An AI pentester that runs the whole engagement.
A human signs the report.

What auditors require is independent testing by a qualified third party, documented, and that's satisfied by the Lorikeet pentester who scopes the run and signs the report, not by Lory herself. She's how the work gets done; the attestation is ours. Reports carry scope, methodology, severity ratings, remediation guidance and retest status in the format CPA firms and certification bodies already accept, plus a control mapping section: Trust Service Criteria for SOC 2, Annex A for ISO 27001. If your auditor wants to talk to a human about methodology, they get one.

A quote inside 24 hours, and recon starts the same day you sign the scope. There's no waiting on a tester's calendar, because Lory doesn't have one. Depth sets how long the run takes; human review and the write-up follow. The honest constraint isn't the testing, it's the fixing: auditors want to see findings remediated and retested, so scope early enough to close what she finds. For an ISO 27001 Stage 2 we'd still say test two to three months out.

It's prepaid and usage-based, with no subscription and no seat licences. Load credits ($1 = 1 credit), and Lory draws down as she works: 0.1 credit per MCP tool call, and engagements billed by depth. Preset packs run $100–$1,000, or set any custom amount from $25 to $25,000 in the billing tab.

No, and the workflow makes that structural rather than a promise. Everything Lory writes lands in a review queue and is invisible to you until a Lorikeet pentester reads the evidence and approves it. She covers volume: recon, validation, chaining, first-draft write-ups, round the clock. Scoping, exploitation judgement, risk rating and the final report are ours.

A scanner runs a fixed template set and hands you a list of maybes. Lory picks her attack vectors from what she found on your system, loads the matching playbook, proves the issue, and then looks for what it unlocks. The output is a demonstrated path with captured evidence, not raw signal you still have to triage.

Scope is enforced in code, not policy. Every tool call resolves its target against your signed allowlist before it executes, and an out-of-scope host is never contacted. Destructive tooling isn't in the toolbelt, a pentester oversees the run, and the full log of what was attempted is yours to read afterwards.

You're told. Every engagement records the vectors it planned, the ones it ran, and the ones it never reached because the time or token ceiling hit first. That record reaches your pentester before sign-off and reaches you in the engagement view. Raise the depth and rerun to close the gap.

For external testing, no. Lory runs entirely in the Lorikeet portal, and you can scope a run and have her starting recon the same day. Internal network testing needs one thing: the Lory Mesh connector, installed with a single command on one machine inside the network you want tested. It opens an outbound encrypted connection for the life of the engagement, so no inbound port is exposed and there is no appliance to rack. Separately, our MIT-licensed lk-exporter agent can sit on individual hosts to report patch state, inventory and supply-chain posture, but it is not what internal testing runs on.

Yes. The MCP server exposes your findings, assets, compliance posture and knowledge base to any MCP client: Claude, Claude Code, or your own. Auth is OAuth 2.1 or a workspace token, scopes are per-token, and access is hard-limited to your own company's data.

Rather than running a monolithic linear scan, Lory orchestrates four specialized agent personas collaborating over an asynchronous blackboard bus: a Recon Specialist (perimeter discovery and port sweeps), a Web & API Infiltrator (deep business logic, IDOR, and injection), an Infrastructure & Cloud Hunter (IAM privilege escalation and lateral movement), and a Triage & Validation Agent (PoC verification, OAST confirmation, and compliance mapping). Dynamic model routing tiers model complexity per task, optimizing speed and reducing token cost by 60–80%.

Yes. We provide an official GitHub Action and a standalone POSIX script (lorikeet-ci.sh) compatible with GitLab CI, CircleCI, and Bitbucket. You can configure a security threshold (e.g., --fail-on high), so if Lory discovers a high or critical finding during the pull request delta run, the build fails before code can merge into production. Findings are exported directly as standard SARIF v2.1.0 files to populate GitHub Code Scanning alerts.

For every confirmed vulnerability, Lory generates a 1-click reproduction pack for your engineering team. This includes a ready-to-run cURL command with escaped parameters and headers, a standalone Python 3 verification script with automated confirmation heuristics, an importable Postman Collection v2.1 JSON schema, and an RFC 7230 .http request. Developers can reproduce and verify the flaw in seconds in their own local environment without guessing.

Lory includes an automated dynamic mobile instrumentation engine powered by Frida (LoryFridaHarness). When testing iOS or Android apps, Lory generates custom Frida hooks on the fly to bypass SSL certificate pinning (for OkHttp 3/4, Conscrypt, TrustManager, and SecTrustEvaluateWithError), evade root and jailbreak detection, and monitor live cryptographic memory (intercepting AES keys, IVs, and decrypted payload buffers in real-time).

Once developers fix a vulnerability, you don't need to re-run the entire pentest. Lory's surgical retest engine replays the exact non-destructive verification payload against the specific finding in seconds. When integrated with Jira Software or Linear, marking a ticket "Resolved" automatically sends a webhook to Lory to trigger a surgical retest. When our human pentester confirms closure, the ticket status updates automatically.