Documentation
Use this documentation for the complete Pentest MCP workflow: declare authority, configure the server, run only approved tools, retain durable evidence, separate assessment and report contexts, and publish only analyst-verified findings.
Start here
| I want to… | Go to |
|---|---|
| Install the server or run a first engagement | Start |
| Plan, execute, log, review, and report an assessment | Workflow |
| Choose a model or provider route | Providers |
| Deploy workers, transports, and scanner dependencies | Deployment |
| Find a tool, schema, environment variable, or safety rule | Reference |
| Review acceptance, provenance, releases, and licensing | Project |
Start
Understand the server, install it, and complete the first scoped engagement.
Overview
What Pentest MCP does, how it ties every active tool call to an engagement and a durable record, and where to start.
Installation and configuration
Install the server, choose stdio or HTTP, set the private evidence directory, and prepare scanner binaries.
First engagement
Register explicit authority with createEngagement, run one scoped tool, and retrieve its evidence record.
Workflow
Move from client intake through isolated assessment, durable evidence, review, and publication.
Context quarantine and roles
Scope author, assessment agent, report agent, and analyst reviewer: what each context receives and what it never sees.
Client intake and wordlists
Save a client-specific assessment plan, fix the exact tool allowlist, and collect authorized wordlist clues without exposing them.
Campaign execution and recovery
The end-to-end sequence, tool selection, campaign budgets, ambiguous-interruption blocking, and reconciliation.
Evidence and reports
Evidence-backed client reports, quarantined report drafts, and why candidates never become findings without an analyst.
Providers
Choose an approved model route and understand the boundaries for local, hosted, Daybreak, and Glasswing access.
Provider selection and data policy
Choose among no-model, metadata-only, local-agent, and approved-provider policies, and what each permits.
Guarded local and OpenRouter models
Local OpenAI-compatible servers and OpenRouter under a bounded tool loop, with optional hostile-model protection.
Daybreak and Project Glasswing
Optional, account-specific provider programs: interfaces, grant requirements, and client-work boundaries.
Deployment
Run isolated workers and transports with explicit authentication, process, storage, and network limits.
Managed assessment workers
Context boundaries, worker profiles, scanner readiness, real acceptance, recovery, and remaining deployment limits.
Transport and authentication
Stdio and Streamable HTTP, bearer scopes, origin checks, and the remote execution gate.
Operational limits
Command timeouts, output bounds, cancellation, and what the server does not infer.
Docker
Compose startup as an unprivileged local stdio service, private evidence storage, and the opt-in authenticated HTTP profile.
Capture, wordlists, and Nuclei templates
The Linux capture profile, read-only private wordlists, the reviewed Nuclei template override, and installed image tools.
Reference
Look up every MCP tool, environment setting, security contract, and credential-testing boundary.
MCP tool catalog
Every registered Pentest MCP tool with its title, MCP annotations, and input schema, generated from the TypeScript source.
Tool inventory and caveats
Which tool groups do what, plus the operator caveats for Gobuster, Nikto, capture, local audit, and Nuclei.
Assessment contract and security notice
What the target gate does and does not prove, and the authorization notice that governs every use.
Environment variables
The maintained environment template for transport, storage, scanners, assessment agents, and provider credentials.
Hashcat usage
Execution boundary, evidence handling, and report treatment for the local-stdio Hashcat tool.
Project
Inspect acceptance evidence, upstream provenance, migration history, releases, notices, and the AGPL license.
Acceptance evidence
How real acceptance is verified, with the public-safe OpenRouter receipt for guarded MCP assessment and quarantined drafting.
T3MP3ST provenance and decisions
What Pentest MCP adopted from Pliny’s T3MP3ST and where its trust model deliberately differs.
Migration guide
Moving to the October 2026 engagement, evidence, and managed-assessment model, with historical notes.
Changelog
Versioned changes to Pentest MCP.
Third-party notices
Upstream design provenance and license boundaries.
AGPL-3.0-or-later license
The GNU Affero General Public License, version 3, under which Pentest MCP is released.