MCP server for authorized assessments
Pentest MCP gives a researcher or a tool-using assessment agent one scoped interface for discovery, validation, capture, credential checks, local audit, evidence retrieval, and report preparation. Each active tool call is tied to an engagement and a durable record, and the researcher verifies findings before publication.
npm install -g pentest-mcpThe declared-target check is an operational guardrail, not a complete network boundary. Use the server only on systems covered by explicit written authorization.
Scope declared
createEngagement
Tools execute
nmapScan
Evidence sealed
getEngagementRecord
Analyst publishes
publishAgentReport
Lineage
Every conclusion in a report traces back through an evidence record, the tool call that made it, and the correlated scope decision. Four stages, each enforced by the server instead of by a prompt.
An engagement records the authorization reference, allowed and excluded targets, the authorization period, and optional testing windows. A saved plan fixes the exact tool names the work may use.
createEngagementsaveAssessmentPlan
Register an engagement →A researcher or a tool-using agent calls scoped MCP tools. The server rejects any call omitted from the plan’s allowedToolNames before its handler runs, and active tools also pass the engagement’s target and time gate.
A successful tool response includes a recordId for its stored evidence. Records persist across restarts, with private directory and file permissions, and reports carry an evidence index of raw-output SHA-256 hashes.
listEngagementRecordsgetEngagementRecord
Evidence and reports →A report writer in a separate context drafts from a bounded evidence packet. An analyst verifies candidates against source records and publishes deliberately.
draftAssessmentReportpublishAgentReport
Context quarantine →What counts as a finding
Why a server
An MCP transport connection is not itself evidence of a test. The durable record and the matching scope decision are the acceptance evidence.
Active tools pass the engagement’s target and time gate before they run. A plan, repository, listening port, or model cannot expand the registered scope.
Register an engagement →The server rejects any call omitted from the plan’s allowedToolNames before its handler runs, leaving a failed audit receipt.
Client intake and plan →Start and completion receipts record argument digests, correlation IDs, timing, and outcome. Records persist across restarts.
Recovery and audit behavior →A missing binary or failed command is a tool error, not evidence that a target is clean. Failed or denied actions describe coverage and cannot support a finding.
Operational limits →The assessment worker and the report writer are separate contexts. The report writer receives a bounded evidence packet and no scanner connection.
Context quarantine →Scanner output remains an observation until a researcher verifies it. publishAgentReport never promotes candidates automatically.
Evidence and reports →The prompt is guidance
assessment-campaign-v2
The server is enforcement
src/index.ts
Workflow
The October 2026 workflow keeps the person who writes the scope, the agent that runs tools, the model that drafts, and the analyst who publishes in separate hands.
Start from signed authorization and rules of engagement, then save the assessment plan. The operator chooses a stable engagementId.
createEngagementsaveAssessmentPlan
Read the guide →A researcher or a fresh Codex process in the managed assessment container sees the complete catalog, while the plan’s exact allowedToolNames list permits only selected calls.
getRuntimeStatusrunAgentAssessment
Read the guide →Review recordId values and correlated scope decisions. Import external research with recordResearchActivity; the import does not replace MCP tool use.
listEngagementRecordsgetEngagementRecordrecordResearchActivity
Read the guide →Draft from the complete evidence ledger, inspect candidate findings against source records, and publish only analyst-verified findings.
draftAssessmentReportpublishAgentReportgetClientReport
Read the guide →Human role separation still requires separate accounts or operating procedures. Attribution fields are not digital signatures.
Scope author
Assessment worker
Report writer
Analyst reviewer
Providers
Codex, Claude, Daybreak Blue/Red, and API models are replaceable reasoning engines. Pentest MCP is the assessment control plane, so the scope, audit trail, and publication gate do not change with the model.
Optional and account-specific
Each provider checks access independently. A successful CLI sign-in or API key alone does not establish the right program grant, and a missing Daybreak grant cannot block an ordinary ready CLI or API profile.
Target authorization and provider entitlement are separate records, and a model cannot expand the target scope.
Daybreak and Glasswing boundaries →Optional, off by default
Enable it per assessment profile for an untrusted or refusal-resistant model. It adds duplicate-action, token-accounting, and finish-reason circuit breakers. It never disables authorization controls, so these stay enforced for every assessment model:
Routes through the docs
Pages are generated from the repository’s maintained Markdown and TypeScript source, so the guide, the tool catalog, and the code cannot drift apart silently.
Install the package, choose the private evidence directory, and confirm which scanner binaries your host provides.
Register explicit authority, save a plan with exact tool names, and collect authorized wordlist clues.
Choose a provider and data policy, run the tool-using session, and recover safely from an interrupted run.
Configure bearer scopes and origins, managed workers, operational limits, and the capture profile.
Follow a record from its scope decision to a report, and see how acceptance is verified.
Look up a tool’s schema, the target gate’s limits, or an environment variable.
Extracted from src/index.ts at build time and grouped by the README tool inventory.
open-world: interacts with systems outside the server
Open source
Pentest MCP is released under AGPL-3.0-or-later. Its production campaign design is informed by Pliny’s T3MP3ST, which uses the same license, and the integration decisions record where the trust model deliberately differs.