Installation and configuration

Quick start

Requires Node.js 22.19.0 or newer and the host binaries for the tools you intend to use. The Docker image includes the listed tools; native installations must provide them in PATH.

npm install -g pentest-mcp
pentest-mcp

Stdio is the default for local MCP clients. pentest-mcp inspector starts the bundled MCP Inspector against this server over stdio; Inspector flags can be forwarded, for example pentest-mcp inspector --help.

Set PENTEST_DATA_DIR to choose the local evidence directory. Otherwise the server uses $XDG_DATA_HOME/pentest-mcp when that variable is set, or ~/.pentest-mcp. Evidence and report files are stored with private directory and file permissions. Treat raw outputs, hashes, captured traffic, and reports as client-sensitive data; control access, retention, and backups accordingly.

Required Host Tools (non-Docker runs)

Ensure the binaries are in PATH:

which nmap john hashcat gobuster nikto subfinder httpx-toolkit ffuf nuclei hydra sqlmap tcpdump

If httpx-toolkit is not installed, a validated ProjectDiscovery httpx binary is accepted as fallback.