Skip to content
SPECIFICTION
Get listed

Pentographer

pentographer.com

Free plan WebLinuxAPISelf-hosted
Visit pentographer.com
Spec score 7.5 #22 of 34 in Penetration Testing Software

What it is

Pentographer is an open-source platform for managing security assessments, from findings and evidence through client reports. Findings can carry CVSS scores, risk and status tracking, evidence attachments, version history, and playbook links. Users can build reusable checklists mapped to OWASP, PTES, or their own framework; OWASP Top 10 (2021) is built in. Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with review required before saving and an Anthropic API key required. Pentographer creates branded reports with customizable templates and executive summaries, exporting to Word and PDF. Team workspaces provide owner, admin, member, and viewer roles, including read-only viewers. A GraphQL API handles projects, findings, and playbooks, while an MCP server supports Claude Desktop, Cursor, and compatible clients. Free cloud and MIT-licensed self-hosted plans are listed; self-hosting requires Node.js 20+ and PostgreSQL.

Spec sheet

Product
Pentographer is an open-source platform for managing security assessments, including findings, playbooks, evidence, and client reports.Read 8 Oct 2026 · pentographer.com
API
Pentographer exposes a GraphQL API for querying and updating projects, findings, and playbooks; authenticated access is required for schema operations.Read 8 Oct 2026 · pentographer.com
AI drafting
Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with a review pass before saving.Read 8 Oct 2026 · pentographer.com
AI integrations
The MCP server supports Claude Desktop, Cursor, and other MCP-compatible clients, with API-key authentication.Read 8 Oct 2026 · pentographer.com
AI key requirement
The features page says users can bring their own Anthropic API key for AI assistance.Read 8 Oct 2026 · pentographer.com
Desktop availability
The features page lists a Mac, Windows, and Linux desktop option as coming soon.Read 8 Oct 2026 · pentographer.com
Finding management
Findings support CVSS scores, risk and status tracking, evidence attachments, version history, and links to playbook items.Read 8 Oct 2026 · pentographer.com
Playbooks
Users can build reusable checklists mapped to OWASP, PTES, or their own framework, and the site lists OWASP Top 10 (2021) as built in.Read 8 Oct 2026 · pentographer.com
Reports
Pentographer generates branded reports and supports Word and PDF exports, with customizable templates and executive summaries.Read 8 Oct 2026 · pentographer.com
Self-hosting and privacy
The features page describes MIT-licensed self-hosting, says there is no telemetry or data leaving the network, and lists PostgreSQL as its external dependency.Read 8 Oct 2026 · pentographer.com
Storage options
Self-hosted evidence can use local filesystem or S3-compatible storage.Read 8 Oct 2026 · pentographer.com
Support and documentation
The maker provides a knowledge base with guides for cloud setup, self-hosting, reporting, AI, API access, and workspace administration.Read 8 Oct 2026 · pentographer.com
Team access
Team workspaces provide owner, admin, member, and viewer roles, including read-only access for viewers.Read 8 Oct 2026 · pentographer.com

Plans and prices

Cloud Free All features · no credit card required Read 8 Oct 2026 · pentographer.com
Self-hosted Free All features · MIT-licensed · Node.js 20+ · PostgreSQL Read 8 Oct 2026 · pentographer.com

Every Pentographer plan and price →

Strong points and limits

Strong points

  • Findings support CVSS, evidence, status, and history
  • Playbooks map to OWASP, PTES, or custom frameworks
  • Exports branded reports to Word and PDF
  • Role-based team workspaces include read-only viewers
  • Free cloud and MIT-licensed self-hosted options

Limits

  • AI assistance requires your own Anthropic API key
  • Self-hosting requires Node.js 20+ and PostgreSQL
  • GraphQL schema operations require authentication
  • Desktop apps are listed as coming soon

Who it suits

It suits security teams that need structured findings, reusable assessment playbooks, evidence handling, and branded reports. It also fits organizations wanting free cloud access or self-hosting without telemetry.

Verdict

Pentographer covers the assessment workflow from checklist and evidence management to reviewed AI drafting and report export. Its free deployment choices and self-hosting model suit teams that can provide the required infrastructure and AI credentials.

Where Specifiction places it

Alternatives to PentographerAll alternatives →