Pentographer review
Open-source finding management with AI assistance, reporting, and self-hosting.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Pentographer is an open-source platform for organizing security assessments rather than executing penetration tests directly. It is designed for solo testers and security teams that need structured project workspaces, findings, evidence, playbooks, client reports, and team access. Its finding records support CVSS scores, risk levels, statuses, evidence attachments, and version history, while reusable checklists can follow OWASP, PTES, or custom frameworks.
Its strongest functional depth is finding and assessment management. Teams can create AI-assisted finding descriptions, remediation guidance, and playbooks using Claude, then generate reports through customizable Word templates with DOCX, PDF, and Markdown exports. Owner, admin, member, and viewer roles support shared workspaces, while the MCP server and GraphQL API provide programmatic access to pentest data. Claude Desktop and Cursor are the named integrations, giving the product a focused ecosystem rather than a broad integration catalog.
Deployment flexibility is another important distinction. Pentographer is available as a hosted cloud application or as a self-hosted deployment using PostgreSQL, local or S3-compatible evidence storage, and API-key or OAuth2 authentication. The open-source model and free availability suit teams that want control over deployment and assessment records without adding a paid tier to the workflow. Choose it for centralized finding management, repeatable playbooks, AI-assisted documentation, and customizable reporting. Choose an alternative when the primary need is direct penetration-testing execution rather than managing the work and outputs around an assessment.
Pentographer pros and cons
- Where it wins
- Versioned findings with CVSS, risk, status, and evidence tracking
- Reusable playbooks mapped to OWASP, PTES, or custom frameworks
- AI-assisted drafting, customizable reports, APIs, and self-hosting
- Where it doesn't
- Direct penetration-testing execution is outside its core positioning
- AI-assisted features depend on Claude
- Self-hosting requires PostgreSQL and evidence storage configuration
Pentographer fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update