Docker

The Compose image below runs the Pentest MCP server. The managed Codex assessment uses a different pinned image and Docker context; follow the container assessment guide for that worker. Its Codex container has bridge networking for model access, while the scanner MCP child runs on the host. Neither side has a destination egress allowlist here, so apply host and VM network policy before client testing.

Docker Compose defaults to a local stdio service with no published port. It runs as an unprivileged user, drops Linux capabilities, and persists scan records, reports, and the scan journal in the host data directory. Prepare that private directory before starting the container:

cp .env.example .env
mkdir -p .pentest-data
chmod 700 .pentest-data
docker compose run --build --rm -T pentest-mcp

The host directory is PENTEST_DATA_HOST_DIR (default ./.pentest-data), mounted at the container's PENTEST_DATA_DIR=/var/lib/pentest-mcp. On Linux, make the host directory writable by container UID 1000 before the first run (for example, sudo chown 1000:1000 .pentest-data). Compose will refuse to auto-create a missing bind path. Protect and back up this directory as client evidence; it is excluded from Git and the Docker build context.

HTTP access

The HTTP profile is opt-in and publishes to 127.0.0.1 by default. It always enables bearer authentication. In .env, configure exact MCP_ALLOWED_ORIGINS, MCP_OIDC_ISSUER, MCP_AUTH_AUDIENCE, an HTTPS MCP_PUBLIC_BASE_URL, and either MCP_OIDC_JWKS_URL or MCP_OIDC_INTROSPECTION_URL. Set OAuth client credentials if introspection requires them. The server fails startup if these listener and verifier requirements are missing. Keep MCP_REMOTE_EXECUTION_ENABLED=false until this is a dedicated trusted scanner deployment, then explicitly set it to true to permit authenticated scanner calls.

chmod 600 .env
docker compose --profile http up --build pentest-mcp-http

The endpoint is http://127.0.0.1:8000/mcp unless you change MCP_SERVER_PORT. Compose uses that same port inside and outside the container. Compose binds the service to 0.0.0.0 inside its network namespace, so the HTTPS public base URL and identity settings are required even when the published host port remains on loopback. For remote clients, keep the Compose listener on loopback and put a TLS reverse proxy with access controls in front of it. Set MCP_BIND_ADDRESS to a non-loopback address only when that address and its firewall policy are intentional; bearer tokens must travel over TLS.