A classic vulnerability scan finds what its signatures know. A pentester finds what comes from several small weaknesses working together. That gap is what the new AI pentest agent in SecTepe SnapScan closes. You no longer just run reconftw modules. You can now pick an agentic LLM engine as the scan type. It scouts the target on its own, forms hypotheses and tests them. It then writes the results into the same normalized finding structure as any other scan.
Three Engines to Choose From: reconftw, AI, Both
When you create a scan, you now have three engine options:
- reconftw: the proven pipeline.
- AI: the new agentic engine.
- Both: runs reconftw recon first, then the AI analysis, and merges the findings.
With Both, you get the breadth of a deterministic recon and the depth of an agentic analysis in one run. You don't have to link two scans by hand.
What the Agentic Engine Does Differently
- Headless via the Claude Code CLI: the agent runs fully on the server in its own container (
Dockerfile.agent). No human has to sit next to the terminal. - Surface inventory & coverage ledger: the agent tracks which parts of the attack surface it has already touched. A gate makes sure it covers the whole application, so it does not get lost in one interesting endpoint.
- Cold resume against context bloat: the agent starts a fresh session for each work batch. The context does not grow without limit. That keeps the analysis focused and the cost predictable.
- Adaptive idle watchdog: a fixed wall-clock timeout is gone. A watchdog now spots when the agent has really stopped doing useful work, and only then stops it.
- Version-to-CVE, service-first: the agent checks the service and software versions it finds against known CVEs. It does this before any active testing begins.
Cost Control Is Built In, Not Optional
Agentic models can get expensive if you leave them running alone. SnapScan keeps costs in check on several levels:
- By default, it runs on a powerful model. After unproductive runs, it switches to a cheaper, faster model on its own (cost downgrade).
- You can set a hard cap with
AGENT_*budget limits. - You can override the model per scan with
scanParameters.model.
Authentication uses CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY.
Live Findings and an Attack-Chain Timeline in the Cockpit
Progress is not hidden in a log. The AI agent's findings stream live into the frontend, and the agent cockpit scrolls along on its own. An attack-chain timeline shows which steps the agent took and in what order. This turns a black box into a chain you can check. That matters for the report and for trust in the result.
How It Fits Into the SecTepe Suite
The AI engine works together with the other SnapScan additions:
- The in-network runners and the hardened appliance bring the agent safely into the customer network.
- The active exploitation modes deliver proof you can verify, not just assumptions.
- The MCP findings export passes the results in a governed way to downstream systems such as SecTepe.Core.
Conclusion
The AI pentest agent makes SnapScan more than a scanner. It becomes a platform that scouts on its own, builds attack chains and documents them openly. Cost control is built in, and every step can be traced. Do you need to scale pentest capacity without losing the quality of a manual analysis? Then this is a solid building block.