Pentestmcp MCP Server

Pentestmcp MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. pentestMCP strictly adheres to the MCP specification, functioning solely as an MCP Server. It does not embed or directly communicate with any specific LLM. The interaction flow is mediated by an MCP Client Host application:.

What you get

• Comprehensive Toolset: — Integrates over 20 essential penetration testing tools via MCP
• Standardized Access: — Enables any MCP client supporting stdio server launching to utilize complex pentesting workflows
• Non-Blocking Scans: — Efficiently handles long-running scans without locking up the interaction flow
• Resource Management: — Implements basic concurrency limiting for scans
• Portable & Reproducible: — Dockerized environment ensures all dependencies and tools are available consistently across platforms (Windows, macOS, Linux)
• Web Scanner Integration: — Provides direct control over OWASP ZAP Active Scan and AJAX Spider functionalities

Setting it up

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

What the assistant can call

Once Pentestmcp is connected, these are the calls the assistant has available:

• Non — Blocking Scans:** Efficiently handles long-running scans without locking up the interaction flow
• macOS — ** ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows — ** %APPDATA%\Claude\claude_desktop_config.json
• run_subfinder — Discovers subdomains using ProjectDiscovery's Subfinder
• run_dig_tool — Executes DNS dig queries
• fetch_whois_data — Retrieves WHOIS information for a domain
• run_curl_tool — Executes cURL commands for HTTP interaction
• run_searchsploit — Searches the local Exploit-DB database using Searchsploit
• Enumeration — ** ad_user_enum, ad_shares_enum, ad_smb_signing_check, ad_certipy_enum, ad_ldap_dump, ad_bloodhound_collect

Configuration and credentials

• Docker: Requires Docker Desktop (Windows/macOS) or Docker Engine (Linux) to be installed and running. Ensure the Docker daemon is active. * Git: Needed only if building the image locally (git clone step). * (Optional but Recommended) OWASP ZAP Instance: For using ZAP-related tools (run_zap_*, run_active_scan_*, run_ajax_*). This ZAP instance needs to be running and

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 9 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Pentestmcp.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the pentestmcp mcp server does with a few real requests.

Choosing this one

This sits in the database access group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Pentestmcp's toolset — Non, macOS, Windows and 6 more — is a fair guide to whether it matches your workflow. It is maintained by ramkansal; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Pentestmcp's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.