The most autonomous pentesting AI on the market. MCP server + Python agents with 150+ security tools, exploit chaining, and PoC validation.
{
"mcpServers": {
"pentest-ai": {
"command": "<see-readme>",
"args": []
}
}
}No install config available. Check the server's README for setup instructions.
Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
The most autonomous pentesting AI on the market. MCP server + Python agents with 150+ security tools, exploit chaining, and PoC validation.
Is it safe?
No package registry to scan.
No authentication — any process on your machine can connect.
MIT. View license →
Is it maintained?
Last commit 4 days ago. 8 stars.
Will it work with my client?
Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
No automated test available for this server. Check the GitHub README for setup instructions.
No known vulnerabilities.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationHave you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Search, evaluate, and compare 17,000+ MCP servers — each scored on security, maintenance, and efficiency.
AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.
MCP server for scanning and remediating hardcoded secrets using GitGuardian’s API. Detect over 500 secret types and prevent credential leaks before code goes public.
Trust infrastructure for AI agents — DIDs, reputation, verifiable credentials, USDC.
MCP Security Weekly
Get CVE alerts and security updates for Pentest Ai and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
MCP server + 10 AI agents + 150+ security tools. One command.
Website · Quick Start · Agents · 150+ Tools · Claude Code Agents
pentest-ai connects AI to 150+ real security tools through the Model Context Protocol. It works with Claude Desktop, Cursor, VS Code Copilot, Windsurf, or any MCP-compatible client.
Point it at a target. It runs recon, finds vulnerabilities, chains them into full compromise paths, validates every finding with a working proof of concept, and generates professional reports with detection rules for your blue team.
No vendor lock-in. No cloud dependency. Runs locally.
You: "Run a full assessment against staging.example.com"
pentest-ai:
1. Recon > nmap, subfinder, amass, DNS enum, OSINT
2. Web scan > nuclei, sqlmap, nikto, ffuf, dalfox
3. Cloud audit > prowler, ScoutSuite, pacu
4. AD attack > BloodHound, Impacket, CrackMapExec
5. Chaining > Links 3 medium findings into domain admin
6. Validation > Generates safe PoC for each finding
7. Detection > Sigma + SPL + KQL rules for every attack
8. Report > Professional markdown/HTML/PDF with CVSS scores
pip install -e .
pentest-ai start target.example.com
That starts the MCP server. Connect from your AI client and start talking to it.
Add this to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"pentest-ai": {
"command": "pentest-ai",
"args": ["server", "start"]
}
}
}
Add the same MCP server config in your editor's settings. Any client that speaks MCP will work.
10 specialist agents, each focused on a specific attack surface.
| Agent | What It Does | |-------|-------------| | Recon | Port scanning, service fingerprinting, subdomain enum, OSINT | | Web | SQLi, XSS, SSRF, IDOR, auth bypass, API testing, business logic | | AD | BloodHound, Kerberoasting, AS-REP, delegation abuse, DCSync | | Cloud | AWS/Azure/GCP misconfigs, IAM escalation, exposed services | | Mobile | Android/iOS app analysis, API interception, SSL pinning bypass | | Wireless | WPA/WPA2/WPA3, evil twin, rogue AP, Bluetooth | | Social Engineer | Phishing campaign design, pretexting, vishing frameworks | | Exploit Chain | Correlates findings across agents into multi-step attack paths | | PoC Validator | Auto-generates safe, non-destructive proofs of concept | | Report + Detection | Professional reports with Sigma, SPL, and KQL rules |
Every agent stores findings in a local SQLite database. Findings persist across sessions and feed into the chaining engine.
158 security tools organized into 6 categories. pentest-ai wraps each tool with structured output parsing so findings flow directly into the database.