The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
BugTraceAI
Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.
Install
$
git clone https://github.com/BugTraceAI/BugTraceAIInstall command taken from the project's README or registry entry. Always review code before running it.
README excerpt
Read full README on GitHub →BugTraceAI
Open-source, self-hosted web pentesting suite. Agentic scanning, analyst tools, API testing and specialized security models.
BugTraceAI brings web and API testing engines, an analyst workspace, published model checkpoints and MCP integrations into one modular suite. Run the components you need on your own infrastructure and inspect the evidence behind each finding.
Install with Launcher · Read the docs · Explore a sample report · Browse BugTraceAI models · Join the community
Choose Your Workflow
| I want to… | Start with |
|---|---|
| Run an agentic web assessment in a terminal, or automate it through REST/MCP | BugTraceAI-CLI |
| Investigate HTTP traffic, use analyst tools, follow scans and review reports in a browser | BugTraceAI-WEB |
| Assess an API target with contract-aware discovery and evidence review | BugTraceAI-API |
| Select modules, configure services and install the suite | BugTraceAI-Launcher |
| Explore the published BugTraceAI model checkpoints | BugTraceAI Models |
| Connect additional security tools through MCP | ReconFTW MCP |
| Practice against a deliberately vulnerable target | BugStore |
WEB can connect to the CLI engine for web scans and the API engine for API-target scans. The Launcher lets you choose WEB, CLI, API or a combination.
Jump To
- Proven in the Security Community
- What is BugTraceAI?
- The Ecosystem
- Models and ModelLab
- Architecture
- Scanning Pipeline
- Current Public Releases
- Demo Report
- CI/CD Integration Proposal
- Quick Start
- Documentation
- Community & Support
Proven in the Security Community
CVEs Disclosed
| Product | CVE | CVSS |
|---|---|---|
| Wallos | CVE-2026-27479 | 7.7 High |
| ZoneMinder | CVE-2026-27470 | 8.8 High |
| Piwigo | CVE-2026-27834 | 7.2 High |
Presented On Stage
- RootedCON 2026, Madrid, Spain
- HKOSCon 2026, Hong Kong
- DEF CON 34, Las Vegas, USA
See It Working
CLI 4.0.16-beta · interactive terminal workspace
The real TUI has five views: Pipeline, Findings, Agents, Timeline and Logs. Configure the target, crawl limits, Provider/F7 and Auth/F8 from the workspace. The terminal capture uses the built-in offline demo with sample data. Open the CLI screenshot gallery and installation guide.
Similar plugs
Reverse engineer anything with agents, from app behavior down to native binaries.
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype…
User-friendly AI Interface (Supports Ollama, OpenAI API, ...)
An open-source AI agent that brings the power of Gemini directly into your terminal.