{"id":"4213ffe0-5123-4122-a321-2c2af92cd0b4","slug":"bugtraceai","kind":"mcp","name":"BugTraceAI","summary":"Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.","owner":"BugTraceAI","repoUrl":"https://github.com/BugTraceAI/BugTraceAI","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":359,"match":null,"fewStars":false,"format":"mcp","createdAt":null,"addedAt":"2026-10-14T05:13:18.882Z","logoUrl":"https://avatars.githubusercontent.com/u/247774386?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","memory-knowledge"],"tags":["ai-agents","bug-bounty","penetration-testing","security-testing","self-hosted","web-security","api-security"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-14T05:14:33.428Z","sample":false,"url":"https://conduits.dev/tools/bugtraceai","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"

\n \"BugTraceAI\"\n

\n\n

BugTraceAI

\n\n

\n Open-source, self-hosted web pentesting suite.
\n Agentic scanning, analyst tools, API testing and specialized security models.\n

\n\nBugTraceAI brings web and API testing engines, an analyst workspace, published model checkpoints and MCP integrations into one modular suite. Run the components you need on your own infrastructure and inspect the evidence behind each finding.\n\n

\n Install with Launcher ·\n Read the docs ·\n Explore a sample report ·\n Browse BugTraceAI models ·\n Join the community\n

\n\n

\n \n \"Watch\n \n

\n\n## Choose Your Workflow\n\n| I want to… | Start with |\n| --- | --- |\n| Run an agentic web assessment in a terminal, or automate it through REST/MCP | [BugTraceAI-CLI](https://github.com/BugTraceAI/BugTraceAI-CLI) |\n| Investigate HTTP traffic, use analyst tools, follow scans and review reports in a browser | [BugTraceAI-WEB](https://github.com/BugTraceAI/BugTraceAI-WEB) |\n| Assess an API target with contract-aware discovery and evidence review | [BugTraceAI-API](https://github.com/BugTraceAI/BugTraceAI-API) |\n| Select modules, configure services and install the suite | [BugTraceAI-Launcher](https://github.com/BugTraceAI/BugTraceAI-Launcher) |\n| Explore the published BugTraceAI model checkpoints | [BugTraceAI Models](https://huggingface.co/BugTraceAI) |\n| Connect additional security tools through MCP | [ReconFTW MCP](https://github.com/BugTraceAI/reconftw-mcp) |\n| Practice against a deliberately vulnerable target | [BugStore](https://github.com/BugTraceAI/BugStore) |\n\nWEB can connect to the CLI engine for web scans and the API engine for API-target scans. The Launcher lets you choose WEB, CLI, API or a combination.\n\n## Jump To\n\n- [Proven in the Security Community](#proven-in-the-security-community)\n- [What is BugTraceAI?](#what-is-bugtraceai)\n- [The Ecosystem](#the-ecosystem)\n- [Models and ModelLab](#models-and-modellab)\n- [Architecture](#architecture)\n- [Scanning Pipeline](#scanning-pipeline)\n- [Current Public Releases](#current-public-releases)\n- [Demo Report](#demo-report)\n- [CI/CD Integration Proposal](#cicd-integration-proposal)\n- [Quick Start](#quick-start)\n- [Documentation](#documentation)\n- [Community & Support](#community--support)\n\n---\n\n## Proven in the Security Community\n\n### CVEs Disclosed\n\n| Product | CVE | CVSS |\n| ------- | --- | ---- |\n| Wallos | [CVE-2026-27479](https://www.cve.org/CVERecord?id=CVE-2026-27479) | 7.7 High |\n| ZoneMinder | [CVE-2026-27470](https://www.cve.org/CVERecord?id=CVE-2026-27470) | 8.8 High |\n| Piwigo | [CVE-2026-27834](https://www.cve.org/CVERecord?id=CVE-2026-27834) | 7.2 High |\n\n### Presented On Stage\n\n- [RootedCON 2026](https://reg.rootedcon.com/cfp/speaker/795), Madrid, Spain\n- [HKOSCon 2026](https://hkoscon.org/2026/topic/bugtraceai-open-source-agentic-ai-for-autonomous-multi-agent-bug-bounty-pentesting/), Hong Kong\n- [DEF CON 34](https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66648), Las Vegas, USA\n\n### See It Working\n\n**CLI 4.0.16-beta · interactive terminal workspace**\n\n![BugTraceAI terminal workspace with Recon, Discovery, Strategy, Exploit, Validate and Report](assets/tui-pipeline.png)\n\nThe real TUI has five views: **Pipeline, Findings, Agents, Timeline and Logs**.\nConfigure the target, crawl limits, Provider/F7 and Auth/F8 from the workspace.\nThe terminal capture uses the built-in offline demo with sample data.\n[Open the CLI screenshot gallery and installation guide](https://github.com/BugTraceAI/BugTraceAI-CLI#terminal-workspace).\n\n\n \n \n \n \n \n \n \n \n
WEB · API discovery
\"BugTraceAI		WEB · specialist graph
\"BugTraceAI
WEB · scan console
\"BugTraceAI		WEB · report explorer
\"BugTraceAI
\n\nWEB captures show the scan and reporting interfaces using the BugStore practice\ntarget. Report counts in screenshots describe those example sessions.\n\nBugTraceAI combines AI-guided investigation with deterministic security tools. The AI prioritizes and reasons about hypotheses; tools and evidence validate what is real.\n\n## Disclaimer\n\nThis platform is provided for **educational and authorized security testing purposes only**.\n\n- Only test applications for which you have **explicit, written authorization**\n- AI output may contain inaccuracies, false positives, or false negatives\n- It is **not** a substitute for professional security auditing\n- The creators assume no liability for misuse or damage\n\n**Always verify findings manually.**\n\n---\n\n## What is BugTraceAI?\n\n**BugTraceAI** is an **open-source, self-hosted web pentesting suite** for authorized security research. It combines agentic scanning, an analyst workspace, an independent API-testing engine, published model checkpoints and extensible tools. Its scanning engines connect AI investigation with security checks, validation and reporting.\n\nIts agents plan and prioritize checks, route work to specialists and collect evidence through the scanning tools and validation stages.\n\n### Core Principles\n\n| Principle | Description |\n| ----------------- | ----------------------------------------------------------------------- |\n| **Privacy-First** | Self-hosted scanning and report storage; analysis uses your configured LLM provider |\n| **Opensource** | Apache-2.0 licensed public product repositories |\n| **Self-Hosted** | Scan reports and local services stay on your infrastructure |\n| **Modular** | Use components independently or together |\n| **Deployment** | Local or Docker CLI profiles; full-platform setup through Launcher |\n\n---\n\n## The Ecosystem\n\nThe suite includes **four independently deployable product components**, published model checkpoints, MCP integrations and a dedicated practice target:\n\n| Component | Description | Repository |\n| --- | --- | --- |\n| **BugTraceAI-API** | Standalone evidence-first API security testing service over REST and MCP | [BugTraceAI-API](https://github.com/BugTraceAI/BugTraceAI-API) |\n| **BugTraceAI-CLI** | Autonomous security scanner with a Textual terminal workspace, REST API and MCP. Multi-agent pipeline with specialist tools and browser validation | [BugTraceAI-CLI](https://github.com/BugTraceAI/BugTraceAI-CLI) |\n| **BugTraceAI-WEB** | Web dashboard with 20+ AI security tools, real-time scan monitoring, and CLI control center | [BugTraceAI-WEB](https://github.com/BugTraceAI/BugTraceAI-WEB) |\n| **BugTraceAI-Launcher** | Guided deployment with CLI TUI/API profiles, local or Docker runtime, optional global btai, service management and an optional AI Setup & Repair Assistant | [BugTraceAI-Launcher](https://github.com/BugTraceAI/BugTraceAI-Launcher) |\n| **MCP Ecosystem** | Extensible agent framework using the Model Context Protocol. Includes integrated Kali Linux and ReconFTW agents | [reconftw-mcp](https://github.com/BugTraceAI/reconftw-mcp) |\n| **BugStore** | Deliberately vulnerable practice target used in demos and walkthroughs. Full-featured shop riddled with 32 planted OWASP vulnerabilities | [BugTraceAI/BugStore](https://github.com/BugTraceAI/BugStore) |\n| **BugTraceAI Models** | Published model checkpoints for bug bounty and web pentesting workflows | [BugTraceAI Models](https://huggingface.co/BugTraceAI) |\n\nUse the CLI TUI locally, its API/MCP for automation, or the Launcher to install independent products or a combination. The WEB connects to the appropriate scanning backend for each engine; API scans use BugTraceAI-API and web scans use the CLI API.\n\n---\n\n## Models and ModelLab\n\nThe suite's model ecosystem has three parts:\n\n- **BugTraceAI Models:** published security-focused checkpoints for bug bounty and web pentesting workflows. See the [model catalog](https://huggingface.co/BugTraceAI) and individual model cards for requirements and usage.\n- **External providers and models:** configurable options supported by each product component. Provider support and model roles vary by module; follow its current configuration guide.\n- **ModelLab:** a benchmarking workspace in WEB for comparing selected OpenRouter models and reviewing their results and costs.\n\nPublishing a checkpoint does not imply it is the default model in every component. Check each module's documentation for supported connections and configuration.\n\n### Published model families\n\n| Family | Focus | Model cards |\n| --- | --- | --- |\n| CORE-Fast | Rapid triage and scanner-output review | [CORE-Fast](https://huggingface.co/BugTraceAI/BugTraceAI-CORE-Fast) |\n| CORE-Pro | Extended investigation, reporting and remediation support | [CORE-Pro](https://huggingface.co/BugTraceAI/BugTraceAI-CORE-Pro) |\n| CORE-Ultra | Structured PoC generation and tool-calling workflows | [Q4](https://huggingface.co/BugTraceAI/BugTraceAI-CORE-Ultra-27B-Q4) · [Q6](https://huggingface.co/BugTraceAI/BugTraceAI-CORE-Ultra-27B-Q6) |\n| Apex | Offensive security reasoning | [Q4](https://huggingface.co/BugTraceAI/BugTraceAI-Apex-G4-26B-Q4) · [F16](https://huggingface.co/BugTraceAI/BugTraceAI-Apex-G4-26B-Master-f16) |\n\nConsult each model card for serving requirements, formats, license terms and intended use.\n\n### Providers by workflow\n\n| Workflow | Provider support described by the current public product documentation |\n| --- | --- |\n| CLI web scans | OpenRouter, Anthropic and Z.ai presets; Amazon Bedrock in beta; custom/local OpenAI-compatible presets. See the [CLI configuration guide](https://github.com/BugTraceAI/BugTraceAI-CLI#configuration-and-reports) and [Bedrock guide](https://github.com/BugTraceAI/BugTraceAI-CLI/blob/main/BEDROCK.md). |\n| API-target investigation and AI review | OpenRouter, Anthropic, Z.ai and local Ollama; AI enrichment is optional. See [API providers](https://github.com/BugTraceAI/BugTraceAI-API#ai-providers). |\n| WEB analysis tools, chat and AIrepeater | OpenRouter, Anthropic and Z.ai. The provider configured for a connected CLI scan is a separate setting. See [WEB setup](https://github.com/BugTraceAI/BugTraceAI-WEB#configure-your-workspace). |\n| WEB ModelLab | OpenRouter with the module's own key. See [WEB workspace](https://github.com/BugTraceAI/BugTraceAI-WEB#workspace). |\n| Launcher AI setup and repair | OpenRouter or Anthropic. Wizard supports Z.ai setup. See the [Launcher guide](https://github.com/BugTraceAI/BugTraceAI-Launcher#readme). |\n\nModel support depends on the selected component, provider, task and configuration. Bedrock remains beta with real AWS account validation pending, as stated in its release notes.\n\n---\n\n## Architecture\n\n```mermaid\nflowchart LR\n TUI[CLI terminal workspace] --> Engine[CLI scan engine]\n WEB[WEB dashboard] --> REST[CLI REST API]\n MCP[CLI MCP clients] --> Engine\n REST --> Engine\n WEB --> API[BugTraceAI-API]\n Engine --> Tools[Specialists and browser validation]\n Engine --> Reports[Scan reports]\n API --> Reports\n```\n\nThe CLI stores scan metadata in SQLite and writes report artifacts to disk.\nThe WEB uses PostgreSQL for its own chats, settings and analysis. The Launcher\nconfigures service connections and selected ports. Standalone local TUI setup\nopens the engine without starting an API server.\n\nSee the [component documentation](#documentation) for deployment details.\n\n---\n\n## Scanning Pipeline\n\nThe CLI terminal and WEB display the same six scan phases:\n\n| Phase | Purpose |\n| --- | --- |\n| **Recon** | Crawl the target and discover endpoints |\n| **Discovery** | Analyze URLs and collect initial findings |\n| **Strategy** | Consolidate findings and route work to specialists |\n| **Exploit** | Run specialist checks and collect evidence |\n| **Validate** | Verify findings through the validation stage |\n| **Report** | Generate structured and human-readable deliverables |\n\nTarget authentication supports Bearer tokens and login YAML with optional\nTOTP/2FA. In the TUI, configure it through **Auth/F8**, separately from the\nLLM provider's API key in **Provider/F7**. See the\n[CLI installation guide](https://github.com/BugTraceAI/BugTraceAI-CLI/blob/main/INSTALLATION.md).\n\n## Current Public Releases\n\n| Component | Version | Highlights |\n| --- | --- | --- |\n| [CLI](https://github.com/BugTraceAI/BugTraceAI-CLI/releases/tag/v4.0.34-beta) | **4.0.34-beta** | Terminal TUI, web-scanning API/MCP, provider/auth setup and optional global `btai` |\n| [WEB](https://github.com/BugTraceAI/BugTraceAI-WEB/releases/tag/v2.0.37-beta) | **2.0.37-beta** | Browser workspace for both scanning engines and reports |\n| [API](https://github.com/BugTraceAI/BugTraceAI-API/releases/tag/v1.4.11-beta) | **1.4.11-beta** | Independent API-target engine with REST and MCP |\n| [Launcher](https://github.com/BugTraceAI/BugTraceAI-Launcher/releases/tag/v3.3.34) | **3.3.34** | Universal TUI installer, independent module selection and Wizard or AI setup |\n\nThese releases include the Bedrock beta CLI provider and WEB region controls,\nmodel-override and scan safe-mode fixes, and tolerant Launcher output decoding.\nThe source and curated release copies passed offline checks. Real AWS account\nvalidation remains pending; see the [Bedrock guide](https://github.com/BugTraceAI/BugTraceAI-CLI/blob/main/BEDROCK.md).\nA fresh full installation, macOS and ARM were not validated in this release review.\n\n## Demo Report\n\nWant to see what BugTraceAI produces? Try the **live demo** or download a real scan report generated against [BugStore](https://bugstore.bugtraceai.com/) -- our deliberately vulnerable practice app.\n\n

\n \n \"Live\n \n  \n \n \"Download\n \n

\n\n> **Benchmark note:** This demo report was produced with an earlier scanner build. Results are useful for exploring the workflow, but should not be treated as a current performance claim for the latest CLI release until re-run under a versioned benchmark protocol.\n\nThe zip includes the full markdown report, validated findings JSON, specialist agent results with WET/DRY traceability, reconnaissance data, and PoC enrichment output.\n\n---\n\n## CI/CD Integration Proposal\n\nFor CI/CD, automation can call the **CLI REST/MCP interfaces** for web scans or **BugTraceAI-API** for API-target testing. Reports and evidence are available for review in the WEB workspace. The diagram below proposes downstream AI review and ticketing integrations; connect them to the selected engine's supported interfaces.\n\n

\n \"BugTraceAI\n

\n\nThis keeps external automation, autonomous scanning, evidence-rich reporting, human review, and remediation coordination connected without hard-coding deployment-specific service endpoints.\n\n---\n\n## Quick Start\n\n### Choose your setup\n\n- **Terminal workspace:** Linux and Python 3.10+ for local installation;\n some specialist tools also use Docker when scanning.\n- **API/MCP or full WEB platform:** select the relevant profile and runtime in\n the installer. Docker deployments need Docker Engine, Compose and Git.\n- **Real scans:** configure a supported provider's API key. Opening the TUI or\n its offline demo does not require starting a scan.\n\n### One-Command Install\n\n**One-liner** (recommended):\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/BugTraceAI/BugTraceAI-Launcher/main/install.sh | bash\n```\n\nOr clone and run manually:\n\n```bash\ngit clone https://github.com/BugTraceAI/BugTraceAI-Launcher.git ~/bugtraceai-launcher\n~/bugtraceai-launcher/launcher.sh\n```\n\nFrom this ecosystem checkout, `./install.sh` opens the same universal menu\nwith `full` suggested. Component `./install.sh` entry points suggest their\nown product in that menu; they do not deploy a profile without your review.\n\nEnter and verify a provider API key on the first screen, then choose\n**Install with Wizard** or **Install with AI**. Both stay in the TUI. Wizard\nsupports every module combination. AI setup uses OpenRouter or Anthropic provider tokens; use Wizard for Z.ai.\nSee the [current Launcher guide](https://github.com/BugTraceAI/BugTraceAI-Launcher#readme)\nfor supported module combinations and installation options.\nThe review shows selected modules, runtime, ports and optional WEB toolboxes.\nTerminal profiles can register a global `btai` command.\n\n### Let your AI coding agent run setup\n\nIf you use Codex, Claude Code, Cursor or another local terminal agent, give it\nthis prompt:\n\n```text\nHelp me install BugTraceAI using the official universal Launcher.\n\nFirst read:\nhttps://github.com/BugTraceAI/BugTraceAI#readme\nhttps://github.com/BugTraceAI/BugTraceAI-Launcher#readme\n\nFollow those instructions using the official installer:\nhttps://raw.githubusercontent.com/BugTraceAI/BugTraceAI-Launcher/main/install.sh\n\nAsk which independent modules I want: BugTraceAI-WEB, BugTraceAI-CLI,\nBugTraceAI-API, or a combination. Install only the modules I choose. Let me\nchoose Wizard or the built-in AI installer when my selection is supported;\nuse Wizard for other combinations.\n\nPreserve any existing installation, configuration and data. Run the\nLauncher in my local interactive terminal. I will enter and verify the\nprovider API key there, choose ports and review the plan before installation.\nKeep credentials out of chat and logs. Do not start a scan.\n\nVerify the selected services on their configured ports. If I enable the\nglobal btai command, check it from a fresh shell. Report the installation\nlocation, launch commands, checks completed and any checks still pending.\n```\n\n| Profile | Installed products | Runtime |\n| --- | --- | --- |\n| `terminal` | CLI terminal TUI | Local Python or Docker |\n| `web` | WEB is preselected; add either or both scanning engines if needed | Docker |\n| `full` | WEB + both scanning engines + CLI terminal TUI | Docker |\n| `server` | CLI web-scanning API/MCP | Local Python or Docker |\n| `terminal-server` | CLI TUI + web-scanning API/MCP, without WEB | Local Python or Docker |\n| `api` | Independent BugTraceAI-API target engine, REST + MCP | Docker |\n\nFor direct component installation, use each checkout's explicit\n`scripts/install-runtime.sh` backend or the documented Python/Compose commands. Follow\n[INSTALLATION.md](INSTALLATION.md); a bare WEB `docker compose up` is not a\ncomplete configuration step.\n\nComponent entry points suggest their own module. A suggestion only sets the\ninitial checkboxes; review the exact modules before installation.\n\n---\n\n## Documentation\n\nFull documentation is available in the **[Project Wiki](https://github.com/BugTraceAI/BugTraceAI/wiki)**:\n\n- [Overview](https://github.com/BugTraceAI/BugTraceAI/wiki/Overview) -- What BugTraceAI is and who it's for\n- [Architecture](https://github.com/BugTraceAI/BugTraceAI/wiki/Architecture) -- System design and communication protocols\n- [BugTraceAI-CLI](https://github.com/BugTraceAI/BugTraceAI/wiki/BugTraceAI-CLI) -- Autonomous scanner documentation\n- [BugTraceAI-WEB](https://github.com/BugTraceAI/BugTraceAI/wiki/BugTraceAI-WEB) -- Web dashboard documentation\n- [BugTraceAI-API](https://github.com/BugTraceAI/BugTraceAI-API#readme) -- REST/MCP API-security service, evidence artifacts, and deployment guidance\n- [BugTraceAI-API on DeepWiki](https://deepwiki.com/BugTraceAI/BugTraceAI-API) -- AI-powered codebase documentation and architecture exploration\n- [BugTraceAI-Launcher](https://github.com/BugTraceAI/BugTraceAI/wiki/BugTraceAI-Launcher) -- Deployment guide\n- [CLI API Reference](https://github.com/BugTraceAI/BugTraceAI/wiki/API-Reference) -- CLI REST API and WebSocket endpoints\n- [Getting Started](https://github.com/BugTraceAI/BugTraceAI/wiki/Getting-Started) -- Installation and first scan\n\n---\n\n## Community & Support\n\n| Resource | Link |\n| -------- | ---------------------------------------------------------------- |\n| Website | [bugtraceai.com](https://bugtraceai.com) |\n| Wiki | [GitHub Wiki](https://github.com/BugTraceAI/BugTraceAI/wiki) |\n| DeepWiki | [AI-powered docs](https://deepwiki.com/BugTraceAI/BugTraceAI) |\n| Issues | [GitHub Issues](https://github.com/BugTraceAI/BugTraceAI/issues) |\n| Discord | [Join the BugTraceAI community](https://discord.gg/5HjujkScC) |\n| Twitter | [@yz9yt](https://x.com/yz9yt) |\n\n### Contributing\n\nWe welcome contributions: bug reports, feature requests, PRs, documentation improvements, and community tools. Open an issue on the respective repository to get started.\n\n---\n\n## License\n\n**Apache License 2.0** — BugTraceAI-owned material is free to use, modify, and distribute under the terms of the Apache License, Version 2.0.\n\nSee LICENSE file in each repository.\n\n---\n\n

\n BugTraceAI -- Build your own self-hosted pentesting platform.
\n If BugTraceAI helps your authorized security research, consider giving the project a star or joining the community on Discord.
\n Albert C (@yz9yt)\n

\n"}