Pentest MCP Server

by cyanheads Your server? Claim it

answering

Pentest MCP Server is answering right now. Last checked 13 min ago. 81 installs a week from npm. It exposes 7 tools. Last commit 22 Aug 2026.

Offline methodology engine for authorized penetration testing, CTF, and security research.

Installs per day peak 238 · avg 23 · +118% w/w

a month agotoday

Uptime history 47 days of history · worst day 0%

47 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

349 ms

Response time

average over 24h

Installs / week

npm and PyPI

What changed 15

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 22 August 2026. No other catalogue keeps this.

22 Aug 7 tool descriptions were rewritten pentest_analyze_response, pentest_encode, pentest_generate_payloads and 4 more

22 Aug 7 tools changed the parameters they ask for pentest_analyze_response, pentest_encode, pentest_generate_payloads and 4 more

22 Aug a tool changed version

What the code does

We read the source, 19 h ago · tools taken from the live server · rules 3dff92dd89df

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Claims local-only, but the code calls out src/services/methodology/methodology-service.ts:354

              'AWS: 169.254.169.254/latest/meta-data/ → /latest/meta-data/iam/security-credentials/. GCP: 169.254.169.254/computeMetadata/v1/ (requires Metadata-Flavor: Google header). Azure: 169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true header).',

Reaches cloud metadata service src/services/methodology/methodology-service.ts:354

              'AWS: 169.254.169.254/latest/meta-data/ → /latest/meta-data/iam/security-credentials/. GCP: 169.254.169.254/computeMetadata/v1/ (requires Metadata-Flavor: Google header). Azure: 169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true header).',

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Pentest MCP Server and you get told the day something new turns up.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 13 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add pentest-mcp-server --transport http https://pentest.caseyjhand.com/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pentest-mcp-server": {
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.pentest-mcp-server]
url = "https://pentest.caseyjhand.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "pentest-mcp-server": {
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "pentest-mcp-server": {
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}

This one needs environment variables set before it will start: MCP_HTTP_HOST (The hostname for the HTTP server.), MCP_HTTP_PORT (The port to run the HTTP server on.), MCP_HTTP_ENDPOINT_PATH (The endpoint path for the MCP server.), MCP_AUTH_MODE (Authentication mode to use: 'none', 'jwt', or 'oauth'.), MCP_LOG_LEVEL (Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').). The author declared them in the registry entry; get the values from the project itself.

Available tools 7

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

pentest

pentest_analyze_response

Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.

pentest_encode

Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.

pentest_generate_payloads

Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.

pentest_guide

Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.

pentest_lookup_group

Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.

pentest_lookup_technique

Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.

pentest_map_techniques

Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.

Endpoints

URL	Transport	State	Latency	Checked
https://pentest.caseyjhand.com/mcp	streamable-http	answering	400 ms	13 min ago

Alternatives to Pentest MCP Server

same job, measured the same way

Cybersec Toolkit

by 26zl

Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.

local only

Operant MCP

by operantlabs

Security testing MCP server for penetration testing, forensics, and vulnerability assessment

49 installs/wk local only

Httpstatus

by httpstatus

AI-callable tools for API mocking, testing, monitoring, security, and automation.

answering

Raven Nest MCP

by tidynest

AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints

local only

ThornGuard

by qwady-thorns

Remote MCP security gateway for auth, redaction, policy enforcement, and audit logging.

local only

MCP Niubiz

by codespar

MCP server for Niubiz — Peru card acquirer: security token, session, authorize, reverse

16 installs/wk local only

Filesystem Context

by j0hanz

🔍 Read-only MCP server for secure filesystem exploration, searching, and analysis

local only

AARF Utility Network

by qolapps

Paid AI utilities for web comparison, code checks, document extraction, security, and research.

15 tools answering

Pentest MCP Server — questions

Answers built from our own checks of this server.

What can Pentest MCP Server do?

It exposes 7 tools, read directly from the server on our last check. Among them: pentest_analyze_response, pentest_encode, pentest_generate_payloads, pentest_guide, pentest_lookup_group, pentest_lookup_technique and 1 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Pentest MCP Server working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 349 ms. The bar chart above shows every period we have measured.

How do I connect Pentest MCP Server?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Pentest MCP Server need an API key?

No. Pentest MCP Server completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 7 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Pentest MCP Server?

It answers our handshake in 349 ms on average, which is faster than 44% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use Pentest MCP Server?

The npm package @cyanheads/pentest-mcp-server was installed 81 times in the last week. Week over week that is +118%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Pentest MCP Server open source?

Yes — it is published under the Apache-2.0 licence, written in TypeScript, 1 stars on GitHub and 9 open issues. The source link is on this page, so you can read exactly what it does with your data before you connect it.