---
title: "Nythera — Autonomous Pentest Agent That Validates Findings"
description: "Nythera: an open-source autonomous pentest platform by Shreyansh Kumar Singh that validates every finding with evidence before reporting it."
url: https://www.shreyanshkumarsingh.com/projects/nythera-ai-penetration-testing-agent
author: Shreyansh Kumar Singh
updated: 2026-10-08
---

# Nythera: autonomous penetration testing that proves every finding

By Shreyansh Kumar Singh. Open source. Authorized testing only.

**How do autonomous penetration-testing tools avoid reporting false positives?**

Nythera avoids false positives by refusing to report anything it can't prove: every active finding needs physical evidence — a database error signature, an unencoded reflected payload, real command output, a file signature, or evaluated template math — or it's discarded, not downgraded. It's an open-source, MIT-licensed scanner for in-house web applications, with internal-network scanning switched off by default.

- **Vulnerability classes:** 9, all validated
- **Workflow phases:** 7 (PTES-style)
- **Internal-network mode:** Off by default
- **CI gate:** Exit code 2 at/above --fail-on severity
- **Stack:** Python · FastAPI · async HTTP · SSE · optional LLM agent · Docker
- **License:** MIT

## The problem it solves

Automated scanners are noisy. A report with forty 'possible' findings teaches a team to ignore the report — and the one real vulnerability goes with it. At the same time, the most useful place to scan is the one most scanners can't reach: behind the login, on internal hosts.

## What he built

### A seven-phase, PTES-style workflow

Reconnaissance (headers, cookies, TLS, tech disclosure) → attack-surface mapping (an in-scope crawler for endpoints, forms and parameters, plus content discovery) → API import (OpenAPI/Swagger and GraphQL introspection) → active exploitation → access-control testing (authenticated vs anonymous) → an optional LLM agent deep-dive → reporting with OWASP and CWE mapping.

### Nine validated vulnerability classes

SQL injection (error signatures + boolean inference), reflected XSS, OS command injection, path traversal / LFI, server-side template injection, open redirect, broken access control, GraphQL introspection exposure, and security misconfiguration — each confirmed by its own evidence signature.

### Built for in-house applications

Authenticated scanning (Bearer, cookie, custom headers, HTTP Basic), self-signed TLS, host-locked scope with include/exclude rules and a request rate limiter. A live FastAPI dashboard streams phases and findings over Server-Sent Events; a headless CLI exits with code 2 when a finding meets a severity threshold, so it can gate a CI/CD pipeline.

## The hardest decision: Make the dangerous capability opt-in

Scanning localhost, private IP ranges and internal hosts is exactly what makes Nythera useful for in-house testing — and exactly what makes it dangerous if it's pointed somewhere it shouldn't be. So internal mode is off by default and has to be switched on explicitly; requests stay host-scoped; private hosts are refused unless internal mode is on; and every scan requires an authorization confirmation first.

The same principle governs the LLM agent: it's an optional phase that reasons about the target and probes further, never a replacement for the validated checks underneath it.

## The result

Reports a team can act on: deduplicated findings with severity, evidence, remediation and OWASP/CWE mapping, exportable as HTML or JSON — and a CI gate that fails a build only on proven issues.

## Research findings

- **A finding is not a finding until it is confirmed:** Every active check needs physical evidence — a DB error signature, a reflected payload, real command output — or it's discarded, not downgraded.
- **The dangerous capability is the one you default to off:** Internal-network scanning is a separate, explicitly authorized switch, host-locked with include/exclude rules and a rate limiter in front.

Stack: Python, Async HTTP, LLM agent loop, Docker

- [Source on GitHub](https://github.com/Shreyanskumarsingh20/Nythera)

---

Shreyansh Kumar Singh — AI & Full-Stack Engineer, Pune, India. Contact: shreyanshkumarsingh208@gmail.com or https://www.shreyanshkumarsingh.com/contact (call and WhatsApp buttons). More: https://www.shreyanshkumarsingh.com/llms.txt · https://www.shreyanshkumarsingh.com/sitemap.xml