PenTest MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GEMINI_MODEL | No | The Gemini model to use (default: gemini-flash-lite-latest). | gemini-flash-lite-latest |
| GEMINI_API_KEY | Yes | Your Gemini API key for AI-powered reports and analysis. |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| pingC | Health check for the PenTest MCP server |
| init_sessionC | Initialize new security assessment session |
| get_reportC | Generate final security assessment report |
| environment_checkA | Inspect installed tools, missing dependencies, and assessment readiness |
| quick_scanA | Fast triage scan (10-15 min): WAF detection, subdomain enum, top-port scan, header analysis, TLS audit, tech fingerprinting, sensitive file discovery, SSRF probe, CSRF check |
| extensive_scanC | Comprehensive scan (20-45 min): WAF detection, full recon, top-1000 port scan, tech fingerprinting, TLS audit, directory discovery, XSS, SQLi, CSRF, sensitive file discovery |
| subfinderC | Passive subdomain enumeration |
| wafw00fC | Web Application Firewall detection |
| nmapC | Port scanning and service detection |
| nucleiC | Fast vulnerability scanner with templates |
| sqlmapC | SQL injection detection and exploitation |
| dalfoxC | XSS vulnerability scanner |
| ffufC | Fast web fuzzer for directory/file discovery |
| sslyzeC | TLS/SSL configuration analyzer |
| whatwebC | Web technology fingerprinting |
| testsslC | TLS/SSL security testing |
| niktoD | Web server vulnerability scanner |
| gobusterC | Directory/file brute forcing |
| wfuzzC | Web application fuzzer |
| arjunC | HTTP parameter discovery |
| masscanC | Fast port scanner |
| amassC | Advanced subdomain enumeration |
| dnsreconC | DNS enumeration and reconnaissance |
| theharvesterC | OSINT gathering from public sources |
| retireC | JavaScript library vulnerability scanner |
| trufflehogC | Secret and credential scanner |
| git_dumperC | Exposed .git directory dumper |
| commixC | Command injection vulnerability scanner |
| corscannerC | CORS misconfiguration scanner |
| jwt_toolD | JWT security testing |
| graphql_copC | GraphQL security scanner |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/omamishra8051-source/PenTest-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server