanning, service fingerprinting, web vulnerability checks and CTF-style challenges. Because the workflow is driven by an agent rather than fixed scripts, it can adapt its next step to what earlier tools found. VulnClaw is intended for professional security work and CTF competition practice, where testers operate on systems they own or are authorised to assess.
VulnClaw is free and open source under the MIT license. You supply your own LLM API access and run any third-party security tools yourself.
Penetration testers, red-teamers and CTF players who want an agent to handle the repetitive phases of an authorised assessment, and security researchers studying how LLM agents perform on offensive-security benchmarks. It should only be used against systems you own or have explicit permission to test.