Ngoto: A Plugin-Based Framework for Automating Pentesting Scripts
I built Ngoto, an extendable Python script handler for automating penetration testing and OSINT scripts — install with pip, extend with simple decorators.
Years ago I built Ngoto, an extendable Python script handler for automating penetration testing tasks. It started as a way to stop rewriting the same boilerplate every time I put together a small security or OSINT script, and turned into a small open-source tool that other people picked up too.
The problem
Most one-off pentesting or OSINT scripts end up looking the same: a bit of argument parsing, some logging, maybe a scheduler if you want something to run repeatedly, then the actual logic buried in the middle. I kept rebuilding that scaffolding from scratch for every new script, which meant more time spent on plumbing than on the actual task.
I wanted a base I could drop any script into, register it, and have it show up as a proper command, plugin, or scheduled task — without rewriting the surrounding structure every time.
What I built
Ngoto is a lightweight framework you install with pip, then extend with your own Python classes using three decorators:
@command— turns a function into a CLI command, with support for aliases@plugin— groups related functionality into a named, foldered plugin@task— schedules a function to run on a delay, useful for recurring or automated jobs
You register your classes with ngoto.load_cogs([...]) and start the tool, and it gives you an interactive console to run commands, trigger plugins, and manage tasks — all logged through a built-in logger. It's designed so anyone can write a new capability as a small class and plug it straight into the framework, rather than building a new script from zero.
Under the hood it's a fairly standard cog/extension-loading pattern (similar in spirit to how some chat bot frameworks structure plugins), applied to the pentesting/OSINT script space where I couldn't find anything quite like it at the time.
Where it landed
The project picked up some traction on GitHub — 39 stars and 9 forks at last count. It is tagged around OSINT, pentesting, and CLI tooling, and is still available to install via pip install ngoto.
It's a good reminder of a problem I keep coming back to: most of my projects start with "I don't want to write this same scaffolding a fourth time."
