The PenTest MCP Server is an AI-powered penetration testing assistant that exposes 25+ professional security tools to AI agents (e.g., Claude Desktop), enabling natural language-driven security assessments.

Session & Reporting

• Initialize assessment sessions for a target (init_session)

• Generate AI-powered, CVE-enriched security reports (get_report)

Preset Scan Modes

• Quick Scan (10–15 min): WAF detection, subdomain enum, port scan, TLS audit, header analysis, SSRF/CSRF checks

• Extensive Scan (20–45 min): Full recon, top-1000 port scan, directory discovery, XSS, SQLi, CSRF, TLS audit, and more

Reconnaissance & OSINT

• Subdomain enumeration: subfinder, amass

• DNS recon: dnsrecon

• OSINT gathering: theharvester

• Web tech fingerprinting: whatweb

• WAF detection: wafw00f

Network Scanning

• Port/service scanning: nmap, masscan

• TLS/SSL analysis: sslyze, testssl

Vulnerability Scanning

• Template-based scanning: nuclei

• SQL injection: sqlmap

• XSS: dalfox

• Command injection: commix

• Web server scanning: nikto

• CORS misconfigurations: corscanner

• GraphQL security: graphql_cop

• JS library CVEs: retire

Web Fuzzing & Discovery

• Directory/file/vhost discovery: ffuf, gobuster, wfuzz

• HTTP parameter discovery: arjun

Secrets & Auth Testing

• Secret/credential scanning: trufflehog

• Exposed .git dumping: git_dumper

• JWT security testing: jwt_tool

Note: All active scanning tools require explicit consent: true to ensure ethical and authorized testing.

Provides capabilities to detect and analyze exposed Git repositories on target servers to identify potential source code leaks.

Integrates security tools like graphql-cop to perform vulnerability assessments and security auditing of GraphQL endpoints.

Maps penetration testing findings to the OWASP Top 10 security standards for comprehensive and industry-aligned reporting.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PenTest MCP Server Run a quick security scan on example.com and analyze the findings."

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.