PentestGPT MCP Server

If you want an AI assistant working directly with PentestGPT MCP, the pentestgpt mcp mcp server is the bridge. This project is an advanced penetration testing tool based on the original "PentestGPT" paper. It extends the core capabilities by integrating with Model Context Protocol servers (MCPs) to perform automated, LLM-driven security assessments.

What PentestGPT MCP does

This project is an advanced penetration testing tool based on the original "PentestGPT" paper. It extends the core capabilities by integrating with Model Context Protocol servers (MCPs) to perform automated, LLM-driven security assessments.

Key capabilities

• Dynamic MCP Server Integration — Connects to various tool servers running locally or remotely via a flexible mcp_servers.json configuration file
• Automated Task Execution (auto mode) — Automatically executes LLM-suggested tasks using tools provided by a connected MCP server
• Interactive "Human-in-the-Loop" Mode — Supports user confirmation before each tool execution, enhancing safety and control during automated scans
• Flexible Model Support — Works with a wide range of LLM providers, including OpenAI (GPT series) and Google (Gemini series)

Installing the pentestgpt mcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Configuration

Before the server will start you need to supply 2 environment variables: OPENAI_API_KEY, GOOGLE_API_KEY. Keep credentials in your client's env block or a secrets manager rather than committing them.

Where it fits

AI-service servers chain other models into your assistant, turning a single chat into a small production pipeline. PentestGPT MCP sits in that group. Worth comparing against the other ai services servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• It will not start until its required credentials are present, so set those before wondering why the tools never appear.
• Maintained by yuhano, written in Python.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the pentestgpt mcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.