Pentest Agent
Public security intelligence for crypto and Web3

Tag a website.
Get a security report.

Pentest Agent assesses a website's public security posture in seconds and publishes a transparent, evidence-backed report anyone can share.

Non-invasive public checks · no exploitation or credential testing · methodology

Pentest Agent report dashboard on a laptop with live scan panels

How it works

From mention to report, automatically.

X agent beta soon · follow @PentestAgent →
  1. 01

    Mention on X

    Tag @PentestAgent with any website.

    @PentestAgent check example.com

  2. 02

    Automated assessment

    Bounded, passive checks of TLS, headers, cookies, DNS and frontend signals.

  3. 03

    Evidence-backed report

    A grade, every observation we made, and how to fix what's missing.

  4. 04

    Published and shareable

    A public report page and history that anyone can verify.

Built for agents

Your agent can buy a security report.

Pay per scan over x402: no signup, no API keys. Premium scans are fresh and deeper and return a full JSON report. USDC on Base and Solana, USDG on Robinhood Chain soon.

API docs$0.10 per scan
POST https://api.pentestagent.dev/v1/premium/scan
{ "target": "app.example.xyz" }

← 402 Payment Required
  accepts: USDC on Base · USDC on Solana

→ PAYMENT-SIGNATURE: …
← 202 { "scan": { "id": "k8yx5edda3", … },
        "reportUrl": "https://pentestagent.dev/report/…" }

Latest reports

Recently assessed

Explore all →
B
curve.finance2m ago
76/1002 medium1 low
A+
pentestagent.dev22m ago
100/100No issues in checked controls
B
app.uniswap.org27m ago
80/1001 medium3 low
C
app.aave.com27m ago
68/1002 medium3 low
B
jup.ag27m ago
86/1001 medium1 low
C
pancakeswap.finance7h ago
72/1002 medium2 low

Coverage

24 deterministic checks. No guesswork.

Findings and grades come from what we actually observed, never from a model's opinion. Every report shows the evidence, separates confirmed issues from potential signals, and states what was not tested.

Own the domain? Verified owners will unlock authorized deeper testing, private findings and continuous monitoring. See plans

  • TLS & transport

    4 checks

    HTTPS, redirects, HSTS and deprecated protocol support.

  • HTTP security headers

    6 checks

    CSP, framing protection, MIME sniffing and disclosure.

  • Cookie configuration

    3 checks

    Secure, HttpOnly and SameSite on every cookie we receive.

  • DNS & email posture

    4 checks

    DNSSEC, CAA, SPF and DMARC against domain spoofing.

  • Frontend & disclosure

    3 checks

    Mixed content, third-party script integrity, security.txt.

  • Web3 frontend

    4 checks

    Wallet libraries, malicious releases, CDN-loaded wallet code, source maps and contract verification.

  • Read the full methodology

    What we test and how grades work →