🔴 Nobody Pentest

Autonomous security testing engine powered by AI. Scan, exploit, and report — all through a single API.

Quick Start

$ curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-your-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nobody-pentest",
    "max_tokens": 4096,
    "messages": [
      {"role": "user", "content": "Scan example.com for vulnerabilities"}
    ]
  }'

How to Use

# Install from PyPI:
pip install nobody-pentest-ultra

# Find the install location:
python -c "import nobody_pentest_ultra.server; print(nobody_pentest_ultra.server.__file__)"

# Add it to Claude Code (use the full path):
claude mcp add nobody-pentest -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"

# Restart Claude Code, then:
> Scan zerosecid.com

# curl:
curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-xxx" \
  -d '{"model":"nobody-pentest",...}'

Authentication

Use your Nobody AI API key in the x-api-key header:

// Option 1: x-api-key header
-H "x-api-key: sk-nobody-xxxxxxxxxxxx"

// Option 2: Authorization Bearer
-H "Authorization: Bearer sk-nobody-xxxxxxxxxxxx"

Available Models

3-Layer Pipeline

Nobody Pentest uses a unique 3-layer pipeline architecture for thorough security testing:

Testing Methodology

Pentest Tools

Nobody Pentest Ultra has 86 security tools organized into 7 categories:

Network Recon (15 tools)

Web App (26 tools)

Auth/Brute (6 tools)

Binary/RE (16 tools)

Cloud (9 tools)

CTF/Forensics (7 tools)

OSINT (7 tools)

API Usage

Endpoint

POST https://api.nobody0x.com/v1/messages

Request Format

{
  "model": "nobody-pentest",
  "max_tokens": 4096,
  "stream": false,
  "messages": [
    {
      "role": "user",
      "content": "Scan 192.168.1.1 for open ports and vulnerabilities"
    }
  ]
}

Response Format

{
  "id": "msg_nobody_abc123",
  "type": "message",
  "role": "assistant",
  "model": "nobody-pentest",
  "content": [
    {
      "type": "text",
      "text": "[PHASE: RECON]\n> Target: 192.168.1.1\n..."
    }
  ],
  "stop_reason": "end_turn",
  "usage": {
    "input_tokens": 1250,
    "output_tokens": 3200
  }
}

Claude Code Integration (MCP)

Nobody Pentest can be integrated with Claude Code via MCP (Model Context Protocol) for seamless tool access.

⚡ Quick Setup (PyPI)

# 1. Install from PyPI:
pip install nobody-pentest-ultra

# 2. Add it to Claude Code:
claude mcp add nobody-pentest -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"

# 3. Restart Claude Code, then start using it right away:
> Scan zerosecid.com for vulnerabilities

The claude mcp add command automatically:

• ✅ Adds the MCP server to Claude Code's config
• ✅ Sets the command and environment variables
• ✅ Saves it to .claude.json

Then restart Claude Code and it's ready to use.

📦 Install Options

Manual Setup

If auto-setup doesn't work, follow these manual steps:

pip install nobody-pentest-ultra

# Without an API key (default Nobody AI endpoint):
claude mcp add nobody-pentest -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"

# With an API key (external endpoint):
claude mcp add nobody-pentest -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py" -e NOBODY_API_KEY=sk-nobody-xxx

# In Claude Code, just ask:
> Scan zerosecid.com for vulnerabilities
> Search CVEs for Apache 2.4.49
> Generate reverse shell for Linux

MCP Tools Available in Claude Code (86 Tools)

Nobody Pentest Ultra provides a full suite of 86 security tools:

Network Recon (15 tools)

Web App (26 tools)

Auth/Brute (6 tools)

Binary/RE (16 tools)

Cloud (9 tools)

CTF/Forensics (7 tools)

OSINT (7 tools)

cURL Examples

Web Application Scan

curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nobody-pentest",
    "max_tokens": 4096,
    "messages": [{
      "role": "user",
      "content": "Perform a full security audit on https://target.com. Check for SQLi, XSS, misconfigurations, and enumerate directories."
    }]
  }'

CVE Search & Exploit Generation

curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nobody-pentest",
    "max_tokens": 8192,
    "messages": [{
      "role": "user",
      "content": "Search CVEs for Apache 2.4.49 and generate a working exploit in Python3."
    }]
  }'

Code Audit

curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nobody-pentest",
    "max_tokens": 4096,
    "messages": [{
      "role": "user",
      "content": "Audit this PHP code for security vulnerabilities:\n\n<?php\n$user = $_GET[\"user\"];\n$query = \"SELECT * FROM users WHERE id = \"$user;\n$result = mysql_query($query);\n?>"
    }]
  }'

Streaming Response

curl -X POST https://api.nobody0x.com/v1/messages \
  -H "x-api-key: sk-nobody-xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nobody-pentest",
    "stream": true,
    "max_tokens": 4096,
    "messages": [{
      "role": "user",
      "content": "Quick scan of 10.0.0.1"
    }]
  }'

Streaming

Set "stream": true for real-time SSE streaming. The response follows Anthropic's SSE format:

event: message_start
data: {"type":"message_start","message":{"id":"msg_xxx","role":"assistant"}}

event: content_block_start
data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}

event: content_block_delta
data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"[PHASE: RECON]"}}

event: message_stop
data: {"type":"message_stop"}

Multi-Turn Conversations

Nobody Pentest supports multi-turn conversations for iterative testing:

{
  "model": "nobody-pentest",
  "max_tokens": 4096,
  "messages": [
    {"role": "user", "content": "Scan example.com for vulnerabilities"},
    {"role": "assistant", "content": "[PHASE: RECON]\n> Found: nginx 1.18, PHP 8.1..."},
    {"role": "user", "content": "Now generate an exploit for the SQL injection you found on /api/users"}
  ]
}

Report Generation

Generate professional pentest reports from your findings:

{
  "model": "nobody-pentest",
  "max_tokens": 16384,
  "messages": [{
    "role": "user",
    "content": "Generate a full pentest report with these findings:\n\n1. SQL Injection on /api/users (Critical, CVSS 9.1)\n2. XSS on search page (Medium, CVSS 6.1)\n3. Missing security headers (Low, CVSS 3.1)\n\nScope: example.com web application\nDate: July 2026"
  }]
}

Report Includes

• Executive Summary (non-technical overview)
• Scope & Methodology
• Findings Matrix with CVSS 3.1 scores
• Detailed Technical Analysis per finding
• Proof of Concept code
• Remediation Recommendations with code examples
• Risk Matrix

FAQ

Is Nobody Pentest legal to use?

Yes, when used with proper authorization. Nobody Pentest is designed for authorized penetration testing, bug bounty programs, and security research. Always obtain written permission before testing any target.

What's the difference between nobody-pentest and nobody-pentest-reasoner?

nobody-pentest is optimized for fast, general-purpose testing. nobody-pentest-reasoner uses advanced reasoning for deeper analysis, 0-day research, and complex multi-step exploitation chains.

Can I use this for bug bounty programs?

Absolutely. Nobody Pentest is ideal for bug bounty hunters. It can quickly identify common vulnerabilities, generate PoCs, and produce professional reports for submission.

How does the 3-layer pipeline work?

Layer 1 (RECON) analyzes the target and creates a blueprint. Layer 2 (EXPLOIT) uses that blueprint to generate exploits. Layer 3 (REPORT) formats findings into a professional report. For multi-turn tool calls, the pipeline is bypassed to preserve context.

What's the daily quota?

Pro users have a 50,000 output token/day budget shared with web chat. The quota is enforced in real-time, including mid-stream cutoff for streaming responses.

Can I use my own API key for the backend?

Yes. If you have your own API key stored in your Nobody AI account, the router will use your key instead of the system key.

How do I integrate with Claude Code?

Install via pip, then add to Claude Code using the claude mcp add command:

pip install nobody-pentest-ultra
claude mcp add nobody-pentest -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"

Restart Claude Code and 86 security tools will be available automatically.