---
type: Collection
title: SuperPentest — Open Knowledge Format bundle
description: Agent-readable, cross-linked knowledge bundle for SuperPentest — an autonomous, authorized AI penetration test for web apps, APIs and AI agents.
resource: https://superpentest.com/
tags: [penetration-testing, ai-security, appsec, okf, autonomous-pentest]
timestamp: 2026-10-28
---

# SuperPentest — Open Knowledge Format bundle

This is an [Open Knowledge Format](https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/HEAD/okf/SPEC.md)
bundle: a directory of cross-linked markdown files describing SuperPentest as a set of
concepts an agent can read without scraping HTML. Each file has YAML frontmatter and a
`resource` link to the canonical page on https://superpentest.com.

SuperPentest is an autonomous, authorized AI penetration tester for web applications,
APIs and AI agents. You supply one application, the scope you approve, and a test account
per role; an AI team maps the attack surface, tests real authorization boundaries, and
returns replayable, control-verified evidence — every finding independently reproduced
from a clean session before it counts.

## Start here
- [Overview](overview.md) — what SuperPentest is, and the canonical facts.
- [Investigation model](investigation-model.md) — the six-step method: prove, don't alert.
- [How a candidate becomes a finding](how-findings-are-verified.md) — the reproduction moat.

## Concepts
- [The autonomous team](autonomous-team.md) — the roles that run a test.
- [Vulnerability classes](vulnerability-classes.md) — the 35 classes the engine tests.
- [AI & agent security](ai-agent-security.md) — the core wedge: prompt injection, MCP, tool boundaries.
- [Access-control testing by replay](access-control-replay.md) — the bug a scanner structurally cannot see.
- [Proving a second-order prompt injection](prompt-injection-canary.md) — the planted-canary method.
- [Business-logic vulnerabilities](business-logic.md) — the bugs only your app can have.
- [Continuous testing](continuous-testing.md) — assess, fix, retest, compare, repeat.
- [Compliance mapping & trust page](compliance-and-trust.md) — evidence mapped to the control it breaks.
- [Controls & safety](controls-and-safety.md) — Rules of Engagement, scope enforcement, secret handling.

## Commercial
- [Pricing](pricing.md) — plans, limits and terms (EUR).
- [Comparisons & category](comparisons.md) — vs XBOW, Hadrian, Aikido, Escape; the open benchmark.
- [Glossary](glossary.md) — IDOR, BOLA, prompt injection, MCP, DAST, PTaaS.
- [Get started](get-started.md) — demo, free assessment, sample report, contact.