CyraFlow AI Pentesting Framework Pipeline orchestrates multi-stage security testing through intent classification, tool filtering, and ReAct-based LLM reasoning. User input flows from CLI and YAML config through Intent Classifier and Action Subcategory Classifier, then Tool Filter Engine routes requests to ReAct Engine, which coordinates with a Swappable LLM Adapter and MCP Manager for dynamic tool execution. MCP Servers (nmap, Metasploit, CredScan) execute against isolated lab targets like Metasploitable VM, with results logged to JSONL and chat history maintained for context. This architecture enables security teams to automate reconnaissance, exploitation, and reporting while maintaining tool flexibility and audit trails. Fork this diagram on Diagrams.so to customize LLM providers, add MCP servers, or adapt the pipeline for your threat model. The modular design supports swapping Ollama, Gemini, or OpenAI backends without pipeline restructuring.