01
Website / APIAuthorizationContext
Save your target.
Add your website or API, confirm authorization and choose the context agents can use.
OPEN-SOURCE PREVIEW BUILT FOR YOUR OWN PROJECTS
Your on-demand
AI pentest team.
Save your website or API, choose your models and follow specialist agents using real security tools. Review the evidence, understand the findings and decide what to fix next—all from your own Cloudflare installation.
Cloudflare-native execution.Git-backed evidence.Separate OpenCode agent sessions.
p_ A CLOSER LOOK AT PENTCLOUD GUIDED DEMO
GUIDED PRODUCT TOUR — JUICE SHOP DEMONSTRATIONINTERACTIVE DEMO
Tour not loading? Open the guided demo in a new tab
REAL SECURITY TOOLS. HUMAN-STEERABLE INVESTIGATIONS.YOUR INFRASTRUCTURE. YOUR CALL.
THE WORKFLOW, WITHOUT THE GUESSWORKFrom target to
From target to
traceable findings.
A real investigation, made visible.
Stay in the conversation from the
first input to the final report.
02
PrimarySpecialistYour input
Follow your AI team.
Configure supported models, open specialist conversations and steer the investigation. Continue setup while the toolbox starts.
03
FindingEvidenceAssessment
Review the evidence.
Inspect findings, reproduction details and captured evidence, then read or download the assessment.
BUILT FOR TRUST, NOT BLACK BOXESReal tools.
A TRACEABLE PATH FROM INPUT TO ACCEPTED WORK SEPARATE CONVERSATIONS, NOT SIMULTANEOUS SCANS
Real tools.
A visible trail.
Behind every finding is work you can inspect.
Behind every investigation is infrastructure
you control.
Git-backed evidence
Connect findings to pinned inputs, captured files and accepted work history.
Pinned input
Captured evidence
Result candidate
Accepted result
Durable orchestration
Keep execution and interruptions visible through recorded state, receipts and supported recovery.
Interrupted work↓ Inspect recorded outcome↳ Recover or reconcile
A conversation for every specialist
Follow each agent's work and steer it through its own conversation.
01PrimarySeparate session
02Searcher 1Separate session
03Pentester 1Separate session
04ReporterSeparate session
Your Cloudflare account
Run the installation in your account, with native access controls and secret bindings.
YOUR ACCOUNT
RuntimeEvidence storage
↕ Model providers↕ Authorized target
EXTERNAL PROVIDERS AND TARGETS REMAIN OUTSIDE YOUR ACCOUNTBring context. Choose your models.
Documents, source/config files and separate pinned repositories can inform an assessment. Supported OpenCode models can be selected by agent role.
UNDER THE SURFACE
A managed foundation.
Less infrastructure to assemble.
More of the investigation to understand.
OperatorCloudflare Access
YOUR CLOUDFLARE ACCOUNT
CoordinatorWorkers + Durable ObjectsSQLite · live runs & admission
↔Artifacts GitImmutable work & evidenceAccepted results
↓ Coordinate separate sessions
OpenCode agent sessions
PrimaryOwn workspaceSearcherOwn workspacePentesterOwn workspaceReporterOwn workspace
↓ Role-dependent tools
One shared Kali ContainerBrowser Run
↔OpenCode /
model providersSelected prompts
& context↕Authorized targetOutside the account
model providersSelected prompts
& context↕Authorized targetOutside the account
Cloudflare Workers and Durable Objects coordinate separate OpenCode sessions. Artifacts Git keeps immutable work and captured evidence. Browser Run and one on-demand shared Kali Container provide testing capabilities.
Understand the state and tool boundaries
Coordinator SQLite owns live runs and admission. Artifacts Git stores immutable work, evidence and accepted results—not every transcript or all live state. Agent sessions have their own workspaces; testing capabilities come from one shared Kali toolbox and Browser Run with role-dependent access. Selected prompts and context are sent to configured model providers. Targets and exclusions guide agents, but universal network host confinement is not enforced.
EVIDENCE, NOT JUST ANSWERSFindings you
Findings you
can investigate.
Move from an investigation to findings you can review: severity, verification status, reproduction details and evidence. Read the assessment, download Markdown or use native Print / Save as PDF.
MarkdownPrint / Save as PDF
ILLUSTRATIVE RELATIONSHIPS · NOT ACTUAL FINDINGS
Saved target
Runs
Finding
A finding, with context
- Severity
- Reviewed impact
- Reproduction
- Steps to investigate
- Evidence
- Captured supporting files
SuspectedConfirmedInconclusive
Distinct verification states, not interchangeable labels.↳ Evidence → Assessment report
Reports disclose incomplete coverage. A completed workflow is not independent proof of a vulnerability.
Built on PentAGI,
with different design choices.
Agents, real security tools and reports are shared capabilities.
The difference is how the platform comes together.
| Dimension | PentCloud THE CLOUDFLARE PATH | PentAGI THE SELF-HOSTED PATH |
|---|---|---|
| Deployment | Cloudflare-managed services in your account | Self-hosted Docker Compose stack |
| Work and history | Coordinator SQLite plus Artifacts Git evidence and accepted work | PostgreSQL/pgvector with optional knowledge graph |
| Models | Supported OpenCode catalogs and configured Console BYOK | Direct providers, gateways and local-model options |
| Emphasis | Guided visible investigations for project owners | Broad platform for security practitioners |
With appreciation to PentAGI for the imported prompts and tool schemas that helped lay the foundation. No claims of superior detection accuracy, lower cost or faster assessments.
A FEW THINGS TO KNOWGood questions.
Good questions.
Clear answers.
Understand the setup,
the scope, and the boundaries.
From target to
traceable findings.
I created PentCloud so nontechnical people can perform real penetration testing on their own projects with less setup and manual effort.
A NOTE FROM THE CREATOR