Which AI agents work with PentestLLM?

Any client that takes an OpenAI-compatible base URL or speaks the Anthropic Messages format. There are step-by-step guides for OpenCode, Claude Code, Cursor, Cline, aider, the Kali MCP server and PentestGPT.

What base URL do I use?

OpenAI-format clients use https://api.pentestllm.ai/v1. Anthropic-format clients such as Claude Code use https://api.pentestllm.ai and add /v1/messages themselves.

Which model id should an agent send?

Send auto/security to let the router pick a security build per request, or the id of a single build from the models page if you want every turn on the same model.

Do the models support tool calling?

Agents need a build that takes tool calls. Each model page lists the request parameters the build supports, and the router only picks builds that can take what the request carries.

What does an agent session cost?

Agents re-send long context, so input tokens are most of the bill. On 2026-11-11 input prices for security builds start at $0.40 per million tokens, and the balance is prepaid from $10.

Is it safe to let an agent run commands?

Only with approval on and a clear scope. Review each proposed command before it runs against a target, and test only systems you own or have written permission to test.

Run security models in your agent

Every agent that accepts an OpenAI-compatible or Anthropic-compatible endpoint can run on PentestLLM: you give it a base URL, a key and a model id. These guides show where those three values go in OpenCode, Claude Code, Cursor, Cline, aider, the Kali MCP server and PentestGPT, using each tool’s real config format.

Get a key Prices per token

shell

curl https://api.pentestllm.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-ptl-live-…" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto/security",
    "messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
  }'

The three values every guide uses

Base URL: https://api.pentestllm.ai/v1 for OpenAI-format clients. Anthropic-format clients such as Claude Code take https://api.pentestllm.ai and add the path themselves.
Key: Created in the console, shown once, prefixed sk-ptl-. Sent as a bearer token, or in x-api-key by Anthropic-format clients.
Model id: auto/security for the router, or the id of one build from the models page, such as gemma-4-26b-a4b-it-cybersecurity.

Before opening any agent, list the models your key can call. If this works, every guide below is a matter of typing the same values into a different place.

shell

curl https://api.pentestllm.ai/v1/models -H "Authorization: Bearer sk-ptl-live-…"

Seven guides

OpenCode: A terminal agent. One provider block in opencode.jsonc; takes the endpoint directly.
Claude Code: Anthropic’s terminal agent. Two environment variables point it at the Messages endpoint.
Cursor: An editor. An OpenAI key and a base URL override in its Models settings, with limits worth knowing.
Cline: An editor extension. The OpenAI Compatible provider with three fields.
Aider: A terminal pair programmer. Two environment variables or a YAML file.
Kali MCP: The Kali project’s MCP package, which lets an agent run tools on a Kali machine you control.
PentestGPT: The open-source pentest assistant. Its interactive mode takes an OpenAI base URL.

Which agent to pick

If you have no preference, start with OpenCode. It takes a custom OpenAI-compatible provider in one file, it lets you alias the router id, and its permission rules decide which actions need your approval. Claude Code is the choice if you already know it and want the same agent on a different model; read the caveat in its guide first.

Editor users choose between Cline, which treats a custom endpoint as a first-class provider, and Cursor, where the base URL override is global and has side effects. Aider suits people who want a small tool that edits files and commits. The Kali MCP guide is not an agent but an addition to one: it gives whichever agent you chose a way to run commands on Kali.

What the router does for an agent

An agent sends many requests of very different sizes: a one-line plan, then a turn carrying forty thousand tokens of files and tool output. The id auto/security places each one. Tools together with code, or a reasoning request, go to the frontier tier; tools, code blocks or a long prompt go to the balanced tier; the rest go to the fast tier. Each request is billed at the price of the build that answered, and the response names it.

Agents that send an x-session-id header keep one build for the session for 30 minutes after the last request. If your client pins a model name you cannot edit, a key with its auto router option set to auto/security routes every chat request that way whatever name the client sends. The router page has the detail.

Approval, scope and logs

An agent on a security model will propose real commands. Keep the approval prompt on for shell and network actions, give the agent the engagement scope in its instructions, and keep its transcript with your engagement notes. The models answer security questions other models decline; they do not know what you are authorized to touch unless you tell them.

PentestLLM is for systems you own or have written permission to test. The acceptable use policy applies to requests your agents send as much as to ones you type.

9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.

Build	Input	Output	Context
Qwen3.8 27B Cybersecurity	$0.40	$2.40	262,144
Gemma 4 26B A4B Cybersecurity	$0.4224	$1.3376	262,144
GLM-5.3 Flash Cybersecurity	$0.5093	$1.6975	1,048,576
Red Team (Flash)	$0.90	$3.00	not published
Red Team (Pro)	$1.50	$6.00	not published
OrcaCyber MiniMax M3.1 Flash	$2.00	$4.00	261,632
OrcaCyber Qwen3.8 Flash Next	$2.00	$4.00	261,632
Cyber Frontier	$5.25	$15.75	1,048,576
OrcaCyber Zero 1.5	$7.50	$18.75	999,488

Full price list and tool fees · Every model · API docs

Questions

Any client that takes an OpenAI-compatible base URL or speaks the Anthropic Messages format. There are step-by-step guides for OpenCode, Claude Code, Cursor, Cline, aider, the Kali MCP server and PentestGPT.
OpenAI-format clients use https://api.pentestllm.ai/v1. Anthropic-format clients such as Claude Code use https://api.pentestllm.ai and add /v1/messages themselves.
Send auto/security to let the router pick a security build per request, or the id of a single build from the models page if you want every turn on the same model.
Agents need a build that takes tool calls. Each model page lists the request parameters the build supports, and the router only picks builds that can take what the request carries.
Agents re-send long context, so input tokens are most of the bill. On 2026-11-11 input prices for security builds start at $0.40 per million tokens, and the balance is prepaid from $10.
Only with approval on and a clear scope. Review each proposed command before it runs against a target, and test only systems you own or have written permission to test.

One key, from $10

PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.

Get a key

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

Input, 8,000 tokens at $0.40 per million: $0.0032
Output, 1,000 tokens at $2.40 per million: $0.0024
One turn: $0.0056
1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B CybersecurityOrcaCyber Zero 1.5 $18.75