io.github.cyanheads/pentest-mcp-server

io.github.cyanheads/pentest-mcp-server · v0.2.0

Offline methodology engine for authorized penetration testing, CTF, and security research.

MCPremotelocal · npmno credentialsSecurityAI & LLMResearch & education

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 7 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 80/100

What it does: 7 tools · 7 read, 0 write · Security, AI & LLM, Research & education

Test call pentest_analyze_response: failed — tool error: Error: At least one of response_headers or response_body must be provided. Recovery: Provide at least one of response_h (1,145 ms)

How the rating is made

Answers without login: +30
Speed of first answer: +10
Lists tools: +10
Tool descriptions: +15
Parameter descriptions: +10
Read/write annotations: +5
Safe test call: 0
More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL

https://pentest.caseyjhand.com/mcp

Package

registry:   npm
identifier: @cyanheads/pentest-mcp-server
version:    0.2.0
transport:  stdio

Tools

7 tools listed at last check

pentest_get_guide Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool s
pentest_analyze_response Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associa
pentest_lookup_technique Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.
pentest_lookup_group Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.
pentest_map_techniques Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.
pentest_generate_payloads Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.
pentest_encode_payload Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.

Badge

Markdown for your README

[![Connect-MCP](https://clawy.uk/mcp/badge/io.github.cyanheads/pentest-mcp-server.svg)](https://clawy.uk/mcp/s/io.github.cyanheads/pentest-mcp-server)

Repository