Pentest Mcp

Pentest MCP

[](https://smithery.ai/server/@DMontgomery40/pentest-mcp) [](https://mseep.ai/app/fa558a10-f45c-4668-9bb6-15630dd51f27)

Professional penetration-testing MCP server with modern transport/auth support and expanded recon tooling.

What Changed in 0.9.0

• Upgraded MCP SDK to @modelcontextprotocol/sdk@^1.26.0
• Kept MCP Inspector at the latest release (@modelcontextprotocol/inspector@^0.20.0) with bundled launcher
• Streamable HTTP is now the primary network transport (MCP_TRANSPORT=http)
• SSE is still available only as a deprecated compatibility mode
• Added bearer-token auth with OIDC JWKS and introspection support
• Added first-class tools: subfinderEnum, httpxProbe, ffufScan, nucleiScan, trafficCapture, hydraBruteforce, privEscAudit, extractionSweep
• Added report-admin tools: listEngagementRecords, getEngagementRecord
• Added SoW capture flow for reports using MCP elicitation (scopeMode=ask) with safe template fallback
• Hardened command resolution so web probing uses httpx-toolkit (preferred) or validated ProjectDiscovery httpx, avoiding Python httpx CLI collisions
• Integrated bundled MCP Inspector launcher (pentest-mcp inspector)
• Runtime baseline is now Node.js 22.7.5+
• Added invocation metadata in new tool outputs when auth/session context is available

Included Tools

• nmapScan
• runJohnTheRipper
• runHashcat
• gobuster
• nikto
• subfinderEnum
• httpxProbe
• ffufScan
• nucleiScan
• trafficCapture
• hydraBruteforce
• privEscAudit
• extractionSweep
• generateWordlist
• listEngagementRecords
• getEngagementRecord
• createClientReport
• cancelScan

Quick Start

Install

npm install -g pentest-mcp

Run locally (stdio)

pentest-mcp

Launch bundled MCP Inspector (no separate install)

pentest-mcp inspector