Pentest MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_AUTH_MODE | No | The authentication mode to use (e.g., 'bearer'). | |
| MCP_TRANSPORT | No | The primary network transport to use. Options: stdio, http, sse. Default is stdio. | stdio |
| MCP_AUTH_SCOPES | No | Comma-separated list of required authentication scopes (e.g., 'read,write'). | |
| MCP_OIDC_ISSUER | No | The URL of the OIDC issuer. | |
| MCP_SERVER_HOST | No | The host address to bind the server to when using network transport (http/sse). | 0.0.0.0 |
| MCP_SERVER_PORT | No | The port to bind the server to when using network transport (http/sse). | |
| MCP_AUTH_ENABLED | No | Whether to enable bearer-token auth with OIDC. Set to 'true' to enable. | |
| MCP_AUTH_AUDIENCE | No | The expected audience for OIDC token validation. | |
| MCP_OIDC_JWKS_URL | No | The URL of the OIDC JWKS (JSON Web Key Set) for token validation. | |
| MCP_OAUTH_CLIENT_ID | No | The OAuth client ID for authentication. | |
| MCP_OAUTH_CLIENT_SECRET | No | The OAuth client secret for authentication. | |
| MCP_OIDC_INTROSPECTION_URL | No | Optional alternative or backup validation mode using an introspection URL. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| setModeD | – |
| nmapScanD | – |
| generateWordlistD | – |
| runJohnTheRipperD | – |
| runHashcatD | – |
| cancelScanD | – |
| createClientReportD | – |
| gobusterD | – |
| niktoD | – |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
The tools have distinct purposes in penetration testing (e.g., nmapScan for scanning, gobuster for directory busting, runHashcat for password cracking), but some overlap exists in the 'run' category (runHashcat and runJohnTheRipper both handle password cracking with different tools), and the vague 'setMode' could be confused with other configuration or control functions. Descriptions are missing, which limits clarity, but the tool names suggest reasonably separate domains.
Naming is inconsistent with mixed conventions: camelCase (cancelScan, createClientReport, setMode) and snake_case-like patterns (gobuster, nikto, nmapScan, runHashcat, runJohnTheRipper, generateWordlist). There's no uniform verb_noun pattern; some tools use verbs like 'run' or 'create', while others are tool names or actions without clear structure, making the set less predictable.
With 9 tools, the count is appropriate for a penetration testing server, covering key areas like scanning, cracking, reporting, and wordlist generation. It's well-scoped without being overly heavy, though it could be slightly thin if more specialized tools are needed, but it reasonably represents core pentest functions.
The tool set covers major pentest phases: reconnaissance (nmapScan), vulnerability scanning (nikto), password cracking (runHashcat, runJohnTheRipper), and reporting (createClientReport). However, there are notable gaps, such as no tools for exploitation, post-exploitation, or data exfiltration, and missing descriptions make it hard to assess full coverage, but it provides a basic workflow from scan to report.