EVERYTHING XIAOMI
Get listed

Pentographer

Pentographer is an open-source platform for organizing security assessments, including findings, playbooks, evidence, and client reports.

Place
#16 of 34
Score
6.1
Pentographer's website

What Pentographer is

Pentographer is an open-source platform for organizing security assessments, including findings, playbooks, evidence, and client reports. Findings can carry CVSS scores, risk and status tracking, attachments, version history, and connections to playbook items. Teams can build reusable checklists around OWASP, PTES, or their own framework, with OWASP Top 10 (2021) included. Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context; users review drafts before saving and need their own Anthropic API key. Reports support branding, executive summaries, customizable templates, and Word or PDF export. Workspaces have owner, admin, member, and viewer roles, with viewers limited to read-only access. A GraphQL API supports project, finding, and playbook operations, and an MCP server connects with Claude Desktop, Cursor, and other compatible clients using API-key authentication. The free service is available in cloud form or as MIT-licensed self-hosted software. Self-hosting requires Node.js 20+ and PostgreSQL, with evidence stored locally or in S3-compatible storage.

Good

  • Tracks finding risk, status, evidence, and version history
  • Reusable OWASP, PTES, or custom checklists
  • Branded reports export to Word and PDF
  • Free cloud and self-hosted plans
  • Workspace roles include read-only viewers

Watch out

  • AI assistance requires your own Anthropic API key
  • Self-hosting requires Node.js 20+ and PostgreSQL
  • Desktop apps are listed as coming soon

Who it suits

Pentographer suits security testers and teams that need to organize assessment findings, evidence, reusable checklists, and client reports. Its self-hosted option may suit teams seeking to keep data on their network.

Verdict

Pentographer brings assessment tracking, playbooks, and reporting into one free platform, with both cloud and self-hosted options. Teams considering AI drafting should account for the Anthropic API key requirement; self-hosting also requires Node.js and PostgreSQL.

Plans and prices

From Pentographer's own pricing page, checked 8 Oct 2026.

All about pricing
PlanPriceWhat it gives you
CloudFreeAll features · no credit card required
Self-hostedFreeAll features · MIT-licensed · Node.js 20+ · PostgreSQL

The facts

Each one read from Pentographer's own pages, with the date it was checked.

What it does

AI drafting
Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with a review pass before saving.checked 8 Oct 2026
AI integrations
The MCP server supports Claude Desktop, Cursor, and other MCP-compatible clients, with API-key authentication.checked 8 Oct 2026
AI key requirement
The features page says users can bring their own Anthropic API key for AI assistance.checked 8 Oct 2026
API
Pentographer exposes a GraphQL API for querying and updating projects, findings, and playbooks; authenticated access is required for schema operations.checked 8 Oct 2026
Desktop availability
The features page lists a Mac, Windows, and Linux desktop option as coming soon.checked 8 Oct 2026
Finding management
Findings support CVSS scores, risk and status tracking, evidence attachments, version history, and links to playbook items.checked 8 Oct 2026
Playbooks
Users can build reusable checklists mapped to OWASP, PTES, or their own framework, and the site lists OWASP Top 10 (2021) as built in.checked 8 Oct 2026
Product
Pentographer is an open-source platform for managing security assessments, including findings, playbooks, evidence, and client reports.checked 8 Oct 2026
Reports
Pentographer generates branded reports and supports Word and PDF exports, with customizable templates and executive summaries.checked 8 Oct 2026
Self-hosting and privacy
The features page describes MIT-licensed self-hosting, says there is no telemetry or data leaving the network, and lists PostgreSQL as its external dependency.checked 8 Oct 2026
Storage options
Self-hosted evidence can use local filesystem or S3-compatible storage.checked 8 Oct 2026
Support and documentation
The maker provides a knowledge base with guides for cloud setup, self-hosting, reporting, AI, API access, and workspace administration.checked 8 Oct 2026

The company

Team access
Team workspaces provide owner, admin, member, and viewer roles, including read-only access for viewers.checked 8 Oct 2026

Alternatives to Pentographer

All alternatives
  1. 1

    Pentesterra

    Free planWebAPIExtensionLinux
    7.7From €23 a month
    Visit
  2. 2

    Kali Linux

    Free planOpen sourceAndroidLinuxmacOSSelf-hosted
    7.6Free plan
    Visit
  3. 3

    OWASP ZAP

    Free planOpen sourceAPIExtensionLinuxmacOS
    7.6Free plan
    Visit
  4. 4

    Dradis

    Free planWebAPILinuxmacOS
    7.1From $3,600 a year
    Visit
  5. 5

    w3af

    Free planWebAPILinuxmacOS
    6.8Free plan
    Visit
  6. 6

    Caido

    Free planWebAPILinuxmacOS
    6.6Free plan
    Visit