Autonomous security intelligence


Tag a website, get a security report. Pentest Agent assesses its public security posture in seconds and publishes a transparent, evidence-backed report anyone can share.

Paste a website or a token contract address · non-invasive public checks · methodology

Built on
  • Robinhood Chain
  • Pons
  • Base
  • Solana
  • 402x402
81
Public reports
54
Domains assessed
584
Issues flagged
1,252
Pons launches watched

Explore

Latest public reports

Pons launchesAll reports →
WebsiteGradeScoreFindingsChecked
example.com
D
52/1004 medium2 low2h agoReport →
www.fridgemind.spacePremium
D
58/1003 medium3 low3h agoReport →
charterai.worldPremium
D
58/1003 medium3 low3h agoReport →
tempcolab.funPremium
F
34/1005 medium4 low3h agoReport →
cowl.proPremium
C
68/1002 medium3 low3h agoReport →
relevanceai.comPremium
B
82/1001 medium2 low4h agoReport →
slovia.online
C
68/1002 medium3 low5h agoReport →
deadroom.lolPremium
B
78/1001 medium3 low5h agoReport →
www.shuttle.devPremium
B
78/1001 medium3 low5h agoReport →
octrafi.latPremium
C
72/1002 medium2 low5h agoReport →

How it works

From mention to report, automatically.

X agent beta soon · follow @PentestAgent →
  1. 01

    Mention on X

    Tag @PentestAgent with any website.

    @PentestAgent check example.com

  2. 02

    Automated assessment

    Bounded, passive checks of TLS, headers, cookies, DNS and frontend signals.

  3. 03

    Evidence-backed report

    A grade, every observation we made, and how to fix what's missing.

  4. 04

    Published and shareable

    A public report page and history that anyone can verify.

Built for agents

Your agent can buy a security report.

Pay per scan over x402: no signup, no API keys. Premium scans are fresh and deeper and return a full JSON report. USDC on Base and Solana, USDG on Robinhood Chain.

API docs$0.10 per scan
POST https://api.pentestagent.dev/v1/premium/scan
{ "target": "app.example.xyz" }

← 402 Payment Required
  accepts: USDC on Base · USDC on Solana · USDG on Robinhood

→ PAYMENT-SIGNATURE: …
← 202 { "scan": { "id": "k8yx5edda3", … },
        "reportUrl": "https://pentestagent.dev/report/…" }
Live on Pons · Robinhood Chain

$PENTEST

The official token of Pentest Agent, live on Pons on Robinhood Chain. Practice what we check: the contract address is published right here, on our own website, so anyone (and our own agent) can verify it.

gmgnDexScreenerExplorer

Verify before you trust

  • The only official CA is the one shown on pentestagent.dev and posted by @PentestAgent.
  • Any other token using our name or website is not ours.
  • Paste any CA into the scanner above: our agent checks whether the project's own site or X account confirms it.

Nothing here is financial advice. Crypto assets are volatile; only use what you can afford to lose.

Coverage

24 deterministic checks. No guesswork.

Findings and grades come from what we actually observed, never from a model's opinion. Every report shows the evidence, separates confirmed issues from potential signals, and states what was not tested.

Own the domain? Verified owners will unlock authorized deeper testing, private findings and continuous monitoring. See plans

  • TLS & transport

    4 checks

    HTTPS, redirects, HSTS and deprecated protocol support.

  • HTTP security headers

    6 checks

    CSP, framing protection, MIME sniffing and disclosure.

  • Cookie configuration

    3 checks

    Secure, HttpOnly and SameSite on every cookie we receive.

  • DNS & email posture

    4 checks

    DNSSEC, CAA, SPF and DMARC against domain spoofing.

  • Frontend & disclosure

    3 checks

    Mixed content, third-party script integrity, security.txt.

  • Web3 frontend

    4 checks

    Wallet libraries, malicious releases, CDN-loaded wallet code, source maps and contract verification.

  • Read the full methodology

    What we test and how grades work →