Developer andrearitossa has released PentestCanvas, a local investigation workspace designed to streamline penetration testing through an agent-powered interface. The tool, showcased on Hacker News, combines a visual investigation canvas with sandboxed terminals and recorded tests to maintain traceable evidence throughout the security assessment process. Currently operating as a single-user desktop prototype, it aims to bridge the gap between raw command-line output and structured reporting by keeping proof embedded directly within test cases.

The Visual Investigation Canvas

The core of PentestCanvas is its node-based canvas, which automatically arranges investigation steps horizontally from host enumeration to discovered endpoints and final findings. Users can paste enumeration results into a 'Discover surfaces' feature, selecting specific ports or services to become targets. The system tracks dependencies, where tests started from a specific access record inherit it as a prerequisite, and prevents the removal of tests that own critical evidence. This structure ensures that every finding is linked back to its source command, output, and environment, creating a chain of custody for the assessment.

Agent Integration and Security Boundaries

While the project title references 'Claude and Kali,' the source documentation explicitly details integration with the OpenAI Codex CLI for optional agent assistance. The agent can inspect and update canvas nodes, capture exact excerpts, and record runs, but it requires an explicit API key and does not automatically attribute arbitrary terminal commands to recorded tests. Security is enforced at the desktop level, with the Electron main process holding fresh credentials for every HTTP route and terminal WebSocket. The application rejects foreign origins and blocks external navigation, ensuring that the local instance remains isolated from external network threats unless explicitly configured.

Evidence Management and Reporting

PentestCanvas treats evidence as immutable, assigning a SHA-256 fingerprint to every captured excerpt. Users can select useful output from a test run, keep it as evidence, and attach it to a finding with descriptions of impact and remediation. The report view automatically updates with reviewed findings, allowing for export in Markdown or PDF formats. However, the tool is clear about its limitations: it is not yet a large artifact repository, with a 12 MB API body limit for inline files, and it does not manage release snapshots or DOCX exports.

Key Takeaways

  • PentestCanvas is a local, single-user Electron app that visualizes pentest workflows from target to report.
  • It integrates with OpenAI's Codex CLI for agent-assisted testing, though the main workflow functions without API calls.
  • Evidence is cryptographically fingerprinted (SHA-256) and embedded within test nodes to ensure traceability.
  • The tool enforces strict security boundaries, including sandboxed renderers and credential-scoped agent access.

The Bottom Line

PentestCanvas offers a compelling structured approach to pentest documentation, but its reliance on Codex rather than the headline's implied Claude integration highlights a disconnect between marketing and reality. For testers drowning in unstructured terminal output, the enforced evidence chain is a genuine productivity win.