No revisions yet.
No dead-lettered jobs.
ClarityASM · PenTestGPT
Sign in
Authorized ClarityASM operators only.
Mission
no active run
Status--
Model--
Elapsed--
Cost--
Mission log idle. Launch a run, or select an active engagement from the left pane.
Hints are queued and picked up by the worker on its next poll (~2s).
Launch Control
High-Ready Dispatch
Launch Wizard
Create Run
At A Glance
Launch Checklist
Live
Active Jobs 0
Click a tile to switch Mission Control to that job.
Active engagement
No engagement selected
Pick a run from the Runs tab to enter Mission Control.
Status
--
Agent
--
Model
--
Elapsed
--
Cost
--
Live
Activity
No events yet.
Tool calls and messages will appear here as the agent works.
Confirmed
Findings
No findings yet.
Flag captures and child-run successes appear here, separate from chatter.
0 / 4000
Hints are queued and picked up by the worker on its next poll (~2s). Best for nudging the agent toward an obvious path or steering away from a dead end.
Live
Active Engagements 0
Engagements running right now. Click any card to drill into the live activity feed.
Click any card to view live activity.
No active engagements right now. Launch one from New Engagement, or open Reports and Exports for completed runs.
Documentation
Job History
Per-job summary with downloadable evidence. Switch to By Execution to see each worker attempt (children of aggregate runs counted separately).
No rows selected.
No runs yet.
Templates
Prompt Library
Tune built-in prompts, create custom variants, and keep saved overrides in the portal so launch templates stay editable without touching source files.
No templates loaded yet.
Editor
Template Editor
Prompt Template
Child Overlay
Structured Operator Inputs
Runtime Policy
Comparison
Diff Vs Built-In Baseline
Select or edit a built-in template to compare it against its baseline.
Operator Flow
Follow the playbook in three moves
Use the library as a guided sequence: choose the workflow, inspect the exact logic, then preserve findings that should survive the run.
Browse
Filter by OWASP, phase, or template until the operator sees the right workflow for the run.
Inspect
Read the goal, preconditions, steps, payloads, and evidence contract as one readable sequence.
Retain
Save reusable endpoints, notes, and branch clues so the next operator starts with context instead of rediscovery.
Step 1
Browse Curated Workflow Library
Start with the runbook list. Filter to the OWASP area or phase you need, then pick one workflow to inspect in full.
No playbooks loaded yet.
Step 2
Choose a playbook
Select a playbook from the library to inspect its goal, preconditions, steps, payload templates, and evidence expectations.
Select a playbook from the library to inspect its goal, preconditions, steps, payload templates, and evidence expectations.
Step 3
Promote Findings Into Passive DB
Retained findings now live in the Passive DB workspace. Group URLs by root domain, expand the domain row, and keep the editor focused on the specific result you want to preserve.
Workflow handoff
Inspect the playbook here, then open Passive DB to retain or refine the URL-level results tied to that workflow.
Passive DB
Retained Findings By Root Domain
Review the retained URL inventory as a passive database. Each domain row expands into the URLs, notes, and captured results currently attached to that surface.
No retained findings yet.
No retained findings yet.
Editor
Retained Finding
Artifacts
Attach CSV Or TXT Evidence
Retained findings accept `.csv` and `.txt` artifacts only. Attach endpoint ledgers, route lists, or analyst notes that should stay with this finding.
No artifacts attached yet.
Inventory
Assets
No assets recorded yet.
Add Asset
Free tier · no Enterprise key required
Burp Suite Workbench
Craft and replay HTTP requests, sweep payloads, review findings, and export Burp-ready config — all in-portal. For full DAST scanning, add an Enterprise key (Enterprise DAST tab).
Request
Response
No response yet. Edit the request and hit Send.
Insert the marker §PAYLOAD§ anywhere in the request below. Each payload (one per line) is substituted in turn and fired; results are tabulated so anomalies stand out.
Base request (with marker)
Payloads (one per line)
Loading findings...
No findings match the current filter.
Generate config you can import into your own Burp Suite (Pro or Community) via Settings → Restore options from file. Seeded from the target below.
Enter a target and choose an export above.
Enterprise DAST
Burp Suite Enterprise ENTERPRISE
Orchestrate Burp Suite Enterprise scans and manage every API-controllable setting — scan profiles, scope, scheduling, and scanning agents — without leaving the portal.
Enterprise features locked
Add and validate a Burp Suite Enterprise API key to unlock orchestrated DAST scans, scan-configuration management, scope control, scheduling, and agent monitoring.
Endpoint--
Scan profiles--
Last validated--
Recent Scans
Scan Configurations
Built-in and custom audit/crawl profiles available to this instance. Select profiles here, then launch from Scope & Sites.
Scope & Sites
The site tree defines scan scope. Launch an on-demand scan against any site using the selected scan configurations.
Pick a site below, then Launch.
Scheduled Scans
One-off and recurring scans registered on this instance.
Scanning Agents
Registered scanning machines and their current load — capacity before launching scans.
Scan Reports
Generate an HTML report for any completed scan.
Per-Attempt Log
Job History
Worker execution history — each child run of an aggregate counts as its own row. Switch to By Job for parent-job summaries with downloadable evidence.
No executions loaded yet.
No rows selected.
No executions yet.
Infrastructure
Workers, Relays, And Control Plane
Command Snapshot
Active routing, ready regions, and operator-side reach at a glance.
Azure Worker Control
Deploy, activate, or retire a region without leaving the page.
Recent Executions
Loading...
Worker Fleet
Loading regions...
Every supported Azure region stays visible here, including standby capacity that can be deployed on demand.
LAN Workers
Loading LAN workers...
Checked-in operator machines that can route Azure runs through a workstation-local proxy.
Azure Identity
Service principal and subscription used for ARM API calls.
Worker Configuration
Container Apps Job, Service Bus, and region defaults.
Platform Surface
Portal endpoints and public hostname.
Local LLM Gateway
ASUS NUC model-queue-manager endpoints and model routing.
Anthropic Provider
API key, balance, and rate-limit status.
Operations
User Management
Super-users can create portal users, grant admin access, and remove managed accounts.
No users loaded yet.
Admin access is required to load user management.
Settings
Preferences
Defaults applied to every new engagement. Per-engagement overrides remain available in the New Engagement form.
Preferences are stored in this browser only.
Integrations · Admin
Burp Suite Enterprise
When configured, every hybrid engagement (Bundle 20) triggers a Burp Suite Enterprise DAST scan alongside the LLM worker. When unset, PenTestGPT falls back to the free Burp Suite Workbench (Bundle 18) — operators paste raw HTTP requests into their own Burp Pro / Community Edition for manual replay.
No portal-stored credentials yet.
Integrations
API Keys
Scoped keys (scans:run) for the external Integration API
(POST /api/integrations/v1/scans). Hand one to an internal tool
(e.g. a Kali/Flask asset dashboard) instead of the admin token. Pair it with a
relay's agent_id to scan internal targets. The secret is shown
once at creation — copy it immediately.
Copy now — this secret will not be shown again.
| Name | Prefix | Scopes | Created | Last used | Status | Actions |
|---|