Open-source, self-hosted web pentesting suite.
Agentic scanning, analyst tools, API testing and specialized security models.
BugTraceAI connects autonomous scanning engines, an analyst workspace, published model checkpoints and MCP integrations. Choose the modules you need, run them on your infrastructure, and review the evidence behind each finding.
BugTraceAI combines AI-guided investigation with deterministic security tools. The AI prioritizes hypotheses; tools execute checks, validate evidence, and produce reports that researchers can inspect and reuse.
 |
 |
| Discover and prioritize API surface | Follow autonomous work in real time |
| CVEs disclosed | Presented on stage |
|---|---|
| Wallos - CVE-2026-27479 - CVSS 7.7 | RootedCON 2026, Madrid |
| ZoneMinder - CVE-2026-27470 - CVSS 8.8 | HKOSCon 2026, Hong Kong |
| Piwigo - CVE-2026-27834 - CVSS 7.2 | DEF CON 34, Las Vegas |
| Component | What it gives you | Start here |
|---|---|---|
| BugTraceAI | Suite overview, architecture, public releases and deployment guidance. | Explore the suite |
| BugTraceAI-CLI | Agentic web-scanning engine with a terminal workspace, specialist tools, browser validation, reports, REST and MCP. | Run the CLI |
| BugTraceAI-WEB | Analyst workspace for scan control, live progress, HTTP investigation with AIrepeater, security tools, reports and ModelLab. | Explore WEB |
| BugTraceAI-API | Independent API-target testing engine with OpenAPI-aware discovery, controlled checks, reports, REST and MCP. | Test APIs |
| BugTraceAI-Launcher | Guided module selection, local or Docker installation, and service management. | Choose your setup |
| BugTraceAI Models | Published checkpoints for bug bounty and web pentesting workflows. | Browse the models |
| MCP integrations | Connect compatible tools and agents, including the ReconFTW toolbox. | Explore ReconFTW MCP |
| BugStore | Deliberately vulnerable practice target for controlled training and scanner walkthroughs. | Practice with BugStore |
BugTraceAI publishes security-focused checkpoints in the CORE-Fast, CORE-Pro, CORE-Ultra and Apex families. Browse their model cards for formats, requirements and license terms. The suite also supports external model providers according to each component's configuration. ModelLab, available through WEB, benchmarks selected OpenRouter models and helps review their results and costs. See each module's documentation for current provider support.
- Watch the DEF CON 34 demo to see the workflow end to end.
- Explore a real report generated against the BugStore practice target.
- Choose your modules with the Launcher or run a component independently.
- Read the documentation for installation and component guidance.
- Ask questions in GitHub Discussions or report a problem in the affected repository.
- Join the Discord community for demos, feedback, and project discussion.
BugTraceAI is for educational and authorized security testing only. Always obtain explicit permission, respect target scope, and verify findings manually.