Description
The tiring part of an authorised pentest is the long middle: probing subdomain after subdomain and endpoint after endpoint, tracking what has and has not been tested, then matching evidence and requests for the report. ARTEX hands that legwork to LLM agents that explore the target, call tools and log findings on their own, while you watch and approve the sensitive steps.
Everything stays visible: an exploration graph shows the path the agent took, an asset coverage graph marks what is tested and what is not, and recorded traffic can be bound to findings. It is a self-hosted Go backend with a Next.js frontend, needs PostgreSQL plus an Anthropic or OpenAI API key, and is AGPL-3.0 licensed; this repository is the English translation of the original Chinese project.
Autonomous exploration: Agents run recon and testing against authorised targets, with every tool call and reasoning step shown in the session.
Exploration and coverage graphs: Test paths and asset coverage drawn as graphs, tested nodes highlighted, nodes collapsible.
Findings: Findings listed by severity and linked to the request and response that prove them.
Human approval: Sensitive actions wait in an approval queue, and you can step into the chat at any time.
Traffic capture extension: A bundled browser extension records your own authenticated browsing, captchas and 2FA included, into the traffic store.
Asset sync: Import domains, IPs, ports and sites from ScopeSentry by project or task.
Model and agent settings: Configure LLMs, agents, MCP and skills in the UI, with token usage on the dashboard.
Everything stays visible: an exploration graph shows the path the agent took, an asset coverage graph marks what is tested and what is not, and recorded traffic can be bound to findings. It is a self-hosted Go backend with a Next.js frontend, needs PostgreSQL plus an Anthropic or OpenAI API key, and is AGPL-3.0 licensed; this repository is the English translation of the original Chinese project.
Features
Autonomous exploration: Agents run recon and testing against authorised targets, with every tool call and reasoning step shown in the session.
Exploration and coverage graphs: Test paths and asset coverage drawn as graphs, tested nodes highlighted, nodes collapsible.
Findings: Findings listed by severity and linked to the request and response that prove them.
Human approval: Sensitive actions wait in an approval queue, and you can step into the chat at any time.
Traffic capture extension: A bundled browser extension records your own authenticated browsing, captchas and 2FA included, into the traffic store.
Asset sync: Import domains, IPs, ports and sites from ScopeSentry by project or task.
Model and agent settings: Configure LLMs, agents, MCP and skills in the UI, with token usage on the dashboard.
