TurboPentest
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TURBOPENTEST_API_KEY | Yes | Your TurboPentest API key (required) | |
| TURBOPENTEST_API_URL | No | Custom API base URL (for testing) | https://turbopentest.com/api |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| start_pentestA | Launch an AI-powered penetration test against a target URL. The domain must be verified first (see list_domains). Requires an available credit matching the selected tier. |
| get_pentestC | Get full details for a pentest including status, progress, findings summary, executive summary, attack surface map, and STRIDE threat model. |
| list_pentestsB | List all your pentests with status and finding counts. Results are ordered newest first. |
| get_findingsB | Get structured vulnerability findings for a pentest. Each finding includes severity, CVSS, CWE, description, PoC, remediation, and retest command. Use the severity filter to narrow results. |
| download_reportA | Download a pentest report. Use format=markdown for AI-readable content, format=json for structured data, or format=pdf for the full formatted report. The scan must be complete. |
| get_creditsA | Check your credit balance and available scan tiers with pricing. Credits are required to launch pentests. |
| verify_attestationA | Verify a blockchain-anchored pentest attestation by its hash. This is a public endpoint — no API key required. Use this to confirm that a pentest was actually performed and its results are authentic. |
| list_domainsA | List your verified domains and their verification status. Domains must be verified before you can run pentests against them. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a distinct purpose with clear boundaries: download_report retrieves reports, get_credits checks balances, get_findings provides vulnerability details, get_pentest gives full test details, list_domains shows domain status, list_pentests lists tests, start_pentest launches tests, and verify_attestation verifies authenticity. No overlap or confusion exists between these functions.
All tools follow a consistent verb_noun pattern using snake_case: download_report, get_credits, get_findings, get_pentest, list_domains, list_pentests, start_pentest, and verify_attestation. This uniformity makes the toolset predictable and easy to navigate.
With 8 tools, the count is well-scoped for a pentesting server, covering essential operations like launching tests, retrieving results, managing domains, and verifying attestations. Each tool earns its place without redundancy or bloat.
The toolset provides complete coverage for the pentesting domain: it supports the full lifecycle from domain verification and test initiation to retrieving findings, reports, and attestation verification. No obvious gaps exist; agents can perform all core workflows seamlessly.