Pentest MCP
A Model Context Protocol server that integrates essential penetration testing tools (Nmap, Gobuster, Nikto, John the Ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conver
What is Pentest MCP?
Pentest MCP is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to model context protocol server that integrates essential penetration testing tools (nmap, gobuster, nikto, john the ripper) into a unified natural language interface, allowing security professionals to...
A Model Context Protocol server that integrates essential penetration testing tools (Nmap, Gobuster, Nikto, John the Ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conver
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- A Model Context Protocol server that integrates essential pe
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx pentest-mcpConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Pentest MCP
Pentest MCP is a Model Context Protocol server that integrates professional penetration testing tools — including Nmap, Gobuster, Nikto, John the Ripper, Hashcat, Subfinder, ffuf, Nuclei, and Hydra — into a natural language interface for security professionals. It supports STDIO, HTTP, and SSE transports with optional OIDC-based authentication for team deployments. Security engineers use it to orchestrate complex multi-tool assessments by describing objectives conversationally rather than memorizing individual tool flags.
Prerequisites
- Node.js 18+ and npm installed
- Penetration testing tools installed on the host: nmap, gobuster, nikto, john, hashcat (install via your OS package manager)
- Authorization to test the target systems — this tool is for professional use only
- An MCP-compatible client such as Claude Desktop or Cursor
Install pentest-mcp globally
Install the pentest-mcp package globally via npm to make it available as a command on your system.
npm install -g pentest-mcpInstall required system tools
Ensure the underlying penetration testing tools are available on your system. On Debian/Ubuntu, install common tools with apt.
sudo apt-get install -y nmap gobuster nikto john hashcatVerify tools are accessible
Confirm that nmap and other tools are on your PATH and accessible by the MCP server process.
which nmap gobuster nikto john hashcatConfigure your MCP client
Add the pentest-mcp server to your Claude Desktop configuration using npx to run it in stdio mode.
{
"mcpServers": {
"pentest": {
"command": "npx",
"args": ["-y", "pentest-mcp"]
}
}
}Start an assessment
With the server running, use Claude Desktop to start a penetration test by describing the target and scope in natural language.
Pentest MCP Examples
Client configuration
Claude Desktop configuration for pentest-mcp running in stdio mode via npx.
{
"mcpServers": {
"pentest": {
"command": "npx",
"args": ["-y", "pentest-mcp"]
}
}
}Prompts to try
Example prompts for security professionals using pentest-mcp with Claude Desktop.
- "Run an nmap SYN scan on 192.168.1.0/24 and identify open ports"
- "Enumerate subdomains for example.com using subfinder with recursive search"
- "Probe these hosts with httpx and show me titles and status codes: [list]"
- "Run a nuclei scan on https://example.com targeting high and critical severity templates"
- "Generate a wordlist based on the company name 'Acme Corp' for use with gobuster"Troubleshooting Pentest MCP
Tool returns 'command not found' errors for nmap or gobuster
The underlying tools must be installed separately and on the PATH of the process running pentest-mcp. Install them via your system package manager and verify with `which nmap`. On macOS, use `brew install nmap`.
Scans time out or return no results
Ensure the target is reachable from your machine and that firewall rules allow the scan traffic. For nmap, try adding `--max-retries 1 --host-timeout 30s` flags to your request. Verify you have the necessary network permissions.
Authentication errors when using HTTP/SSE transport
When MCP_AUTH_ENABLED is set, you must provide a valid OIDC token. Check that MCP_OIDC_ISSUER and MCP_AUTH_AUDIENCE are correctly set to match your identity provider. For local testing, switch to stdio transport which has no auth requirements.
Frequently Asked Questions about Pentest MCP
What is Pentest MCP?
Pentest MCP is a Model Context Protocol (MCP) server that model context protocol server that integrates essential penetration testing tools (nmap, gobuster, nikto, john the ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conver It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Pentest MCP?
Follow the installation instructions on the Pentest MCP GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with Pentest MCP?
Pentest MCP works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Pentest MCP free to use?
Yes, Pentest MCP is open source and available under the MIT License license. You can use it freely in both personal and commercial projects.
Pentest MCP Alternatives — Similar Security Servers
Looking for alternatives to Pentest MCP? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Pentest MCP in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Pentest MCP?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.