From af1bf049aff68037e84b34d3b2c12d05d35720af Mon Sep 17 00:00:00 2001 From: "Mason Kim(ZINUS US_SALES)" Date: Wed, 15 Apr 2026 16:15:21 -0400 Subject: [PATCH 1/2] docs: add first-use guide after login Signed-off-by: Mason Kim(ZINUS US_SALES) --- README.md | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/README.md b/README.md index 7ddc15ba..426964ca 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ - [Architecture](#architecture) - [Agent Supervision](#advanced-agent-supervision) - [Quick Start](#quick-start) +- [How to Use PentAGI After Login](#how-to-use-pentagi-after-login) - [API Access](#api-access) - [LLM Provider Configuration](#custom-llm-provider-configuration) - [Ollama](#ollama-provider-configuration) @@ -937,6 +938,60 @@ The `ASSISTANT_USE_AGENTS` setting affects the initial state of the "Use Agents" Note that users can always override this setting by toggling the "Use Agents" button in the UI when creating or editing an assistant. This environment variable only controls the initial default state. +## How to Use PentAGI After Login + +Once the stack is running and you can sign in to the web UI, the fastest way to start is through the Flows workflow. + +### 1. Create your first flow + +1. Open **Flows** in the sidebar. +2. Click **New Flow**. +3. Choose the mode that fits your goal: + - **Automation**: fully autonomous execution for a testing goal you want PentAGI to carry out end-to-end + - **Assistant**: interactive back-and-forth help when you want to steer the investigation step by step +4. Select the LLM provider you want to use for this flow. +5. Describe the target and the objective in natural language in the message box. + +Good first prompts usually include: + +- the target system or URL +- the type of assessment you want +- any scope limitations or rules of engagement +- the result you expect, such as a vulnerability report or validation of a hypothesis + +Example: + +```text +Assess https://target.example for common web application vulnerabilities. Focus on authentication, file handling, and injection issues. Stay within the provided target only and summarize confirmed findings with reproduction steps. +``` + +### 2. Use templates for repeatable workflows + +The new flow form includes a template picker, which can prefill the message box with a saved flow template. This is useful when you run similar assessments repeatedly. + +- Use an existing template if you already have one saved in **Templates** +- Start from the example prompt in [`examples/prompts/base_web_pentest.md`](examples/prompts/base_web_pentest.md) if you need a practical baseline for web testing +- Adjust the target, scope, and constraints before starting the flow + +Templates are starting points. You do not need special syntax to use PentAGI: plain natural-language instructions work well as long as the target and goal are clear. + +### 3. Monitor execution and review output + +After submitting the flow, PentAGI opens the flow page automatically. + +- Use the main flow view to follow messages, agent activity, and task progress +- Inspect tool activity and terminal output as the flow runs +- Review generated tasks and subtasks to understand what PentAGI is doing + +Once the flow has enough results, use the **Report** menu on the flow page to: + +- open the report in a web view +- copy the generated report to the clipboard +- download the report as Markdown +- download the report as PDF + +For early testing, start with a narrow target and a single clear objective. This makes the output easier to review and helps you refine your prompts before running larger assessments. + ## API Access PentAGI provides comprehensive programmatic access through both REST and GraphQL APIs, allowing you to integrate penetration testing workflows into your automation pipelines, CI/CD processes, and custom applications. From a07c28c2aea11870e58ecafa3e35bc78d016621a Mon Sep 17 00:00:00 2001 From: "Mason Kim(ZINUS US_SALES)" Date: Wed, 15 Apr 2026 17:52:16 -0400 Subject: [PATCH 2/2] docs: add authorized-use reminder Signed-off-by: Mason Kim(ZINUS US_SALES) --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 426964ca..dc94d72e 100644 --- a/README.md +++ b/README.md @@ -965,6 +965,8 @@ Example: Assess https://target.example for common web application vulnerabilities. Focus on authentication, file handling, and injection issues. Stay within the provided target only and summarize confirmed findings with reproduction steps. ``` +Only test systems you own or are explicitly authorized to assess. See [EULA.md](EULA.md) for the acceptable use requirements. + ### 2. Use templates for repeatable workflows The new flow form includes a template picker, which can prefill the message box with a saved flow template. This is useful when you run similar assessments repeatedly.