Automate OWASP PTK

PTK Auto + PTK Agent

Browser security checks in tests, CLI and CI/CD

PTK Agent drives the browser and scan lifecycle. PTK Auto runs inside the browser and returns security evidence from the application context. Keep credentials and provider configuration in the agent or CI environment—not in the extension.

1

Your test or CLI workflow

Start an authorised target and choose a PTK CLI command or supported framework integration.

2

PTK Agent

The pentestkit package acquires the runtime, launches or connects to the browser, controls scan scope and collects results.

3

PTK Auto

The restricted extension executes the browser-side security runtime under the active, authorised agent session.

Local quick start

Run the PTK Agent CLI

  1. Start the application you are authorised to test.
  2. Install the npm package and a browser supported by your chosen framework.
  3. Verify the PTK Auto artifact, then run the scan with explicit completion checks.

Use your real scoped URL in place of the example. Scan only systems you own or have permission to test.

npm install -D pentestkit
npx playwright install chromium

npx ptk-agent --doctor-extension

npx ptk-scan https://your-authorised-target.example \
  --engine DAST,IAST,SAST,SCA \
  --require-ptk-bridge \
  --require-ptk-findings-export \
  --wait-for-ptk-complete

GitHub Actions

Add a security gate to a workflow

Start the application earlier in the job, wait until it is reachable, then invoke the published action. The action can retain PTK artifacts and expose a configurable severity result.

Read the complete action setup, including permissions, artifact handling and SARIF upload.

- name: Run OWASP PTK
  id: ptk
  uses: ptklabs/ptk-action@v1
  with:
    target: http://127.0.0.1:3000
    engines: DAST,IAST,SAST,SCA
    fail-on: high

Browser infrastructure

Frameworks and providers

PTK Agent supports local browser frameworks and selected remote browser platforms. Provider capabilities differ by browser, automation protocol and extension-upload format, so consult the tested matrix before choosing a configuration.

Playwright Puppeteer Selenium Cypress Browserbase Browserless BrowserStack Steel TestMu Hyperbrowser
Provider/browser matrix Runnable examples

Canonical documentation

Continue with the source documentation

The website provides the product boundary and quick start. Versioned options, framework APIs, provider setup and release details remain with the packages that implement them.

pentestkit on npmPackage, current version and install command PTK Agent documentationCLI, frameworks, artifacts and providers PTK ActionGitHub Marketplace workflow integration PTK Auto storesChrome, Microsoft Edge and Firefox listings
Responsible use: PTK can actively attack a target. Configure an explicit scope and use it only on applications you are authorised to test.