She doesn't answer questions about pentests.
She runs them.
Lorikeet Security is an AI-native services company, and Lory is the pentester at the middle of it. She takes a signed scope, runs recon, picks her own attack vectors, validates exploits, chains them, captures evidence and drafts the finding. Then a human pentester countersigns it before you ever see it.
Lory is not one product.
She runs engagements in our platform, she runs on hosts inside your network, she plugs into the AI tools your own team already uses — and she still talks.
The AI pentester
An autonomous engine that plans, exploits and reports across web, API, network, cloud and identity.
How an engagement runs → 02 / lk-exporterThe in-network agent
An open-source host sensor Lory drives from inside your perimeter. Patch state, services, supply chain.
Meet lk-exporter → 03 / mcpYour agents, our data
Point Claude — or any MCP client — at your findings, assets, compliance posture and knowledge base.
Connect a client → 04 / chatThe part you knew
She still explains findings, scopes work, books calls and answers at 2am. It's just no longer the headline.
Ask her something →One engagement, start to signed.
This is the actual shape of a Lory run — the same stages that show up in the log, in the same order. Nothing here is a metaphor for something else.
Scope is a gate, not a suggestion
You declare targets and sign the rules of engagement in the portal. Every single tool call is checked against that allowlist first — scope_check runs before anything touches a host, and an out-of-scope target is never contacted. Pick a depth: surface, standard or deep.
Deterministic sweep
Before any judgement calls, a fixed sweep establishes ground truth: DNS, live HTTP surface, service fingerprints, open ports, a screenshot. Same inputs, same output, every run — so the interesting part starts from facts rather than guesses.
One focused pass per attack vector
The orchestrator picks the vectors that apply to what it just found, ranks them by offensive impact, and gives each one its own pass with its own budget. SQLi gets a pass. IDOR gets a pass. SSRF gets a pass. Each pass loads the matching playbook and works only that angle — no thin, scattered coverage.
Validate, then chain
A signal isn't a finding. Lory proves it, screenshots it, and looks for what it unlocks — SSRF into instance metadata into cloud credentials into production data. Findings land with evidence, a CWE, and a mapping to the compliance controls they break.
A human signs, or it doesn't ship
Everything Lory writes lands in pending_review and stays invisible to you until a Lorikeet pentester reads the evidence and approves it. Risk rating, exploitation judgement, executive summary and final sign-off are ours. This is the part we won't automate.
The tools she can actually reach.
Lory isn't given a shell. She gets a fixed, sandboxed toolbelt with typed arguments, and every call is scope-checked and written to the engagement log. Here is the whole list — there is no tenth tool.
| Tool | Stage | What it does |
|---|---|---|
| scope_check | gate | Resolves a target against the signed allowlist. Returns a hard yes or no; a no ends the call there. |
| dns_recon | recon | Records, resolution and hosting facts for declared assets only — no subdomain enumeration, no drifting off scope. |
| http_probe | recon | Requests a path with chosen method, headers and body. The workhorse for anything request-shaped. |
| content_fetch | recon | Pulls and reads a response body — JS bundles, API docs, error pages — to find the next thing worth testing. |
| port_scan | recon | nmap against in-scope hosts for listening services and versions. |
| web_fingerprint | recon | httpx-based stack identification: server, framework, CDN, headers, TLS. |
| nuclei_scan | test | Templated checks for known-vulnerable versions and exposures — the fast, boring, necessary layer. |
| sqlmap_probe | test | Confirms injection where a manual probe suggested it, so a maybe becomes a demonstrated yes. |
| screenshot | evidence | Captures the proof frame that ends up attached to the finding in your report. |
Six more tools appear only when you deploy the agent. With lk-exporter running inside your network, Lory can also call agent_discover_hosts, agent_scan_host, agent_grab_banner, agent_check_web_endpoint, agent_run_nmap_script and agent_dns_lookup — executed locally, behind your perimeter. See how that works.
57 playbooks, loaded one at a time.
Lory doesn't carry a single giant prompt. Each attack class is a written playbook — methodology, payloads, false-positive traps, what proof looks like — and she pulls exactly the one the current pass needs. Depth per vector instead of a checklist skimmed thin.
Web
27- sqli · ssrf · ssti · rce
- idor · business-logic
- deserialization · xxe
- request-smuggling · cache
- prototype-pollution
- graphql · websockets
- + 14 more
Authentication
14- oauth · saml · jwt
- webauthn · mfa · mtls
- session-management
- account-recovery
- ntlm · ldap · legacy-sso
- + 5 more
Network
3- network-layer
- network-services
- internal-agent-recon
Identity & AD
1- active-directory
Cloud
1- cloud · IAM · metadata
Mobile
1- mobile (iOS & Android)
AI systems
1- ai-security
Code & supply chain
2- source-review
- supply-chain
Recon
2- osint
- osint-methodology
Operating rules
5- rules-of-engagement
- operator-identity
- findings-format
- reporting · fast-checking
Behind the playbooks sits a 1,969-entry vulnerability knowledge base built from OWASP ASVS, WSTG and Top 10, plus MITRE CWE and CAPEC — searched during enrichment so findings arrive with real remediation guidance, not a generated paragraph.
We'll also tell you what she didn't test.
Every AI security tool shows you what it found. The harder number is what it never got to. Each engagement emits a coverage record: vectors planned, vectors that ran, and vectors cut short by the time or token ceiling — with the reason attached.
If a run stops two vectors short, that's in your engagement record and your pentester sees it before sign-off. You can raise the depth and rerun. What you can't do is mistake an unfinished run for a clean one.
And she works inside your network.
Internal assessment is normally episodic: someone connects, runs a profile, leaves, and the network drifts unseen until next year. lk-exporter is our open-source answer to that — a per-host sensor that runs unattended, tracks what changed, and that Lory can drive live over MCP during an engagement.
- what it is
- A Python agent you install on a host, not an appliance. It knows that machine deeply; network-wide recon stays Lory's job.
- what it collects
- Open ports and service versions, OS patch level and installed packages mapped to CVEs, EOL software, full inventory with drift, and a supply-chain crawl — npm manifests checked against OSV and known-malicious packages.
- how it reports
- Outbound only. The agent opens every connection; the platform never reaches into your network. Findings are fingerprinted, so the same issue never floods your queue — and when it stops appearing, it auto-closes.
- how Lory uses it
- Over MCP. Mid-engagement she can trigger a collection cycle on a host she's interested in and read the results in the same reasoning loop — plus six relay tools that execute locally behind your perimeter.
- licence
- MIT. Read it, audit it, fork it. Running it standalone needs no platform account at all — findings print as JSON straight to stdout for your SIEM.
# install on the host you want watched pip install lorikeet-security-agent-exporter # scope is an allowlist. nothing runs without it. lk-exporter validate --config config.yaml # continuous collection + MCP, so Lory can drive it lk-exporter run --agent-mode ▸ scope 10.0.4.0/24 (254 addrs) ▸ modules discovery patch inventory posture ▸ transport outbound TLS → platform ▸ mcp stdio · 8 tools exposed ▸ cycle 41 12 findings · 3 new · 2 auto-closed
Standalone mode needs no platform at all. Point it at nothing and it prints normalized findings to stdout — pipe them wherever you already send security events.
Bring your own agent.
Being AI-native cuts both ways. Your security program shouldn't be locked behind our UI, so we expose it over the Model Context Protocol — point Claude, Claude Code, or anything else that speaks MCP at your own workspace and ask it questions in your own words.
- read
- Findings and their full detail, asset inventory, compliance frameworks and control status, and the 1,969-entry vulnerability knowledge base.
- write
- One write action: request a retest on a finding you've fixed. Writing into your findings is deliberately not exposed to customer credentials.
- boundaries
- Every call is authenticated and hard-scoped to the company that owns the credential. There is no cross-tenant read. Anything touching a concrete asset is checked against your scope rules first.
- auth
- OAuth 2.1 with dynamic client registration for Claude.ai and Desktop, or a workspace API token for everything else.
{
"mcpServers": {
"lorikeet": {
"type": "http",
"url": "https://lorikeetsecurity.com/ptaas/mcp/",
"headers": {
"Authorization": "Bearer <your-token>"
}
}
}
}
She still talks, obviously.
Ask what a pentest costs, what your SOC 2 evidence needs to cover, or what a finding in your report actually means. Signed in, she goes further — pulling your live findings, drafting an executive summary, scoping an engagement, or booking time with a human when you'd rather have one.
Prepaid credits. No seats.
Load a balance and Lory draws from it as she works. $1 buys 1 credit, MCP tool calls cost 0.1 credit, and engagements bill by depth. Credits gate the start of a run, so nothing begins that you haven't funded.
- ≈ 1,000 MCP tool calls
- Your first scoped engagement
- Every finding human-reviewed
- ≈ 2,500 MCP tool calls
- Multi-target, multi-stage chains
- Compliance-mapped reporting
- ≈ 5,000 MCP tool calls
- Room for deep, long-running runs
- Full vector coverage at depth
- ≈ 10,000 MCP tool calls
- Program-level, ongoing testing
- Priority human review
The things people actually ask.
No, and the workflow makes that structural rather than a promise. Everything Lory writes lands in a review queue and is invisible to you until a Lorikeet pentester reads the evidence and approves it. She covers volume — recon, validation, chaining, first-draft write-ups, round the clock. Scoping, exploitation judgement, risk rating and the final report are ours.
A scanner runs a fixed template set and hands you a list of maybes. Lory picks her attack vectors from what she found on your system, loads the matching playbook, proves the issue, and then looks for what it unlocks. The output is a demonstrated path with captured evidence, not raw signal you still have to triage.
Scope is enforced in code, not policy. Every tool call resolves its target against your signed allowlist before it executes, and an out-of-scope host is never contacted. Destructive tooling isn't in the toolbelt, a pentester oversees the run, and the full log of what was attempted is yours to read afterwards.
For external testing, no — Lory runs entirely in the Lorikeet portal, and you can scope a run and have her starting recon the same day. For internal network testing you deploy lk-exporter on the hosts you want covered: one pip install, an allowlist, and it reports outbound only.
You're told. Every engagement records the vectors it planned, the ones it ran, and the ones it never reached because the time or token ceiling hit first. That record reaches your pentester before sign-off and reaches you in the engagement view. Raise the depth and rerun to close the gap.
Yes. The MCP server exposes your findings, assets, compliance posture and knowledge base to any MCP client — Claude, Claude Code, or your own. Auth is OAuth 2.1 or a workspace token, scopes are per-token, and access is hard-limited to your own company's data.
It's prepaid and usage-based — no subscription, no seat licences. Load credits ($1 = 1 credit), and Lory draws down as she works: 0.1 credit per MCP tool call, and engagements billed by depth. Preset packs run $100–$1,000, or set any custom amount from $25 to $25,000 in the billing tab.
Scope one engagement and see what she finds.
No waitlist and no separate contract — the AI pentester is live in the portal today. Book thirty minutes and we'll scope your first run together. And if you'd rather skip the AI entirely, our pentesters will run it by hand. That option never goes away.