SHARKAPT: An Autonomous LLM-Orchestrated Penetration Testing Framework with MCP-Based Tool Integration

Abstract

Penetration testing is still highly dependent on trained professionals (who are required to manually coordinate heterogeneous security tools, multi-phase findings, and actionable reports) that is both time-consuming, expertise-oriented and inadequate to the speed of current threats. The framework described in this paper, SHARKAPT, is an autonomous AI-based penetration testing framework that uses the Model Context Protocol and large language model orchestration to conduct end-to-end automated security testing of both network and web application-related systems. SHARKAPT uses a multi-agent architecture based on LangGraph with five specialised agents: reconnaissance, network penetration testing, web application testing, exploitation as well as report generation and a decision engine that dynamically chooses 60+ real-world security tools. Google Gemini 3.1 Pro evaluated empirically against Metasploitable2 and OWASP Juice Shop has coverage of 71.7% of the Open Web Application Security Project Top 10 2021 challenges (9/10 categories), 79.1% Metasploitable2 known-vulnerability coverage, a 99.1% step success rate on the web session (111 steps), and a 94.5% step success rate on the network session (73 steps). All finding results are rated using a deterministic CVSS v3.0 calculator and stored in organised HTML reports containing per-finding evidence.