TurboPentest
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TURBOPENTEST_API_KEY | Yes | Your TurboPentest API key (required) | |
| TURBOPENTEST_API_URL | No | Custom API base URL (for testing) | https://turbopentest.com/api |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| turbopentest_start_pentestA | Launch an AI-powered penetration test against a target URL. The target domain must be verified first — this tool checks turbopentest_list_domains itself and will refuse (isError) to launch against an unverified domain, so there is no need to bypass this check. Requires an available credit matching the selected tier — use turbopentest_get_credits to check balance. Returns a pentest ID that can be used with turbopentest_get_pentest to monitor progress. |
| turbopentest_get_pentestA | Retrieve full details for a specific penetration test by its ID. Returns current status, scan progress percentage, findings summary by severity, executive summary, attack surface map, and STRIDE threat model. Use this to monitor a running scan or review completed results. For detailed vulnerability data, follow up with turbopentest_get_findings. |
| turbopentest_list_pentestsA | List all your penetration tests with their status and finding counts, ordered newest first. Use this to find pentest IDs, check which scans are running, or review past results. Supports filtering by status and limiting result count. Use turbopentest_get_pentest with a specific ID for full details. |
| turbopentest_get_findingsA | Retrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of concept, remediation steps, and a retest command. Returns up to 20 findings at a time — use the severity filter to focus on specific risk levels. Use turbopentest_download_report for a complete exportable report. |
| turbopentest_download_reportA | Download a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-readable analysis, 'json' for structured programmatic data, or 'pdf' for a professionally formatted document suitable for stakeholders. |
| turbopentest_get_creditsA | Check your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one credit of the matching type. Call this before turbopentest_start_pentest to verify you have sufficient credits for the desired tier. |
| turbopentest_verify_attestationA | Verify a blockchain-anchored penetration test attestation by its SHA-256 hash. Returns scan metadata (tier, agents, duration, risk score, finding summary) and blockchain proof (chain ID, transaction hash, block number, merkle root) if anchored. This is a public endpoint — no API key is required. Use this to independently confirm that a pentest was performed and its results are tamper-proof. |
| turbopentest_list_domainsA | List all domains in your account with their verification status and expiry dates. A domain must have status 'verified' before it can be used as a target in turbopentest_start_pentest. To verify a new domain, add a DNS TXT record via the TurboPentest dashboard at turbopentest.com/domains. |
| turbopentest_workflow_run_pentestA | Returns step-by-step instructions for running a full-lifecycle pentest against a target: domain verification, credit check, launch, progress monitoring, findings summary, and report offer. Use this in MCP clients (like Codex) that don't support the 'run_pentest' MCP prompt directly. |
| turbopentest_workflow_analyze_findingsA | Returns step-by-step instructions for producing a prioritized remediation plan from a completed pentest's findings. Use this in MCP clients (like Codex) that don't support the 'analyze_findings' MCP prompt directly. |
| turbopentest_workflow_compare_pentestsA | Returns step-by-step instructions for diffing two pentests on the same target to show what's new, fixed, and persistent. Use this in MCP clients (like Codex) that don't support the 'compare_pentests' MCP prompt directly. |
| turbopentest_workflow_security_postureA | Returns step-by-step instructions for producing an executive security posture briefing across the 5 most recent pentests. Use this in MCP clients (like Codex) that don't support the 'security_posture' MCP prompt directly. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| analyze_findings | Deep-dive analysis of a pentest's findings with prioritized remediation plan |
| compare_pentests | Diff two pentests to track what's new, fixed, and persistent across tests |
| run_pentest | Guided full-lifecycle pentest: domain check, credit verification, launch, monitoring, and findings summary |
| security_posture | Executive summary of overall security posture across all recent pentests |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
The four workflow_* tools return instructions rather than performing actions, and are clearly distinguished from the actual action tools (start_pentest, get_findings) by their descriptions. Minor overlap risk exists — an agent could confuse workflow_run_pentest with start_pentest, or workflow_analyze_findings with get_findings — but the descriptions explicitly clarify each tool's role.
All names use snake_case with a consistent turbopentest_ prefix followed by verb_noun (get_credits, list_domains, start_pentest, get_pentest, get_findings, download_report). The workflow_* group inserts a noun segment before the verb, which is a minor deviation but is internally consistent across all four tools.
Twelve tools is well within a comfortable range and each tool maps to a distinct operation in the pentest lifecycle. No redundant or filler tools are present.
The surface covers credits, domain listing, launching, listing, monitoring, findings retrieval, reporting, and attestation verification — a strong full-lifecycle flow. Minor gaps exist: domain addition/verification must be done via the dashboard, and there is no tool to cancel or delete a running pentest, but these are workable.