apex

Use Cases

Developers

• Run /pentest before merging a PR — catch vulnerabilities as naturally as running tests
• Get actionable findings with severity scores, evidence, and suggested fixes — no security background needed
• Integrate into CI/CD via headless CLI commands or Pensar Console

Security Engineers

• Deploy agent-driven swarm testing across large attack surfaces
• Use /operator mode for manual investigation, exploit chaining, and validation
• Automate repetitive testing workflows with persistent memory that accumulates across engagements
• Scale across teams and projects through Pensar Console

Installation

Method	Command
Quick Install (macOS/Linux)	curl -fsSL https://pensarai.com/install.sh | bash
Homebrew	brew tap pensarai/tap && brew install apex
npm	npm install -g @pensar/apex
Windows (PowerShell)	irm https://www.pensarai.com/apex.ps1 | iex

Usage

Open the Apex TUI:

pensar

Herdr

Apex automatically reports its state when launched inside Herdr. The sidebar shows working during a turn, blocked when approval, plan review, or answers are needed, and idle when Apex is ready for input. Terminal-attached CLI agent commands also report their activity. No plugin or additional Apex configuration is required.

Herdr 0.9.2 or later can restore the current conversation after a server restart. Keep pensar on your PATH; Apex supplies a resume command with the session ID, active model, and obfuscation setting. The saved session restores its operator mode and approval settings. Restored sessions wait for your next prompt.

You can also reopen a session directly:

pensar --resume <session-id>
pensar --resume <session-id> --model <model-id>

State reporting and release also work with older Herdr versions. Reports run in the background with a short timeout, and Herdr failures do not interrupt Apex.

Headless CLI

Run pentests without the TUI for scripting, CI, or evalgate integration:

# Basic pentest
pensar pentest --target https://example.com

# With extended thinking and task-driven mode
pensar pentest --target https://example.com --extended-thinking --task-driven

# Whitebox (with source code access)
pensar pentest --target https://example.com --cwd ./my-app

# Targeted pentest with specific objectives
pensar targeted-pentest --target https://example.com --objective "Test authentication bypass"

Flag	Command	Description
--target <url>	pentest, targeted-pentest	Target URL (required)
--cwd <path>	pentest	Source code path for whitebox mode
--mode <mode>	pentest	exfil for pivoting and flag extraction
--model <model>	pentest, targeted-pentest	AI model (default: auto-selected)
--extended-thinking	pentest	Enable extended thinking for supported models
--task-driven	pentest	Enable task-driven architecture (experimental)
--prompt <text|@file>	pentest	Custom guidance for the agent
--threat-model <text|@file>	pentest	Threat model to guide testing
--objective <text>	targeted-pentest	Testing objective (repeatable)

Ollama (local models)

Start Ollama with a model installed, then open /models and select it under Ollama (local). Apex discovers models automatically at startup and refreshes the list every five seconds, including when Ollama starts after Apex. No API key or manual endpoint setup is needed. Running models appear first.

Discovery uses http://127.0.0.1:11434 by default and honors OLLAMA_HOST. Headless commands accept --model-provider ollama --model <ollama-model-name> or --model ollama:<ollama-model-name>. Model names retain their full tags, including Hugging Face paths. Existing manual local endpoints remain separate.

Apex loads the selected model on the first request if needed, showing Loading model weights with a dedicated throbber. It then reads Ollama's allocated context before fitting the prompt or deciding whether to compact the conversation. Servers without context metadata use a conservative 4,096-token budget. Apex does not download models or override Ollama's idle-unload settings; model lifetime is managed by Ollama, independently of Apex sessions. Agent workflows require a model and Ollama template that support tool calls; discovery alone does not establish tool support.

Hoonify inference

Connect Hoonify in /providers or set HOONIFY_API_KEY, then select a discovered model in /models. Headless commands accept --model-provider hoonify --model <catalog-model-id>. See Hoonify setup for model discovery, token budgets, and live checks.

Inference.net

Connect Inference.net in /providers or set INFERENCE_API_KEY, then select DeepSeek V4.1 Flash 1017 Cyber in /models. This is the only Inference.net model currently available in Apex. Headless commands accept --model inference:deepseek-v4.1-flash-1017-cyber.

Your team needs approved model access before inference will succeed; saving a valid API key does not grant model access. Apex uses the provider's default reasoning behavior and the catalog limits of 1,040,000 context tokens and 393,216 output tokens.

Custom inference endpoints

Bring an OpenAI-compatible endpoint and bearer token through customProviders configuration or the APEX_CUSTOM_PROVIDERS worker environment variable. Select it with --model-provider <id> --model <model>, or choose its declared models in the operator's /models picker. See custom inference setup for GLM settings, headless job configuration, and a live connection test.

Web search

Use your own Exa API key for direct web search with any model provider:

export EXA_API_KEY=your-exa-api-key
pensar

You can also save the key as exaAPIKey in your existing ~/.pensar/config.json. If a Brave key is configured (BRAVE_API_KEY or braveAPIKey), Brave takes precedence; remove that key to use Exa. Without either search key, Apex uses the existing Pensar web-search gateway, which requires Pensar authentication. Exa errors are returned directly without switching providers.

Logging

Apex routes diagnostic/operational logging through a centralized structured logger (src/core/logger). It writes one-line JSON to stderr when output is not a TTY — keeping it separate from the program's stdout and easy to ship to a log pipeline (e.g. CloudWatch) — and pretty, colorized output in an interactive terminal. User-facing CLI/TUI output stays on stdout.

Set the level (most → least verbose: debug < info < warn < error, default info):

pensar pentest --target https://example.com --log-level debug   # or --verbose / --quiet
PENSAR_LOG_LEVEL=debug pensar ...                                # via environment
PENSAR_DEBUG=1 pensar ...                                        # back-compat alias for debug

Resolution order: CLI flag → PENSAR_LOG_LEVEL → PENSAR_DEBUG → default info. PENSAR_LOG_FORMAT=json|pretty forces the output format. When Apex runs as a managed agent, PENSAR_LOG_LEVEL is supplied by the host environment.

W&B Weave Tracing

Stream step-level agent traces to Weights & Biases Weave for analysis and fine-tuning:

export WANDB_API_KEY=your-key
export WANDB_ENTITY=your-entity
# WANDB_PROJECT defaults to "apex-traces"
pensar pentest --target https://example.com

Traces include reasoning steps, tool calls, token usage, and state checkpoints. When credentials are not set, tracing is silently disabled.

OpenTelemetry (Observability)

Apex emits OpenTelemetry spans for agent runs, LLM calls, and tool executions through @opentelemetry/api. Spans are no-ops unless your process registers an OpenTelemetry SDK as the global tracer provider; Apex ships no SDK.

Register an SDK before importing Apex code:

• Sentry: install @sentry/node ≥ 9.27 and add Sentry.vercelAIIntegration() to your Sentry.init integrations.
• Any OTel backend (Honeycomb, Tempo, Datadog, etc.): register @opentelemetry/sdk-node with an OTLP exporter.

Spans follow OTel GenAI semantic conventions. Only span shape (model, token counts, latency, tool names) is captured by default; set AI_TRACE_RECORD_PAYLOADS=true to also record prompts, tool I/O, and outputs.

Kali Linux Container (Optional)

For best performance, run Apex in the included Kali Linux container with preconfigured pentest tools:

cd container
cp env.example .env  # add your API keys
docker compose up --build -d
docker compose exec kali-apex bash

Inside the container, run:

pensar

---

⚠️ Responsible Use

This repository contains tools for authorized security testing only. Before use, please read and agree to the Responsible Use Disclosure.