Agentic Blackbox Pentester
True black box pentesting. We never see your code. Agents probe your application from the outside, exactly the way an attacker would.
What we test
Coverage spans the OWASP Top 10, validated with working exploits, not theoretical warnings. These classes are where the agents spend most of their time. No exploit, no report.
Broken Access Control
OWASP A01
IDOR, privilege escalation, tenant isolation failures, and horizontal authorization bypasses across multiple roles.
Security Misconfiguration
OWASP A05
Exposed endpoints, default credentials, verbose errors, and permissive CORS or header policies.
Auth Failures
OWASP A07
Auth bypass, session handling flaws, weak MFA, credential-stuffing exposure, and token lifecycle issues.
Custom invariants
Business logic
Application-specific rules and assumptions you supply as context, tested for ways an attacker could violate them.
Point the Keygraph platform at a URL and let it attack. Agents autonomously navigate your application with a real browser and terminal, just like a human pentester. Test as often as you like. No source code access, ever.
The hypothesis-driven testing loop
The pentester runs three phases autonomously, adapting to what it discovers, and follows the arc of a human pentest: discover, attack, report.
Reconnaissance
Phase 01 · Discover
Fingerprints the target's tech stack, maps endpoints using WhatWeb and Playwright-driven browser automation, captures HTTP traffic via mitmproxy, and optionally generates an OpenAPI specification from observed traffic.
Testing loop
Phase 02 · Attack
A strategy agent selects a vulnerability hypothesis, dispatches exploit agents to test it via real browser automation, evaluates outcomes, updates confidence scores, and tracks what's been attempted. It continues until high-confidence exploits are confirmed or the iteration budget is reached.
Reporting
Phase 03 · Report
Synthesizes confirmed exploits into a pentest-grade report with business impact, proof-of-impact evidence, and step-by-step reproduction. Every vulnerability is marked identified, validated, and recorded, so each run stands as penetration test evidence. Exports as PDF and markdown.
Diminishing returns detection
Testing stops when confidence plateaus, not when a counter runs out. The agent tracks its own progress and detects the knee in the curve, the point where additional testing iterations start returning diminishing value.
Gray-box context configuration
All fields optional. Leave blank for pure black box, or fill in to give the agents targeted guidance.
Credentials
Roles
Up to 4 login credentials. Supports Google OAuth, GitHub, and custom auth. Multiple credentials enable privilege escalation and IDOR testing across different roles and organizations.
Focus
Targeting
Aim the agents at specific areas: your auth flow, a particular feature, a sub-service, or endpoints you're nervous about. Tell it: “I built this quickly and I'm not sure how secure it is.”
Context
Business logic
Describe business logic invariants, assumptions your app makes, legacy infrastructure, or tech stack details so the logic testing aims at the right places.
Avoid
Scope exclusions
Define scope exclusions for the assessment: specific features, flows, or sub-services the agents will not test. Useful for protecting production data, skipping known-good areas, or avoiding destructive operations.
OpenAPI spec
Attack surface
For the most thorough coverage, provide an OpenAPI specification. It gives the agents a complete inventory of your endpoints for attack surface enumeration.
Deployment targets
Environments
Test against localhost dev setups via ngrok, or target staging and sandbox URLs after verifying domain ownership through DNS TXT record confirmation.
One platform, the whole surface
The Blackbox Pentester is one module on the Keygraph platform. Everything below shares the same findings model, deduplication, and reporting.
Pentesting
Whitebox PentesterCode-aware exploit validation Blackbox PentesterNo source access required Business Logic TestingAbuse of intended behaviour ShannonThe open-source engineSee it attack your stack
Point the Keygraph platform at a staging URL. Get a pentest-grade report in hours, not weeks, with proof-of-impact evidence and step-by-step reproduction.