T3MP3ST provenance and decisions

T3MP3ST influence

T3MP3ST is AGPL-3.0-or-later. Pentest MCP is now AGPL-3.0-or-later too. The bounded ReAct loop, duplicate-call guard, recovery journal, strict action boundary, protected evidence context and evidence gate are informed by T3MP3ST commit 29824d5625ede419ac8cdae418c8f4c72c6270f7. See third-party provenance and the source comparison.

T3MP3ST review and Pentest MCP integration decisions

Review date: 2026-10-25 Upstream: Pliny's T3MP3ST commit 29824d5625ede419ac8cdae418c8f4c72c6270f7, tag v1.0.0License: AGPL-3.0-or-later

The local checkout was fetched from upstream before review. T3MP3ST does not require Daybreak. It supports API providers and keyless local agent CLIs including Codex and Claude. That provider independence is a product requirement for Pentest MCP.

Pentest MCP is now AGPL-3.0-or-later, with the full license text in LICENSE and design attribution in THIRD-PARTY.md. This resolves the prior MIT/GPL metadata conflict and permits deliberate reuse under the repository's chosen license. Third-party dependency licenses remain their own licenses.

What T3MP3ST does better

T3MP3ST mechanism	Why it matters	Pentest MCP response
Persistent ReAct loop	The model repeatedly chooses a tool, sees the result and adjusts, instead of producing one free-form answer	Managed Codex/Claude sessions use Pentest MCP as their tool loop; assessment-campaign-v2 requires the observe/record/reassess cycle
Provider-neutral backbones	The security workflow is useful without one access program	Local Codex, local Claude, container Codex, SSH draft profiles, OpenAI and Anthropic are profile choices; Daybreak is optional
Exact tool-call boundary	Unknown tools, malformed JSON and guessed values are rejected	MCP schemas validate every call; plan allowlists and scope gates add server-side authority
Duplicate detection and anti-stall reflection	Agents otherwise repeat a failed or familiar action	Worker MCP rejects identical successful assessment calls; four no-progress turns trigger reflection in campaign state
Recovery snapshots and idempotency keys	Restarting a campaign must not replay an ambiguous network action	pentest_mcp_campaign/v1 uses revisioned snapshots, attempt budgets and ambiguous-after-crash blocking
Protected context compression	Scope, evidence and unresolved errors must survive long runs	Assessment/report prompts protect scope, stop conditions, evidence IDs and digests; the server ledger remains authoritative
Tool-provenance findings	Model prose cannot be the source of a vulnerability	Candidates require successful record IDs; analyst publication supplies separately verified findings
Local-agent connectors	A useful workflow can run without API keys	local-agent permits CLI processing and refuses hosted API profiles before sending context

What Pentest MCP keeps different

T3MP3ST's public MCP server exposes a high-level security_recon tool around its internal Arsenal. Pentest MCP exposes the individual scoped methods. This gives the calling agent exact per-tool schemas and creates a scope decision and audit receipt for every action.

Pentest MCP keeps its engagement registry, owner boundary, exact target and time gates, parent/worker cancellation, private hash-checked evidence store, worker-to-parent import map, and analyst publication gate. It does not import T3MP3ST's broad private-network defaults, local-agent home restoration, or report language that can imply zero findings means no vulnerabilities.

Implemented changes

1. Pentest MCP and package metadata are AGPL-3.0-or-later.
2. The public synthetic-fixture profile and packaged fake receipts were removed.
3. Student Mode, setMode and userModeHint were removed. Research logging always runs.
4. Local codex exec and claude -p can run with dedicated account profiles and no LLM API key.
5. Container Codex remains available for stronger model-process isolation.
6. local-agent and approved-provider are separate data policies. Missing Daybreak access no longer blocks local agent use.
7. Campaign state, duplicate-call control, no-progress tracking, crash blocking and idempotency fields were added with tests. The user-facing assessment runner now blocks an unresolved start receipt, and reconcileAgentAssessment requires stopped-process confirmation, reviewer identity and rationale before a retry while revoking the former worker scope when available.
8. Assessment and report prompts were replaced with evidence-bound versioned instructions.
9. Real Nmap, ProjectDiscovery HTTPX, Nuclei, ffuf, subfinder, Hydra and sqlmap dependencies were installed locally; runtime identity validation prevents Python HTTPX from satisfying the ProjectDiscovery check.
10. scripts/run-real-acceptance.mjs requires explicit authorization and targets, runs real scanners, and can require separate assessment and report profiles.

Real acceptance result

The final local Faxbot loopback acceptance used Daybreak Blue at xhigh as the assessment worker and a separate Daybreak Blue xhigh report worker.

• assessment run: ff193ff0-58c3-4491-8990-a1f1a29f0895;
• real Nmap evidence: rec-06697543-c1de-45d2-acf8-dba15a1a344c;
• real HTTPX evidence: rec-e105d0f3-9946-47a3-836e-30d662132772;
• 40 imported worker records;
• full catalog coverage table with used/skipped reasons;
• separate evidence-only report profile;
• report draft: rec-48c49b0c-c78c-43d7-b378-7b85ace55841;
• report prompt: report-evidence-v4;
• six report evidence items, four cited observations, zero candidate findings, three recommendations and seven limitations.

One malformed research-note target was denied by the scope gate and produced no network action. The acceptance receipt is private and excluded from package contents. This verifies a real MCP benefit: tool discovery, enforced authority, real tool execution, per-call logging, a visible denial, evidence import, stable citations and a separate report context.

Remaining work

• Add native tool-calling loops for OpenAI and Anthropic assessment profiles; their current API adapters are report-only.
• Implement remote assessment seeding/import before enabling SSH assessors.
• Add OS/network egress enforcement for the host scanner process.
• Add signed append-only anchoring outside the local evidence directory.
• Build a controlled benchmark that compares the same tasks with and without Pentest MCP and refuses a product claim when the MCP adds no capability, auditability or report quality.

Source locations reviewed

• src/agent/index.ts: bounded ReAct loop, concurrency, duplicate detection and no-progress reflection.
• src/mission/recovery.ts: revisioned recovery snapshots, idempotency keys and ambiguous in-flight blocking.
• src/llm/tool-call-boundary.ts: strict action contract and narrow JSON repair.
• src/llm/context-compression.ts: protected evidence context and retained/summarized/dropped accounting.
• src/evidence/gate.ts: evidence-backed finding promotion.
• src/agent/local-agents.ts and src/llm/index.ts: provider and local CLI support.
• src/reporting/auto-report.ts: useful automation shape, but not adopted as the Pentest MCP report trust model.