Pentest MCP Server

MCP server for browser automation using Playwright

Local serverstdio

What is the Pentest MCP Server?

MCP server for browser automation using Playwright

What you get

The installation process will automatically add the following configuration to your Claude config file:

  • Full browser xss, sql vulnerability automatic detection
  • Screenshots of the entire page or specific elements
  • Comprehensive network interaction (navigation, clicks, form filling)
  • Console log monitoring
  • JavaScript execution in the browser context

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
broser_url_reflected_xssTest whether the URL has an XSS vulnerability javascript { "url": "https://test.com", "paramName":"text" }
browser_url_sql_injection
browser_navigateNavigate to any URL in the browser javascript { "url": "https://stealthbrowser.cloud" }
browser_screenshotCapture screenshots of the entire page or specific elements javascript { "name": "screenshot-name", // required "selector": "#element-id", // optional "fullPage": true // optional, default: false }
browser_clickClick elements on the page using CSS selector javascript { "selector": "#button-id" }
browser_click_textClick elements on the page by their text content javascript { "text": "Click me" }
browser_hoverHover over elements on the page using CSS selector javascript { "selector": "#menu-item" }
browser_hover_textHover over elements on the page by their text content javascript { "text": "Hover me" }
browser_fillFill out input fields javascript { "selector": "#input-field", "value": "Hello World" }
browser_selectSelect an option in a SELECT element using CSS selector javascript { "selector": "#dropdown", "value": "option-value" }
browser_select_textSelect an option in a SELECT element by its text content javascript { "text": "Choose me", "value": "option-value" }
browser_evaluateExecute JavaScript in the browser console javascript { "script": "document.title" }

How to install the Pentest MCP Server

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "/Users/...../dist/index.js"
      ],
      "disabled": false,
      "autoApprove": []
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Example prompts to try

  • “Use Pentest to Installing.”
  • “Use Pentest to Tools.”
  • “Use Pentest to broser url reflected xss.”

Frequently asked questions

MCP server for browser automation using Playwright Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.