Pentest Tools MCP server
{
"mcpServers": {
"pentest-tools": {
"type": "http",
"url": "https://mcp.pentest-tools.com/mcp"
}
}
}{
"mcpServers": {
"pentest-tools": {
"type": "http",
"url": "https://mcp.pentest-tools.com/mcp"
}
}
}{
"mcpServers": {
"pentest-tools": {
"type": "http",
"url": "https://mcp.pentest-tools.com/mcp"
}
}
}{
"servers": {
"pentest-tools": {
"type": "http",
"url": "https://mcp.pentest-tools.com/mcp"
}
}
}{
"mcpServers": {
"pentest-tools": {
"type": "http",
"url": "https://mcp.pentest-tools.com/mcp"
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsonversion 0.1.13
What it does
MCP server for Pentest-Tools.com that lets you run vulnerability scans, manage findings, and generate reports through your AI assistant. It connects Claude, Cursor, VS Code, Gemini CLI, and other MCP-compatible tools to your Pentest-Tools account.
- Run Website Scanner, Subdomain Finder, and Network Scanner scans on targets through natural language prompts.
- Triage and manage vulnerability findings across workspaces and scans via your LLM.
- Generate and download security reports, including translated versions for different teams.
Tools this server exposes
| Tool | Does |
|---|---|
| run_website_scanner | Execute a Website Scanner scan on a URL with configurable scan types. |
| run_subdomain_finder | Run a Subdomain Finder scan to discover subdomains. |
| run_network_scanner | Execute a Network Scanner scan on network infrastructure. |
| manage_targets | Create, list, and manage scan targets. |
| manage_workspaces | Create and manage workspaces to organize scans and findings. |
| manage_scans | List, view, and manage vulnerability scans. |
| manage_findings | View, triage, and manage vulnerability findings from scans. |
| generate_report | Generate security reports from scan findings. |
| download_report | Download generated reports, with support for translated versions. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.