Freedom251 › Penetration Testing Software

Pentographer

Free plan APILinuxSelf-hostedWeb

What Pentographer is

Pentographer is an open-source platform for managing security assessments, including findings, playbooks, evidence, and client reports. Findings can carry CVSS scores, risk and status tracking, attached evidence, version history, and links to playbook items. Teams can build reusable checklists around OWASP, PTES, or their own framework; OWASP Top 10 (2021) is included. Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with a review step before saving. This AI assistance requires the user's own Anthropic API key. Pentographer creates branded reports with customizable templates and executive summaries, and exports to Word or PDF. Team workspaces include owner, admin, member, and viewer roles, with viewers limited to read-only access. Its GraphQL API supports work with projects, findings, and playbooks, while an MCP server connects with Claude Desktop, Cursor, and other compatible clients using API-key authentication. Pentographer is offered free as a cloud service or MIT-licensed self-hosted software. Self-hosting requires Node.js 20+ and PostgreSQL; evidence can be stored locally or in S3-compatible storage. Desktop apps for Mac, Windows, and Linux are listed as coming soon.

Who it suits

Pentographer suits security assessment teams that need to manage findings, evidence, playbooks, and reports. Its free cloud and self-hosted options may suit teams with different deployment needs.

What it does well

Free cloud and self-hosted plans.
Includes OWASP Top 10 (2021) playbook.
Exports branded reports to Word and PDF.
Supports team roles, including read-only viewers.
Self-hosting is MIT-licensed.

What to know first

AI assistance requires your own Anthropic API key.
Self-hosting requires Node.js 20+ and PostgreSQL.
Desktop apps are listed as coming soon.

Plans

Plan	Billed and limits	Price
Self-hosted	All features · MIT-licensed · Node.js 20+ · PostgreSQL	Free
Cloud	All features · no credit card required	Free

As pentographer.com lists them, read 8 Oct 2026. The maker's own page has the final word.

Getting started

Visit https://www.pentographer.com/
Choose the free cloud plan or the self-hosted plan.
For self-hosting, provide Node.js 20+ and PostgreSQL.
Use Pentographer on the web, Linux, or through its API.
For AI assistance, bring an Anthropic API key.

Verdict

Pentographer covers assessment tracking through report creation, with cloud and self-hosted deployment options. Teams considering AI drafting should account for the separate Anthropic API key requirement.

Questions

Is Pentographer free?

Yes. The Cloud plan is free and requires no credit card; the Self-hosted plan is also free.

Is Pentographer open source?

Yes. Its self-hosted software is MIT-licensed.

What does self-hosting require?

The Self-hosted plan lists Node.js 20+ and PostgreSQL. Evidence can be stored on the local filesystem or S3-compatible storage.

Which platforms are available?

Pentographer lists API, Linux, self-hosted, and web. Mac, Windows, and Linux desktop options are described as coming soon.

Does AI assistance require a separate key?

Yes. AI drafting uses your own Anthropic API key, and a review pass is required before saving a draft.

What report formats can Pentographer export?

Pentographer supports Word and PDF exports, with branded reports, customizable templates, and executive summaries.

Facts from Pentographer's own pages

AI drafting: Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with a review pass before saving. · pentographer.com, 8 Oct 2026
AI integrations: The MCP server supports Claude Desktop, Cursor, and other MCP-compatible clients, with API-key authentication. · pentographer.com, 8 Oct 2026
AI key requirement: The features page says users can bring their own Anthropic API key for AI assistance. · pentographer.com, 8 Oct 2026
API: Pentographer exposes a GraphQL API for querying and updating projects, findings, and playbooks; authenticated access is required for schema operations. · pentographer.com, 8 Oct 2026
Desktop availability: The features page lists a Mac, Windows, and Linux desktop option as coming soon. · pentographer.com, 8 Oct 2026
Finding management: Findings support CVSS scores, risk and status tracking, evidence attachments, version history, and links to playbook items. · pentographer.com, 8 Oct 2026
Playbooks: Users can build reusable checklists mapped to OWASP, PTES, or their own framework, and the site lists OWASP Top 10 (2021) as built in. · pentographer.com, 8 Oct 2026
Product: Pentographer is an open-source platform for managing security assessments, including findings, playbooks, evidence, and client reports. · pentographer.com, 8 Oct 2026
Reports: Pentographer generates branded reports and supports Word and PDF exports, with customizable templates and executive summaries. · pentographer.com, 8 Oct 2026
Self-hosting and privacy: The features page describes MIT-licensed self-hosting, says there is no telemetry or data leaving the network, and lists PostgreSQL as its external dependency. · pentographer.com, 8 Oct 2026
Storage options: Self-hosted evidence can use local filesystem or S3-compatible storage. · pentographer.com, 8 Oct 2026
Support and documentation: The maker provides a knowledge base with guides for cloud setup, self-hosting, reporting, AI, API access, and workspace administration. · pentographer.com, 8 Oct 2026
Team access: Team workspaces provide owner, admin, member, and viewer roles, including read-only access for viewers. · pentographer.com, 8 Oct 2026

Where Pentographer stands on Freedom251

Penetration Testing Software#12 of 34