Turn Claude Code into a Pentester

A developer created shiftGrid, an open-source prompt engine for agentic pentesting with human oversight. The tool allows agents to follow scoped prompts and checklists while providing transparency through test observations and findings lists, and can be adapted for other tasks like auditing Confluence.

I created this open-source project to automate my day job. I think it could help others too. From Github: shiftGrid https://github.com/BuFuuu/shiftgrid is an prompt engine for agentic pentesting with human oversight. You point your agent or agents at shiftGrid's API and from there it knows the scope, follows the prompts and works through the checklists. Test observations, notes.md and a findings list help keep track of all actions and provide transparency and traceability. At any point, you can switch agents or continue testing yourself. The shiftGrid is the extended context window. Not only does it find security issues but by doing so it gives a great overview and perspective on the app / server. It was written for security testing but in the end, it could be used as a harness for all kinds of tasks. The operator then has great visibility into what the agent does. E.g. I tried to use it for an audit of Confluence, which blew my mind. You can see more details about that adventure here: https://blog.shiftgrid.net/issues/issue-2 https://blog.shiftgrid.net/issues/issue-2 Let me know what you think. I'd love feedback