Question: Where are results stored?

[christian-schwaderer]

Hi! Where does PentestGPT store its results?
It had found some interesting results in the last runs and I want to look at the details again. Where are they stored? Besides, I wasn't even able to copy&paste the results while they were displayed. How is that done?

[ninderlakhotra5-code]

Instagram password

[CyberSunil]

If you're using PentestGPT v0.8 or later, previous sessions are typically stored in the 'test_history' directory

[rksharma-owg]

The answer depends on which of the two maintained runtimes you are using. I checked current main (e8b1bb7):

Autonomous pentestgpt-agent

By default, each run is stored relative to the directory where you launch it:

runs/<run-id>/
├── summary.json       # status, tasks, observations, attempts, usage, and errors
├── state.sqlite3      # canonical run state
├── trial-config.json  # exact resume configuration
└── traces/<episode>/
    ├── input.json
    ├── events.jsonl   # command/tool/file events and outputs
    └── output.json

The default is set by --runs-root runs; it can be changed explicitly. The easiest result to inspect is:

jq . runs/<run-id>/summary.json

Provider workspaces are separate and default to agent-workspaces/<run-id>/.

Interactive pentestgpt-legacy

When you quit and choose a session name, the reference transcript is saved to:

<current-working-directory>/test_history/<session-name>

The full conversation log is also written under <current-working-directory>/logs/ by default. The previous comment mentioning only test_history applies to this legacy runtime, not the autonomous agent.

One documentation mismatch remains on current main: the root README advertises pentestgpt --list-sessions, but the packages currently export pentestgpt-agent, pentestgpt-agent-audit, and pentestgpt-legacy; no pentestgpt executable or --list-sessions option is implemented. Until that is reconciled, find runs -maxdepth 2 -name summary.json -print is a reliable way to list autonomous run summaries.

Note that traces contain sensitive target output and provider session identifiers, so avoid posting the raw files publicly.