mcpbeat Sign in

Pentest MCP Server

by cyanheads Your server? Claim it
answering

Pentest MCP Server is answering right now. Last checked 9 min ago. 305 installs a week from npm. It exposes 7 tools. Last commit 30 Oct 2026.

Offline methodology engine for authorized penetration testing, CTF, and security research.

Installs per day peak 224 · avg 32 · +98% w/w
a month agotoday
Uptime history 91 days of history · worst day 0%
91 days agonow
100.0%
Uptime 24h
91 of 91 checks
7
Tools
read from the server
581 ms
Response time
average over 24h
305
Installs / week
npm and PyPI

What changed 23

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 22 August 2026. No other catalogue keeps this.

30 Oct a tool changed version
15 Oct 2 tools appeared pentest_encode_payload, pentest_get_guide
15 Oct 2 tools disappeared pentest_encode, pentest_guide
15 Oct a tool changed version
9 Oct a tool changed version
20 Sep a tool changed version
22 Aug 7 tool descriptions were rewritten pentest_analyze_response, pentest_encode, pentest_generate_payloads and 4 more
22 Aug 7 tools changed the parameters they ask for pentest_analyze_response, pentest_encode, pentest_generate_payloads and 4 more
22 Aug a tool changed version

What the code does

We read the source, 2 d ago · tools taken from the live server · rules 995398eba69f

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Claims local-only, but the code calls out src/services/methodology/methodology-service.ts:354 
              'AWS: 169.254.169.254/latest/meta-data/ → /latest/meta-data/iam/security-credentials/. GCP: 169.254.169.254/computeMetadata/v1/ (requires Metadata-Flavor: Google header). Azure: 169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true header).',
Reaches cloud metadata service src/services/methodology/methodology-service.ts:354 
              'AWS: 169.254.169.254/latest/meta-data/ → /latest/meta-data/iam/security-credentials/. GCP: 169.254.169.254/computeMetadata/v1/ (requires Metadata-Flavor: Google header). Azure: 169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true header).',

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Pentest MCP Server and you get told the day something new turns up.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

run in your terminal
claude mcp add pentest-mcp-server --transport http https://pentest.caseyjhand.com/mcp
Settings → Connectors → Add custom connector, then paste this address
https://pentest.caseyjhand.com/mcp
~/.codex/config.toml
[mcp_servers.pentest-mcp-server]
url = "https://pentest.caseyjhand.com/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "pentest-mcp-server": {
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "pentest-mcp-server": {
      "type": "http",
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}

Available tools 7

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

pentest
pentest_analyze_response
Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.
pentest_encode_payload
Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.
pentest_generate_payloads
Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.
pentest_get_guide
Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.
pentest_lookup_group
Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.
pentest_lookup_technique
Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.
pentest_map_techniques
Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

pentest_encode
removed 15 Oct 2026
pentest_guide
removed 15 Oct 2026

Endpoints

URLTransportStateLatencyChecked
https://pentest.caseyjhand.com/mcp streamable-http answering 625 ms 9 min ago

Alternatives to Pentest MCP Server

same job, measured the same way
Cybersec Toolkit
by 26zl

Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.

local only
Operant MCP
by operantlabs

Security testing MCP server for penetration testing, forensics, and vulnerability assessment

78 installs/wk local only
Httpstatus
by httpstatus

AI-callable tools for API mocking, testing, monitoring, security, and automation.

answering
Raven Nest MCP
by tidynest

AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints

local only
T
ThornGuard
by qwady-thorns

Remote MCP security gateway for auth, redaction, policy enforcement, and audit logging.

local only
Guarita
by pitroldev

Authorized security scans, evidence, fix prompts and retests for AI-built web apps.

answering
MCP Niubiz
by codespar

MCP server for Niubiz — Peru card acquirer: security token, session, authorize, reverse

33 installs/wk local only
Offense
by offense-research

Security tools for coding agents: dependency advisory audits and evidence for remediation.

1 tools answering

Pentest MCP Server — questions

Answers built from our own checks of this server.

What can Pentest MCP Server do?
It exposes 7 tools, read directly from the server on our last check. Among them: pentest_analyze_response, pentest_encode_payload, pentest_generate_payloads, pentest_get_guide, pentest_lookup_group, pentest_lookup_technique and 1 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Pentest MCP Server working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 581 ms. The bar chart above shows every period we have measured.
Did Pentest MCP Server ever remove tools?
Yes. pentest_encode, pentest_guide are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.
How do I connect Pentest MCP Server?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Pentest MCP Server need an API key?
No. Pentest MCP Server completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 7 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Pentest MCP Server?
It answers our handshake in 581 ms on average, which is faster than 19% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use Pentest MCP Server?
The npm package @cyanheads/pentest-mcp-server was installed 305 times in the last week. Week over week that is +98%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Pentest MCP Server open source?
The code is open source: it is published under the Apache-2.0 licence, written in TypeScript and 1 stars on GitHub. The licence covers the code in the repository, not the hosted service at pentest.caseyjhand.com, which runs on its operator's own terms.