Pentest MCP Server

@cyanheads/pentest-mcp-server Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP. STDIO or Streamable HTTP. 7 Tools

Public Hosted Server: https://pentest.caseyjhand.com/mcp

Authorized use only. This server is designed for penetration testers, red teamers, CTF players, security researchers, and students working on systems they own or have explicit written authorization to test. Users are solely responsible for ensuring their testing is lawful and appropriately scoped. Unauthorized access to computer systems is illegal — this server does not and cannot enforce authorization on your behalf.

Dual-audience design. Every offensive technique is paired with detection indicators and mitigations. Blue teamers, developers, and anyone building detection coverage will find the methodology and ATT&CK data as useful as the red team workflows.

Overview

An offline methodology engine for authorized penetration testing, CTFs, and security research, built on MITRE ATT&CK, the OWASP Testing Guide, and annotated payload templates. Generate a phased test plan, map techniques to a target, analyze HTTP responses for leaks, and generate or encode payloads, each paired with detection and mitigation context.

Tools

Capability reference

pentest_get_guide tool

• vector: auth_bypass, idor, ssrf, xss, sqli, xxe, path_traversal, cors, csrf, open_redirect, deserialization, race_condition, ssti, command_injection, or jwt_attack; phase: all (default), recon, enumeration, exploitation, or post_exploitation
• Playbook techniques carry detection and mitigation, with owasp_references, attack_technique_ids, and context-derived nextToolSuggestions
• Optional target_context (stack, waf, recon_notes) narrows the playbook

pentest_analyze_response tool

• Supply response_headers (≤20,000 characters), response_body (≤10,000 characters), or both; optional status_code (100–599) and context (≤2,000 characters). Missing both response fields returns no_input
• Findings carry category, severity (info/low/medium/high), detection, and remediation, ordered by severity descending
• fingerprints (server_software, framework, language, database, cloud_provider, other) and nextToolSuggestions support follow-up calls

pentest_lookup_technique tool

• Supply an ATT&CK ID (T1190, T1059.001) or keyword; include_subtechniques defaults to true
• Returns tactics, platforms, description, detection (summary, data_sources, indicators), mitigations, procedure examples, and attack_version
• Returns no_match when the ID or keyword resolves to nothing

pentest_lookup_group tool

• Supply an ATT&CK group ID (G0007), software ID (S0002), or name/keyword; returns no_match when nothing resolves
• type distinguishes group from software; results include aliases, description (≤800 characters), and attack_version
• techniques_used returns up to 20 techniques with procedure context and technique_id for pentest_lookup_technique

pentest_map_techniques tool

• Supply at least one of stack, services, auth_type (jwt/session_cookie/api_key/oauth2/basic_auth/ntlm/kerberos/none/unknown), or os (linux/windows/macos/unknown); otherwise returns no_profile
• ranked_techniques carries relevance_score, relevance_rationale, detection_opportunity, mitigation_summary, and optional pentest_guide_vector; owasp_test_cases returns up to 10 cases
• limit caps techniques at 1–50 (default 15); enrichment (truncated, shown, cap) discloses the cap

pentest_generate_payloads tool

• category: xss, sqli, ssrf, xxe, path_traversal, ssti, command_injection, open_redirect, csrf, deserialization, jwt, ldap_injection, nosql_injection, or http_header; injection_context: html_attribute, html_body, js_string, js_template, js_script_block, url_parameter, url_path, sql_where, sql_integer, xml_element, xml_attribute, http_header, json_value, cookie_value, file_name, or generic
• count caps templates at 1–20 (default 5); each carries detection_signature and mitigation, with optional encoding applied to every template
• waf_profile: cloudflare, aws_waf, modsecurity_crs, imperva, akamai, f5_bigip_asm, nginx_modsecurity, fortinet_fortiwaf, none (default), or unknown; profiles other than none add waf_bypass_note

pentest_encode_payload tool

• payload accepts up to 10,000 characters; chain applies 1–6 steps left to right from url, double_url, html_entity, unicode, hex, base64, js_escape, null_byte, mixed_case, or comment_break
• Returns intermediate_steps and detection_note; explain (default true) adds decode_path and bypass_rationale
• Returns encoding_error when a transform fails

Features

Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.

Methodology-specific:

• Fully offline at runtime — no external API calls, no credentials required; all data loaded at startup, zero I/O during request handling
• MITRE ATT&CK Enterprise embedded at build time via scripts/refresh-attack.ts and indexed in memory by ID/keyword; fails fast with an actionable error if the data file is missing
• OWASP Testing Guide methodology and payload template library curated as structured TypeScript modules, one per vector/category
• WAF bypass variants keyed by WAF product and attack vector, referencing public research
• All tools annotated readOnlyHint: true, openWorldHint: false — deterministic output from a bounded embedded dataset

Agent-friendly output:

• authorized_use_reminder rendered as the first line of content[] on every guide/payload/encoding response — consistent framing regardless of which surface a client forwards
• Techniques and payloads require detection and mitigation context; response findings require detection and remediation
• attack_version echoed on every ATT&CK-backed response so callers can reason about data vintage
• nextToolSuggestions pre-filled with arguments derived from the current context, reducing agent planning overhead
• pentest-guide supports response-evidence review and ATT&CK detection coverage assessment; available through plugin installs and the MCP resource skill://pentest-guide/SKILL.md

Build-time data step

The server embeds MITRE ATT&CK Enterprise data (~20 MB JSON) fetched by a one-time script into a gitignored path. Self-hosters and Docker builders must run this step before the server will start:

bun run scripts/refresh-attack.ts

This downloads the latest ATT&CK Enterprise JSON from the MITRE GitHub release endpoint, writes it to src/data/attack/enterprise.json (gitignored), and updates src/data/attack/version.ts with a version string such as Enterprise v16.1. The version file is committed; the JSON is not (too large for git history).

The Dockerfile handles this automatically — the build stage runs scripts/refresh-attack.ts before the TypeScript compile, so docker build produces a self-contained image.

If you clone the repo and skip this step, attack-service will fail fast at startup with an actionable error message pointing to scripts/refresh-attack.ts.

Run the script quarterly (or before each release) to pull the latest ATT&CK version.

Getting started

Connect to the hosted instance:

claude mcp add --transport http pentest-mcp-server https://pentest.caseyjhand.com/mcp

Or run it locally:

claude mcp add pentest-mcp-server -- npx -y @cyanheads/pentest-mcp-server

For other clients, add this to the MCP config file:

{

"mcpServers": { "pentest-mcp-server": { "command": "npx", "args": ["-y", "@cyanheads/pentest-mcp-server"] } } }

No API keys required. For Docker or a source build, see Running the server.

Configuration

No API keys required. The server is fully offline at runtime.

| `M