io.github.cyanheads/pentest-mcp-server

Offline methodology engine for authorized penetration testing, CTF, and security research.

0 tools GitHub

No known CVEs

No license

Maintenance unknown

No commit data

Works with most clients

Transport:

0 tools

Token cost not measured

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-cyanheads-pentest-mcp-server": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-cyanheads-pentest-mcp-server)](https://mcppedia.org/s/io-github-cyanheads-pentest-mcp-server)

Read me

What io.github.cyanheads/pentest-mcp-server does

Offline methodology engine for authorized penetration testing, CTF, and security research.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

0/100across 5 weighted dimensions

How we score →

0255075100

−100

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.cyanheads/pentest-mcp-server safe to use?: io.github.cyanheads/pentest-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.cyanheads/pentest-mcp-server?: io.github.cyanheads/pentest-mcp-server can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.cyanheads/pentest-mcp-server?: io.github.cyanheads/pentest-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Similar servers

Others in security

View all →

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

9.0k 3

Mcpki Server92

mcpki-server is the backend infrastructure for https://www.mcpki.org, enabling secure public key management and autonomous certificate handling for large language models (LLMs).

MCP Security Weekly

Get CVE alerts and security updates for io.github.cyanheads/pentest-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Tools

Six tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:

Tool

Description

pentest_guide

Returns a step-by-step methodology playbook for the given attack vector, scoped to authorized testing. Each phase covers what to look for, tools, detection indicators for defenders, and mitigations.

pentest_analyze_response

Analyzes a raw server response (headers + body) from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities — each finding paired with remediation.

pentest_lookup_technique

Looks up a MITRE ATT&CK technique by ID or keyword. Returns description, tactics, detection data sources, behavioral indicators, mitigations, and real-world procedure examples.

pentest_map_techniques

Given a target profile (stack, services, auth type, OS), returns ranked ATT&CK techniques and

Frequently Asked Questions

Is io.github.cyanheads/pentest-mcp-server safe to use?

io.github.cyanheads/pentest-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.cyanheads/pentest-mcp-server?

io.github.cyanheads/pentest-mcp-server can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with io.github.cyanheads/pentest-mcp-server?

io.github.cyanheads/pentest-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

@cyanheads/pentest-mcp-server

Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP. STDIO or Streamable HTTP.

6 Tools

Public Hosted Server: https://pentest.caseyjhand.com/mcp

Authorized use only. This server is designed for penetration testers, red teamers, CTF players, security researchers, and students working on systems they own or have explicit written authorization to test. Users are solely responsible for ensuring their testing is lawful and appropriately scoped. Unauthorized access to computer systems is illegal — this server does not and cannot enforce authorization on your behalf.

Dual-audience design. Every offensive technique is paired with detection indicators and mitigations. Blue teamers, developers, and anyone building detection coverage will find the methodology and ATT&CK data as useful as the red team workflows.

Tools

Six tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:

Tool	Description
`pentest_guide`	Returns a step-by-step methodology playbook for the given attack vector, scoped to authorized testing. Each phase covers what to look for, tools, detection indicators for defenders, and mitigations.
`pentest_analyze_response`	Analyzes a raw server response (headers + body) from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities — each finding paired with remediation.
`pentest_lookup_technique`	Looks up a MITRE ATT&CK technique by ID or keyword. Returns description, tactics, detection data sources, behavioral indicators, mitigations, and real-world procedure examples.
`pentest_map_techniques`	Given a target profile (stack, services, auth type, OS), returns ranked ATT&CK techniques and

... View full README on GitHub