proofmark

Proofmark is an open-source autonomous penetration-testing agent. It runs code dynamically inside an isolated Docker sandbox, forms a hypothesis, and reproduces the exploit before it reports anything. It is built for developers and security teams who want fast, accurate testing without the overhead of a manual pentest or the noise of a static scanner. Every finding carries the request it sent and the response that proves the impact; if it can't prove it, it doesn't report it.

Proofmark supports any target — a live URL, a local codebase, a git repo, an OpenAPI/Swagger spec, or a Postman collection. Its agentic toolkit includes recon, OSINT, an HTTP intercept proxy, a real browser, a code reader, a shell, and a verified auto-fixer. A recon agent maps the target, then an exploit agent proves what it can, sharing a blackboard. It is provider-agnostic via LiteLLM, supporting OpenAI, Anthropic, Azure and more.

Trust and safety features include enforced authorization, with scope checked in code and out-of-scope requests refused before they leave the process. Safe mode blocks destructive HTTP methods (PUT/PATCH/DELETE), so the agent proves impact with reads, never by altering data. Every run is signed, verifiable, and replayable, with hash-chained, optionally signed, replayable records. Per-run cost accounting reports exact tokens and an estimated dollar cost. Authenticated testing lets the agent test as a logged-in user.