She doesn't answer questions about pentests.
She runs them.
Lorikeet Security is an AI-native services company, and Lory is the pentester at the middle of it. She takes a signed scope, runs recon, picks her own attack vectors, validates exploits, chains them, captures evidence and drafts the finding. Then a human pentester countersigns it before you ever see it.
Lory is not one product.
She runs engagements in our platform, she reads your source, she runs on hosts inside your network, she plugs into the AI tools your own team already uses — and she still talks.
The AI pentester
An autonomous engine that plans, exploits and reports across web, API, network, cloud and identity.
How an engagement runs → 02 / code securityIn your terminal
An open-source TUI that pulls your findings into the repo, traces the lines responsible and files the retest.
Meet lory-code-security → 03 / lk-exporterThe in-network agent
An open-source host sensor Lory drives from inside your perimeter. Patch state, services, supply chain.
Meet lk-exporter → 04 / mcpYour agents, our data
Point Claude — or any MCP client — at your findings, assets, compliance posture and knowledge base.
Connect a client → 05 / chatThe part you knew
She still explains findings, scopes work, books calls and answers at 2am. It's just no longer the headline.
Ask her something →One engagement, start to signed.
This is the actual shape of a Lory run — the same stages that show up in the log, in the same order. Nothing here is a metaphor for something else.
Scope is a gate, not a suggestion
You declare targets and sign the rules of engagement in the portal. Every single tool call is checked against that allowlist first — scope_check runs before anything touches a host, and an out-of-scope target is never contacted. Pick a depth: surface, standard or deep.
Deterministic sweep
Before any judgement calls, a fixed sweep establishes ground truth: DNS, live HTTP surface, service fingerprints, open ports, a screenshot. Same inputs, same output, every run — so the interesting part starts from facts rather than guesses.
One focused pass per attack vector
The orchestrator picks the vectors that apply to what it just found, ranks them by offensive impact, and gives each one its own pass with its own budget. SQLi gets a pass. IDOR gets a pass. SSRF gets a pass. Each pass loads the matching playbook and works only that angle — no thin, scattered coverage.
Validate, then chain
A signal isn't a finding. Lory proves it, screenshots it, and looks for what it unlocks — SSRF into instance metadata into cloud credentials into production data. Findings land with evidence, a CWE, and a mapping to the compliance controls they break.
A human signs, or it doesn't ship
Everything Lory writes lands in pending_review and stays invisible to you until a Lorikeet pentester reads the evidence and approves it. Risk rating, exploitation judgement, executive summary and final sign-off are ours. This is the part we won't automate.
57 playbooks, loaded one at a time.
Lory doesn't carry a single giant prompt. Each attack class is a written playbook — methodology, payloads, false-positive traps, what proof looks like — and she pulls exactly the one the current pass needs. Depth per vector instead of a checklist skimmed thin.
Web
27- sqli · ssrf · ssti · rce
- idor · business-logic
- deserialization · xxe
- request-smuggling · cache
- prototype-pollution
- graphql · websockets
- + 14 more
Authentication
14- oauth · saml · jwt
- webauthn · mfa · mtls
- session-management
- account-recovery
- ntlm · ldap · legacy-sso
- + 5 more
Network
3- network-layer
- network-services
- internal-agent-recon
Identity & AD
1- active-directory
Cloud
1- cloud · IAM · metadata
Mobile
1- mobile (iOS & Android)
AI systems
1- ai-security
Code & supply chain
2- source-review
- supply-chain
Recon
2- osint
- osint-methodology
Operating rules
5- rules-of-engagement
- operator-identity
- findings-format
- reporting · fast-checking
Behind the playbooks sits a 1,969-entry vulnerability knowledge base built from OWASP ASVS, WSTG and Top 10, plus MITRE CWE and CAPEC — searched during enrichment so findings arrive with real remediation guidance, not a generated paragraph.
We'll also tell you what she didn't test.
Every AI security tool shows you what it found. The harder number is what it never got to. Each engagement emits a coverage record: vectors planned, vectors that ran, and vectors cut short by the time or token ceiling — with the reason attached.
If a run stops two vectors short, that's in your engagement record and your pentester sees it before sign-off. You can raise the depth and rerun. What you can't do is mistake an unfinished run for a clean one.
And the half that happens after the report.
A test ends with findings; the work ends when the code changes. lory-code-security is our open-source terminal cockpit for that second half — pull your findings down, find the lines responsible, ask Lory for the fix, and file the retest, without leaving the repo you are fixing.
- what it is
- A Python TUI and CLI, MIT-licensed, Python 3.11+. It does not scan anything — findings come from Lory's engine, our testers and incident response, and only after a human has approved them. This reads them and helps you close them.
- trace
- Points
git grep/rgat your working tree using the parameters, routes, paths, headers and CWE sink patterns the finding names. Every hit is labelled with the token that produced it, because a lead generator is not an analyser — it narrows a repo to a handful of lines, and you decide. - fix
- Asks Lory for the concrete code-level change, grounded in the Lorikeet knowledge base entry for that class. Your source is attached only if you opt in, per request.
- close
- Local triage state is deliberately separate from the platform's. Marking something fixed here changes nothing upstream — only a retest closes a finding, and that stays a human decision.
- CI
- The portal export speaks SARIF 2.1.0, so an engagement becomes inline annotations in GitHub code scanning with no integration work. Headless pipelines authenticate over MCP with a
lkmcp_token rather than a cookie that expires. - and a harness
- Lory's behaviour lives in hot-editable skill files.
lory harness runasserts against them from YAML scenarios — the regression net those files otherwise wouldn't have.
# cockpit, or CLI-only for CI pip install "lory-code-security[tui]" # everything comes from your portal lory init → reuses your existing MCP token if you have one lory doctor lory findings list --severity critical lory trace 41 ▸ src/reports.py:88 dateFrom sql = "… WHERE d >= '" + dateFrom + "'" lory fix 41 --code lory retest 41 → a human re-tests. only that closes it.
Unreviewed AI findings are never returned on either read path — the export applies the same review gate the portal reads through, so the tool cannot see a finding a human hasn't approved.
And she works inside your network.
Internal assessment is normally episodic: someone connects, runs a profile, leaves, and the network drifts unseen until next year. lk-exporter is our open-source answer to that — a per-host sensor that runs unattended, tracks what changed, and that Lory can drive live over MCP during an engagement.
- what it is
- A Python agent you install on a host, not an appliance. It knows that machine deeply; network-wide recon stays Lory's job.
- what it collects
- Open ports and service versions, OS patch level and installed packages mapped to CVEs, EOL software, full inventory with drift, and a supply-chain crawl — npm manifests checked against OSV and known-malicious packages.
- how it reports
- Outbound only. The agent opens every connection; the platform never reaches into your network. Findings are fingerprinted, so the same issue never floods your queue — and when it stops appearing, it auto-closes.
- how Lory uses it
- Over MCP. Mid-engagement she can trigger a collection cycle on a host she's interested in and read the results in the same reasoning loop — plus six relay tools that execute locally behind your perimeter.
- licence
- MIT. Read it, audit it, fork it. Running it standalone needs no platform account at all — findings print as JSON straight to stdout for your SIEM.
# install on the host you want watched pip install lorikeet-security-agent-exporter # scope is an allowlist. nothing runs without it. lk-exporter validate --config config.yaml # continuous collection + MCP, so Lory can drive it lk-exporter run --agent-mode ▸ scope 10.0.4.0/24 (254 addrs) ▸ modules discovery patch inventory posture ▸ transport outbound TLS → platform ▸ mcp stdio · 8 tools exposed ▸ cycle 41 12 findings · 3 new · 2 auto-closed
Standalone mode needs no platform at all. Point it at nothing and it prints normalized findings to stdout — pipe them wherever you already send security events.
Bring your own agent.
Being AI-native cuts both ways. Your security program shouldn't be locked behind our UI, so we expose it over the Model Context Protocol — point Claude, Claude Code, or anything else that speaks MCP at your own workspace and ask it questions in your own words.
- read
- Findings and their full detail, asset inventory, compliance frameworks and control status, and the 1,969-entry vulnerability knowledge base.
- write
- One write action: request a retest on a finding you've fixed. Writing into your findings is deliberately not exposed to customer credentials.
- boundaries
- Every call is authenticated and hard-scoped to the company that owns the credential. There is no cross-tenant read. Anything touching a concrete asset is checked against your scope rules first.
- auth
- OAuth 2.1 with dynamic client registration for Claude.ai and Desktop, or a workspace API token for everything else.
{
"mcpServers": {
"lorikeet": {
"type": "http",
"url": "https://lorikeetsecurity.com/ptaas/mcp/",
"headers": {
"Authorization": "Bearer <your-token>"
}
}
}
}
She still talks, obviously.
Ask what a pentest costs, what your SOC 2 evidence needs to cover, or what a finding in your report actually means. Signed in, she goes further — pulling your live findings, drafting an executive summary, scoping an engagement, or booking time with a human when you'd rather have one.
Prepaid credits. No seats.
Load a balance and Lory draws from it as she works. $1 buys 1 credit, MCP tool calls cost 0.1 credit, and engagements bill by depth. Credits gate the start of a run, so nothing begins that you haven't funded.
- ≈ 1,000 MCP tool calls
- Your first scoped engagement
- Every finding human-reviewed
- ≈ 2,500 MCP tool calls
- Multi-target, multi-stage chains
- Compliance-mapped reporting
- ≈ 5,000 MCP tool calls
- Room for deep, long-running runs
- Full vector coverage at depth
- ≈ 10,000 MCP tool calls
- Program-level, ongoing testing
- Priority human review
The things people actually ask.
No, and the workflow makes that structural rather than a promise. Everything Lory writes lands in a review queue and is invisible to you until a Lorikeet pentester reads the evidence and approves it. She covers volume — recon, validation, chaining, first-draft write-ups, round the clock. Scoping, exploitation judgement, risk rating and the final report are ours.
A scanner runs a fixed template set and hands you a list of maybes. Lory picks her attack vectors from what she found on your system, loads the matching playbook, proves the issue, and then looks for what it unlocks. The output is a demonstrated path with captured evidence, not raw signal you still have to triage.
Scope is enforced in code, not policy. Every tool call resolves its target against your signed allowlist before it executes, and an out-of-scope host is never contacted. Destructive tooling isn't in the toolbelt, a pentester oversees the run, and the full log of what was attempted is yours to read afterwards.
For external testing, no — Lory runs entirely in the Lorikeet portal, and you can scope a run and have her starting recon the same day. For internal network testing you deploy lk-exporter on the hosts you want covered: one pip install, an allowlist, and it reports outbound only.
You're told. Every engagement records the vectors it planned, the ones it ran, and the ones it never reached because the time or token ceiling hit first. That record reaches your pentester before sign-off and reaches you in the engagement view. Raise the depth and rerun to close the gap.
Yes. The MCP server exposes your findings, assets, compliance posture and knowledge base to any MCP client — Claude, Claude Code, or your own. Auth is OAuth 2.1 or a workspace token, scopes are per-token, and access is hard-limited to your own company's data.
It's prepaid and usage-based — no subscription, no seat licences. Load credits ($1 = 1 credit), and Lory draws down as she works: 0.1 credit per MCP tool call, and engagements billed by depth. Preset packs run $100–$1,000, or set any custom amount from $25 to $25,000 in the billing tab.
Scope one engagement and see what she finds.
No waitlist and no separate contract — the AI pentester is live in the portal today. Book thirty minutes and we'll scope your first run together. And if you'd rather skip the AI entirely, our pentesters will run it by hand. That option never goes away.