A classic vulnerability scan finds what its signatures know. A pentester finds what emerges from the interplay of several small weaknesses – and that is exactly the gap the new AI pentest agent in SecTepe SnapScan closes. Instead of merely running reconftw modules, you can now select an agentic LLM engine as a scan type that reconnoiters on its own, forms hypotheses, tests them, and writes the results into the same normalized finding structure as any other scan.
Three Engines to Choose From: reconftw, AI, Both
When creating a scan, three engine options are now available: the proven reconftw pipeline, the new AI engine, and Both – the latter chains reconftw reconnaissance and AI analysis and merges the findings. This gives you the breadth of a deterministic recon and the depth of an agentic analysis in a single run, without manually connecting two scans.
What the Agentic Engine Does Differently
- Headless via the Claude Code CLI: the agent runs entirely server-side in its own container (
Dockerfile.agent), without a human sitting next to the terminal. - Surface inventory & coverage ledger: the agent keeps track of which parts of the attack surface it has already touched, and a gate ensures the whole application is covered – instead of getting lost in a single interesting endpoint.
- Cold resume against context bloat: the agent starts a fresh session per work batch rather than letting the context grow indefinitely. That keeps the analysis focused and the cost predictable.
- Adaptive idle watchdog: a fixed wall-clock timeout was replaced by a watchdog that recognizes when the agent is genuinely no longer working productively – and only then stops.
- Version-to-CVE, service-first: detected service and software versions are checked specifically against known CVEs before any active testing begins.
Cost Control Is Built In, Not Optional
Agentic models can get expensive when left running unattended. SnapScan counters this on several levels: the default runs on a powerful model but automatically downgrades to a cheaper, faster model after unproductive runs (cost downgrade). A hard cap can be set via AGENT_* budget limits, and the model can be overridden per scan via scanParameters.model. Authentication uses CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY.
Live Findings and an Attack-Chain Timeline in the Cockpit
Progress isn't hidden in a log: the AI agent's findings stream live into the frontend, the agent cockpit auto-scrolls along, and an attack-chain timeline shows exactly which steps the agent took and in what order. This turns a black box into a verifiable chain – important for the report and for trust in the result.
How It Fits Into the SecTepe Suite
The AI engine complements the other SnapScan additions: the in-network runners and the hardened appliance bring the agent safely into the customer network, the active exploitation modes deliver verifiable proof instead of mere assumptions, and via the MCP findings export the results flow in a governed way into downstream systems such as SecTepe.Core.
Conclusion
The AI pentest agent makes SnapScan more than a scanner: a platform that reconnoiters on its own, builds attack chains, and documents them transparently – with built-in cost control and full traceability. Anyone who needs to scale pentest capacity without losing the quality of a manual analysis gets a solid building block here.