Skip to main content
Glama
DMontgomery40

Pentest MCP

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
MCP_AUTH_MODENoThe authentication mode to use (e.g., 'bearer').
MCP_TRANSPORTNoThe primary network transport to use. Options: stdio, http, sse. Default is stdio.stdio
MCP_AUTH_SCOPESNoComma-separated list of required authentication scopes (e.g., 'read,write').
MCP_OIDC_ISSUERNoThe URL of the OIDC issuer.
MCP_SERVER_HOSTNoThe host address to bind the server to when using network transport (http/sse).0.0.0.0
MCP_SERVER_PORTNoThe port to bind the server to when using network transport (http/sse).
MCP_AUTH_ENABLEDNoWhether to enable bearer-token auth with OIDC. Set to 'true' to enable.
MCP_AUTH_AUDIENCENoThe expected audience for OIDC token validation.
MCP_OIDC_JWKS_URLNoThe URL of the OIDC JWKS (JSON Web Key Set) for token validation.
MCP_OAUTH_CLIENT_IDNoThe OAuth client ID for authentication.
MCP_OAUTH_CLIENT_SECRETNoThe OAuth client secret for authentication.
MCP_OIDC_INTROSPECTION_URLNoOptional alternative or backup validation mode using an introspection URL.

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Server capabilities have not been inspected yet.

Tools

Functions exposed to the LLM to take actions

NameDescription
setModeD
nmapScanD
generateWordlistD
runJohnTheRipperD
runHashcatD
cancelScanD
createClientReportD
gobusterD
niktoD

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

D1.6/5.0

Scored across 9 tools

Disambiguation3/5

The tools have distinct purposes in penetration testing (e.g., nmapScan for scanning, gobuster for directory busting, runHashcat for password cracking), but some overlap exists in the 'run' category (runHashcat and runJohnTheRipper both handle password cracking with different tools), and the vague 'setMode' could be confused with other configuration or control functions. Descriptions are missing, which limits clarity, but the tool names suggest reasonably separate domains.

Naming Consistency2/5

Naming is inconsistent with mixed conventions: camelCase (cancelScan, createClientReport, setMode) and snake_case-like patterns (gobuster, nikto, nmapScan, runHashcat, runJohnTheRipper, generateWordlist). There's no uniform verb_noun pattern; some tools use verbs like 'run' or 'create', while others are tool names or actions without clear structure, making the set less predictable.

Tool Count4/5

With 9 tools, the count is appropriate for a penetration testing server, covering key areas like scanning, cracking, reporting, and wordlist generation. It's well-scoped without being overly heavy, though it could be slightly thin if more specialized tools are needed, but it reasonably represents core pentest functions.

Completeness3/5

The tool set covers major pentest phases: reconnaissance (nmapScan), vulnerability scanning (nikto), password cracking (runHashcat, runJohnTheRipper), and reporting (createClientReport). However, there are notable gaps, such as no tools for exploitation, post-exploitation, or data exfiltration, and missing descriptions make it hard to assess full coverage, but it provides a basic workflow from scan to report.

Maintenance

ActivityInactive
ResponsivenessResponsive