Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PenTest MCP Run a quick scan on http://localhost:3001 with consent"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AI-Powered Security Scanning via Model Context Protocol (MCP)
PenTest MCP is a specialized MCP server that exposes 25+ professional security tools to AI agents like Claude Desktop. It enables security researchers and developers to orchestrate penetration testing through natural language, automating complex tool chains and generating professional reports.
Install dependencies:
pip install -e .Configure Claude Desktop:
Add the following to your claude_desktop_config.json:
{
"mcpServers": {
"pentest": {
"command": "python3",
"args": [
"-m",
"pentest_mcp.mcp_server"
],
"cwd": "/absolute/path/to/pentest-mcp"
}
}
}Restart Claude Desktop and start scanning:
"Initialize a security assessment for http://localhost:3001"
"Run a quick scan on http://localhost:3001 with consent"
"Check if the site has a WAF"
"Generate the final security report"
Claude Desktop Integration - Full orchestration via the Model Context Protocol.
25+ Security Tools - Including nmap, sqlmap, nuclei, ffuf, nikto, testssl, and more.
Natural Language Orchestration - Ask security questions, Claude picks the right tools.
Preset Scan Modes - Quick Triage and Extensive Assessment modes.
AI-Generated Reports - Professional markdown reports powered by Gemini AI.
CVE Enrichment - Findings are automatically cross-referenced with CVE data.
Related MCP server: BugBounty MCP Server
Category | Tools |
Reconnaissance |
|
Vulnerability Scanning |
|
Web Fuzzing |
|
TLS/SSL |
|
Advanced/OSINT |
|
Python 3.11+
Gemini API Key (for reports and analysis)
(Recommended) External tools installed: nmap, sqlmap, ffuf, nuclei, etc.
Create a .env file in the project root:
GEMINI_API_KEY=your_api_key_here
GEMINI_MODEL=gemini-flash-lite-latestpentest-mcp/
├── pentest_mcp/
│ ├── mcp_server.py # Main MCP server entry point
│ ├── scan_modes.py # Quick & Extensive scan logic
│ ├── session.py # Session & DB management
│ ├── report_engine.py # AI report generation
│ ├── llm_providers.py # Gemini API integration
│ ├── tools/ # Tool wrappers & logic
│ └── models.py # Pydantic data models
├── vulnerable-app/ # Local test target (Node.js)
├── reports/ # Generated scan reports
└── pyproject.toml # Project dependenciesThis tool is for authorized security testing only.
Always obtain explicit written permission before scanning any target.
Unauthorized testing is illegal and unethical.
The consent flag is a mandatory requirement for all active scanning tools.
Built with 🐍 Python · 🧠 Gemini AI · 🛡️ MCP
Advanced subdomain enumeration
Inputs: domain (required), session_id (required), dry_run.
HTTP parameter discovery
Inputs: url (required), session_id (required), dry_run.
Command injection vulnerability scanner
Inputs: url (required), session_id (required), dry_run.
CORS misconfiguration scanner
Inputs: url (required), session_id (required), dry_run.
XSS vulnerability scanner
Inputs: url (required), session_id (required), params, consent, +1 more.
DNS enumeration and reconnaissance
Inputs: domain (required), session_id (required), dry_run.
Inspect installed tools, missing dependencies, and assessment readiness
Inputs: no named parameters.
Comprehensive scan (20-45 min): WAF detection, full recon, top-1000 port scan, tech fingerprinting, TLS audit, directory discovery, XSS, SQLi, CSRF, sensitive file discovery
Inputs: target (required), consent (required), dry_run.
Fast web fuzzer for directory/file discovery
Inputs: url (required), session_id (required), mode, consent, +1 more.
Generate final security assessment report
Inputs: session_id (required).
Exposed .git directory dumper
Inputs: url (required), session_id (required), dry_run.
Directory/file brute forcing
Inputs: url (required), session_id (required), mode, dry_run.
GraphQL security scanner
Inputs: url (required), session_id (required), dry_run.
Initialize new security assessment session
Inputs: target (required).
JWT security testing
Inputs: token (required), session_id (required), url, dry_run.
Fast port scanner
Inputs: target (required), session_id (required), ports, dry_run.
Web server vulnerability scanner
Inputs: url (required), session_id (required), consent, dry_run.
Port scanning and service detection
Inputs: host (required), session_id (required), ports, consent, +1 more.
Fast vulnerability scanner with templates
Inputs: url (required), session_id (required), dry_run.
Health check for the PenTest MCP server
Inputs: no named parameters.
Fast triage scan (10-15 min): WAF detection, subdomain enum, top-port scan, header analysis, TLS audit, tech fingerprinting, sensitive file discovery, SSRF probe, CSRF check
Inputs: target (required), consent (required), dry_run.
JavaScript library vulnerability scanner
Inputs: url (required), session_id (required), dry_run.
SQL injection detection and exploitation
Inputs: url (required), session_id (required), params, consent, +1 more.
TLS/SSL configuration analyzer
Inputs: host (required), session_id (required), port, consent, +1 more.
Passive subdomain enumeration
Inputs: domain (required), session_id (required), consent, dry_run.
TLS/SSL security testing
Inputs: host (required), session_id (required), port, dry_run.
OSINT gathering from public sources
Inputs: domain (required), session_id (required), dry_run.
Secret and credential scanner
Inputs: target (required), session_id (required), dry_run, scan_type.
Web Application Firewall detection
Inputs: url (required), session_id (required), dry_run.
Web application fuzzer
Inputs: url (required), session_id (required), dry_run, fuzz_param.
Web technology fingerprinting
Inputs: url (required), session_id (required), consent, dry_run.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 31 tools
Many tools have overlapping purposes: nmap/masscan both scan ports, sslyze/testssl both audit TLS, ffuf/gobuster/wfuzz all fuzz for directories, and subfinder/amass/dnsrecon all do subdomain/DNS enumeration. The descriptions are lean and don't clarify when to choose one over the other.
The tool names are a mix of raw external tool names (nmap, sqlmap, gobuster) and server-specific snake_case verbs (init_session, get_report, quick_scan). This makes the naming pattern unpredictable and inconsistent across the API surface.
31 tools is too many for a focused MCP server, especially when several are near-duplicates (subfinder/amass/dnsrecon, ffuf/gobuster/wfuzz, sslyze/testssl). A consolidated surface with fewer, higher-level scan operations would be easier for an agent to use.
The server covers reconnaissance, scanning, web fuzzing, TLS testing, secret detection, and report generation, which is solid for web-focused pentesting. However, session lifecycle support is thin (init_session/get_report only) and there are no explicit post-exploitation or broader infrastructure testing tools, leaving noticeable gaps for a general 'PenTest' role.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Autonomous AppSec & DAST scanner across 12 security domains (260+ controls) with 3-Layer Triage.
Test your AI agents for security and safety weaknesses, and re-verify the fixes.
