PenTool is a Python toolkit for authorized security testing of web apps, APIs, and source code. External scans assess TLS, ports, DNS, headers, cookies, CORS, directories, APIs, JWT/IDOR, rate limits, and CVEs. Internal analysis checks dependency vulnerabilities and freshness, then uses Claude for framework-aware code review. Cross-mode review ranks fixes; diff tracks changes between scans. Export severity-tagged findings, reproducers, coverage, and next actions as JSON, HTML, or Markdown.