How do I use PenTest MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PenTest MCP Run a quick scan on http://example.com with consent" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

PenTest MCP

by omamishra8051-source

Overview Schema Source Related Servers Discussions Admin

Python

Local

🛡️ PenTest MCP

AI-Powered Security Scanning via Model Context Protocol (MCP)

PenTest MCP is a specialized MCP server that exposes 25+ professional security tools to AI agents like Claude Desktop. It enables security researchers and developers to orchestrate penetration testing through natural language, automating complex tool chains and generating professional reports.

🚀 Quick Start (Claude Desktop)

Install dependencies:
```
pip install -e .
```

Configure Claude Desktop: Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "pentest": {
      "command": "python3",
      "args": [
        "-m",
        "pentest_mcp.mcp_server"
      ],
      "cwd": "/absolute/path/to/pentest-mcp"
    }
  }
}

Restart Claude Desktop and start scanning:
- "Initialize a security assessment for http://localhost:3001"
- "Run a quick scan on http://localhost:3001 with consent"
- "Check if the site has a WAF"
- "Generate the final security report"

Claude Desktop Integration - Full orchestration via the Model Context Protocol.
25+ Security Tools - Including nmap, sqlmap, nuclei, ffuf, nikto, testssl, and more.
Natural Language Orchestration - Ask security questions, Claude picks the right tools.
Preset Scan Modes - Quick Triage and Extensive Assessment modes.
AI-Generated Reports - Professional markdown reports powered by Gemini AI.
CVE Enrichment - Findings are automatically cross-referenced with CVE data.

Related MCP server: pentestMCP

🛠️ Supported Tools (25)

Category	Tools
Reconnaissance	`subfinder`, `wafw00f`, `nmap`, `whatweb`, `amass`, `dnsrecon`, `theharvester`
Vulnerability Scanning	`nuclei`, `sqlmap`, `dalfox`, `nikto`, `retire`, `commix`, `corscanner`, `graphql_cop`
Web Fuzzing	`ffuf`, `gobuster`, `wfuzz`, `arjun`
TLS/SSL	`sslyze`, `testssl`
Advanced/OSINT	`masscan`, `trufflehog`, `git_dumper`, `jwt_tool`

🔧 Installation & Setup

Prerequisites

Python 3.11+
Gemini API Key (for reports and analysis)
(Recommended) External tools installed: nmap, sqlmap, ffuf, nuclei, etc.

Configuration

Create a .env file in the project root:

GEMINI_API_KEY=your_api_key_here
GEMINI_MODEL=gemini-flash-lite-latest

📁 Project Structure

pentest-mcp/
├── pentest_mcp/
│   ├── mcp_server.py      # Main MCP server entry point
│   ├── scan_modes.py      # Quick & Extensive scan logic
│   ├── session.py         # Session & DB management
│   ├── report_engine.py   # AI report generation
│   ├── llm_providers.py   # Gemini API integration
│   ├── tools/             # Tool wrappers & logic
│   └── models.py          # Pydantic data models
├── vulnerable-app/        # Local test target (Node.js)
├── reports/               # Generated scan reports
└── pyproject.toml         # Project dependencies

🔒 Security Notice

This tool is for authorized security testing only.

Always obtain explicit written permission before scanning any target.
Unauthorized testing is illegal and unethical.
The consent flag is a mandatory requirement for all active scanning tools.

Built with 🐍 Python · 🧠 Gemini AI · 🛡️ MCP

Available Tools

31 tools

amassC

Advanced subdomain enumeration

Inputs: domain (required), session_id (required), dry_run.

arjunC

HTTP parameter discovery

Inputs: url (required), session_id (required), dry_run.

commixC

Command injection vulnerability scanner

Inputs: url (required), session_id (required), dry_run.

corscannerC

CORS misconfiguration scanner

Inputs: url (required), session_id (required), dry_run.

dalfoxC

XSS vulnerability scanner

Inputs: url (required), session_id (required), params, consent, +1 more.

dnsreconC

DNS enumeration and reconnaissance

Inputs: domain (required), session_id (required), dry_run.

environment_checkA

Inspect installed tools, missing dependencies, and assessment readiness

Inputs: no named parameters.

extensive_scanC

Comprehensive scan (20-45 min): WAF detection, full recon, top-1000 port scan, tech fingerprinting, TLS audit, directory discovery, XSS, SQLi, CSRF, sensitive file discovery

Inputs: target (required), consent (required), dry_run.

ffufC

Fast web fuzzer for directory/file discovery

Inputs: url (required), session_id (required), mode, consent, +1 more.

get_reportC

Generate final security assessment report

Inputs: session_id (required).

git_dumperC

Exposed .git directory dumper

Inputs: url (required), session_id (required), dry_run.

gobusterC

Directory/file brute forcing

Inputs: url (required), session_id (required), mode, dry_run.

graphql_copC

GraphQL security scanner

Inputs: url (required), session_id (required), dry_run.

init_sessionC

Initialize new security assessment session

Inputs: target (required).

jwt_toolD

JWT security testing

Inputs: token (required), session_id (required), url, dry_run.

masscanC

Fast port scanner

Inputs: target (required), session_id (required), ports, dry_run.

niktoD

Web server vulnerability scanner

Inputs: url (required), session_id (required), consent, dry_run.

nmapC

Port scanning and service detection

Inputs: host (required), session_id (required), ports, consent, +1 more.

nucleiC

Fast vulnerability scanner with templates

Inputs: url (required), session_id (required), dry_run.

pingC

Health check for the PenTest MCP server

Inputs: no named parameters.

quick_scanA

Fast triage scan (10-15 min): WAF detection, subdomain enum, top-port scan, header analysis, TLS audit, tech fingerprinting, sensitive file discovery, SSRF probe, CSRF check

Inputs: target (required), consent (required), dry_run.

retireC

JavaScript library vulnerability scanner

Inputs: url (required), session_id (required), dry_run.

sqlmapC

SQL injection detection and exploitation

Inputs: url (required), session_id (required), params, consent, +1 more.

sslyzeC

TLS/SSL configuration analyzer

Inputs: host (required), session_id (required), port, consent, +1 more.

subfinderC

Passive subdomain enumeration

Inputs: domain (required), session_id (required), consent, dry_run.

testsslC

TLS/SSL security testing

Inputs: host (required), session_id (required), port, dry_run.

theharvesterC

OSINT gathering from public sources

Inputs: domain (required), session_id (required), dry_run.

trufflehogC

Secret and credential scanner

Inputs: target (required), session_id (required), dry_run, scan_type.

wafw00fC

Web Application Firewall detection

Inputs: url (required), session_id (required), dry_run.

wfuzzC

Web application fuzzer

Inputs: url (required), session_id (required), dry_run, fuzz_param.

whatwebC

Web technology fingerprinting

Inputs: url (required), session_id (required), consent, dry_run.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

C2.2/5.0

Scored 2026-07-28 09:40 across 31 tools

Disambiguation2/5

Many tools have overlapping purposes (e.g., multiple port scanners, fuzzers, and vulnerability scanners). While descriptions provide some distinction, the high degree of redundancy makes it difficult for an agent to select the correct tool for a task.

Naming Consistency3/5

Most tools are named after actual tool names (e.g., nmap, sqlmap) which are not descriptive of actions. There are a few descriptive names like ping and init_session, but overall the naming is a mix of proper nouns and verbs, lacking a consistent pattern.

Tool Count2/5

31 tools is excessive for the scope, with many overlapping functionalities (e.g., 3 fuzzers, 2 TLS scanners). The count feels inflated by bundling every available tool rather than curating a minimal, non-redundant set.

Completeness3/5

The tool set covers major penetration testing areas (recon, scanning, web vulns, etc.), but notable gaps exist such as exploitation frameworks and post-exploitation tools. Additionally, the redundancy indicates incomplete coverage in certain areas.

Resources

Related MCP Connectors

MCP Fortress
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
https://server.smithery.ai/@mcp-fortress/mcp-fortress-server/mcp
Tinplate Edge AI Safety, Security & EU ComplianceB
dev.tinplate
Zero-log MCP server with 49 tools for AI guardrails, secret scanning, MCP linting & EU compliance.
491
https://api.tinplate.dev/mcp
AI Agent Security ScannerA
dev.workers.manhliemcn4euwlu.llmrt-companion
Security scanner for AI agents and MCP servers: injection, jailbreak, tool abuse.
Security Penetration Testing Testing & QA Tools
51
https://llmrt-companion.manhliemcn4euwlu.workers.dev/mcp-agent-security
mcp-server
com.pentest-tools
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Penetration Testing Security
24
https://mcp.pentest-tools.com/mcp

Related MCP Servers

Pentest Tools MCP Server
Penetration Testing API Testing Security
ch1nhpd
F
license
Not graded
quality
D
maintenance
An MCP server that integrates various penetration testing tools, enabling security professionals to perform reconnaissance, vulnerability scanning, and API testing through natural language commands in compatible LLM clients like Claude Desktop.
Updated 2 years ago (2025-04-23 07:15 UTC)
7
-
pentestMCP
Penetration Testing Security Autonomous Agents
RamKansal
F
license
Not graded
quality
C
maintenance
An MCP server that exposes over 20 standard penetration testing utilities, such as Nmap, SQLMap, and OWASP ZAP, as callable tools for AI agents. It enables natural language control over complex security workflows for automated and interactive penetration testing.
Updated 2 months ago (2026-09-25 14:10 UTC)
117
-
redteam-mcp
Penetration Testing Shell Access
samirjani03
F
license
Not graded
quality
D
maintenance
A penetration testing MCP server that runs 20 hacking tools inside a Kali Linux Docker container, enabling AI assistants to execute security scans and attacks via natural language.
Updated 3 months ago (2026-08-17 09:33 UTC)
2
-
Pentest-mcp
Penetration Testing Code Analysis
d01ki
F
license
Not graded
quality
D
maintenance
Unified penetration testing MCP server for Claude Desktop providing 34 security tools for reconnaissance, web scanning, code analysis, and authenticated testing.
Updated 10 months ago (2026-01-30 06:05 UTC)
1
-

🛡️ PenTest MCP

🚀 Quick Start (Claude Desktop)

🛠️ Supported Tools (25)

🔧 Installation & Setup

Prerequisites

Configuration

📁 Project Structure

🔒 Security Notice

Available Tools

Tool Schema Changelog

TDQS

Resources

Related MCP Connectors

Related MCP Servers

Pentest Tools MCP Server

pentestMCP

redteam-mcp

Pentest-mcp