Installing and Configuring PentAGI on Kali Linux: A Complete Step-by-Step Guide

In this article, I'll walk you through the complete process of installing and configuring PentAGI on Kali Linux using the OpenAI API. By the end, we'll perform a Proof of Concept (PoC) reconnaissance assessment against an authorized test environment.

What is PentAGI?

PentAGI is an autonomous penetration testing platform developed by VXControl that leverages Artificial Intelligence agents to assist security professionals throughout the penetration testing process.

Its capabilities include:

Automated reconnaissance
Service enumeration
Attack planning
Report generation
Integration with security tools
End-to-end penetration testing workflows

It's important to note that PentAGI is not a replacement for a penetration tester. Instead, it acts as an intelligent assistant that automates repetitive tasks while helping analysts make informed decisions.

Prerequisites

Before starting the installation, make sure you have:

Kali Linux (fully updated)
Docker
Docker Compose
An OpenAI API account
An OpenAI API key

Update your system:

sudo apt update
sudo apt upgrade -y

sudo apt update
sudo apt upgrade -y

Installing Docker

Install Docker:

sudo apt install docker.io -y

sudo apt install docker.io -y

Enable and start the Docker service:

sudo systemctl enable docker
sudo systemctl start docker

sudo systemctl enable docker
sudo systemctl start docker

Add your user to the Docker group:

sudo usermod -aG docker $USER
newgrp docker

sudo usermod -aG docker $USER
newgrp docker

Verify the installation:

docker info

docker info

Installing Docker Compose

Depending on your Kali Linux version, Docker Compose may need to be installed separately.

Check whether it's available:

docker compose version

docker compose version

If not:

sudo apt install docker-compose

sudo apt install docker-compose

sudo apt install docker-compose-plugin

sudo apt install docker-compose-plugin

Verify the installation:

docker-compose --version

docker-compose --version

Downloading PentAGI

Create a working directory:

mkdir -p pentagi
cd pentagi

mkdir -p pentagi
cd pentagi

Download the installer:

wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip

wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip

Extract it:

unzip installer.zip

unzip installer.zip

Run the installer:

./installer

./installer

Configuring OpenAI

Select:

OpenAI

OpenAI

Configure the provider with:

Base URL

https://api.openai.com/v1

https://api.openai.com/v1

Paste your OpenAI API key.

PentAGI will automatically validate the connection.

Configuring LLM Providers

For this Proof of Concept, we only configured:

OpenAI

We intentionally skipped:

Anthropic
Google Gemini
Ollama
DeepSeek

Applying the Configuration

After finishing the setup, select:

Apply Changes

Apply Changes

PentAGI will automatically deploy its Docker containers.

Accessing the Web Interface

Open:

https://127.0.0.1:8443

https://127.0.0.1:8443

Important:_ PentAGI uses HTTPS by default._

Once the web interface is available, create or log into your account and access the dashboard.

Running Your First Proof of Concept

For this article, we used Nmap's official test host, which is specifically designed for authorized scanning:

scanme.nmap.org

scanme.nmap.org

We created a Flow focused exclusively on reconnaissance.

Prompt:

You are performing an authorized security assessment against scanme.nmap.org.
Objectives:
- Resolve the hostname.
- Discover open TCP ports.
- Identify running services.
- Detect service versions.
- Attempt OS fingerprinting.
- Produce a concise report.
Constraints:
- Reconnaissance only.
- No exploitation.
- No brute force.
- No denial of service.

You are performing an authorized security assessment against scanme.nmap.org.
Objectives:
- Resolve the hostname.
- Discover open TCP ports.
- Identify running services.
- Detect service versions.
- Attempt OS fingerprinting.
- Produce a concise report.
Constraints:
- Reconnaissance only.
- No exploitation.
- No brute force.
- No denial of service.

This keeps the assessment limited to discovery and enumeration while respecting the intended use of the test environment.

Creating Reusable Templates

One of PentAGI's strengths is the ability to build reusable templates.

Some useful examples include:

Web Assessment
API Assessment
Mobile Assessment
External Reconnaissance
Internal Network Assessment

Having reusable templates helps standardize workflows across different engagements.

Tips for Reducing OpenAI API Costs

Since PentAGI relies heavily on LLM agents, managing token consumption is important.

Some practical recommendations:

Reuse previously collected information.
Avoid repeating reconnaissance tasks.
Request confirmation before starting a new testing phase.
Keep the assessment scope well defined.
Use smaller, lower-cost models for lightweight tasks whenever appropriate.

Final Thoughts

PentAGI represents an exciting step forward in AI-assisted penetration testing. When used within an authorized scope, it can significantly accelerate reconnaissance, enumeration, workflow orchestration, and report generation, allowing security professionals to spend more time analyzing findings rather than performing repetitive tasks.

Although we encountered a minor issue with the restart script during installation, the platform proved to be stable and capable once properly configured.

Like any AI-powered security tool, PentAGI should be viewed as an assistant — not a replacement for human expertise. All findings should be validated by an experienced security professional before drawing conclusions or proceeding with additional testing.

As AI continues to evolve, platforms like PentAGI have the potential to become valuable companions in modern offensive security workflows.

Contents