MCP Pentest Server

A Structured, Scope-Enforced Penetration Testing Framework for Large Language Models via the Model Context Protocol

Abstract · Overview · Architecture · Installation · Lifecycle · Tools · Plugins · Research · Contributing

Abstract

Large language models possess substantial reasoning capabilities applicable to cybersecurity assessment, yet no standardized interface exists for conducting structured, scope-safe penetration tests through natural language interaction. This work presents PentestMCP, a constrained Model Context Protocol server architecture that exposes 43 security tools — 20 security scanners spanning the complete OWASP Top 10 (2021) taxonomy plus 23 management tools for scope, engagement lifecycle, findings, CVE enrichment, and async job control — behind an architecturally inviolable scope enforcement layer. The server enforces a seven-phase PTES engagement lifecycle, persists all findings to SQLite with automatic MITRE ATT&CK correlation via 160 mapping rules covering all 14 Enterprise tactics, and produces audit-ready reports in Markdown, JSON, and HTML formats. Evaluated against a 215-finding ground-truth corpus spanning 25 tool categories, the ATT&CK mapper achieves F1 = 0.771 (95% CI [0.734, 0.805]). Adversarial scope testing achieves 200/200 accuracy (100%) across 8 attack categories. External validation against 50 real-world NVD CVEs yields recall = 0.879. A DVWA case study detects all 14 vulnerability modules across 5 PTES phases. The constrained system achieves methodology adherence of 0.971 versus 0.605 for unconstrained baselines (Cohen's d = 4.43). The LLM component (a fine-tuned Qwen 7B served via LM Studio) is separate from this MCP server; any MCP-compatible LLM client can connect.

Overview

PentestMCP is a Model Context Protocol server that transforms any MCP-compatible large language model into a structured penetration testing assistant. Unlike wrapper-style MCP tools that simply shell out to binaries, this server enforces engagement scope on every call via an 8-step canonicalization pipeline, persists findings to SQLite, auto-correlates results to MITRE ATT&CK techniques using 160 mapping rules, and generates audit-ready reports — the same workflow a professional pentester follows, made accessible through natural language. The LLM is a separate component; this repository contains only the MCP server and its 43 tool endpoints.

Who Is This For

Security researchers investigating LLM-assisted vulnerability assessment
Professional pentesters seeking structured, auditable engagement workflows
Red teams requiring scope-enforced, repeatable testing through natural language
Academics studying the intersection of large language models and cybersecurity

Comparison with Existing MCP Pentest Tools

Capability	MCP Pentest Server	pentestMCP	pentest-mcp	mcp-pentest
Full OWASP Top 10 coverage (43 tools)	Yes	Partial	Partial	Partial
Scope enforcement engine	Yes	No	No	No
Engagement lifecycle (7 phases)	Yes	No	No	No
MITRE ATT&CK auto-mapping	Yes	No	No	No
Structured finding tracker (CVSS)	Yes	No	No	No
CVE enrichment (NVD API)	Yes	No	No	No
Auto-generated reports (MD/JSON/HTML)	Yes	No	No	Partial
Async job management	Yes	No	No	No
Plugin architecture (ToolPlugin ABC)	Yes	No	No	No
SQLite persistence	Yes	No	No	No
Rate limiting & schema validation	Yes	No	Partial	No

Architecture

+------------------+          stdio / SSE          +-------------------+
|                  |  <=========================>  |                   |
|   LLM Client    |       MCP Protocol JSON-RPC    |   server_mcp.py   |
|  (Claude, LM    |                                |   (FastMCP)       |
|   Studio, etc.) |                                +--------+----------+
+------------------+                                        |
                                                            v
                                            +-------------------------------+
                                            |        Core Managers          |
                                            |                               |
                                            |  +-------------------------+  |
                                            |  | Scope Manager           |  |
                                            |  | - IP/CIDR/domain allow  |  |
                                            |  | - blocks out-of-scope   |  |
                                            |  +-------------------------+  |
                                            |  | Engagement Manager      |  |
                                            |  | - 7-phase lifecycle     |  |
                                            |  | - SQLite persistence    |  |
                                            |  +-------------------------+  |
                                            |  | Finding Tracker         |  |
                                            |  | - severity, CVSS, CVE   |  |
                                            |  | - remediation notes     |  |
                                            |  +-------------------------+  |
                                            |  | MITRE ATT&CK Mapper    |  |
                                            |  | - 160 mapping rules    |  |
                                            |  | - auto-correlation      |  |
                                            |  +-------------------------+  |
                                            |  | Job Manager             |  |
                                            |  | - async background jobs |  |
                                            |  | - progress tracking     |  |
                                            |  +-------------------------+  |
                                            |  | CVE Enrichment          |  |
                                            |  | - NVD API + cache       |  |
                                            |  +-------------------------+  |
                                            |  | Report Generator        |  |
                                            |  | - MD / JSON / HTML      |  |
                                            |  | - OWASP heatmap         |  |
                                            |  +-------------------------+  |
                                            +---------------+---------------+
                                                            |
                                                            v
                                            +-------------------------------+
                                            |       Tool Plugins            |
                                            |  (ToolPlugin ABC + registry)  |
                                            +---------------+---------------+
                                                            |
                                                            v
                                +-----------------------------------------------+
                                |            External Binaries                  |
                                |  ffuf  sqlmap  nmap  nuclei  dalfox  hydra   |
                                |  trivy  semgrep  commix  arjun  httpx  ...   |
                                +-----------------------------------------------+

Communication Layer

The server communicates with LLM clients via the Model Context Protocol using JSON-RPC over stdio. FastMCP handles serialization, tool registration, and lifecycle management. All 40+ endpoints (security tools, scope management, engagement lifecycle, finding management, and job control) are registered as MCP tool endpoints.

Core Manager Pipeline

Six specialized managers form the business logic layer. The Scope Manager validates every target against the authorized engagement scope before any tool executes — this check is architecturally mandatory and cannot be bypassed. An 8-step canonicalization pipeline (whitespace stripping, recursive percent-decoding, NFKC Unicode normalization, hostname extraction, and strict character validation) defends against evasion via Unicode homoglyphs, null-byte injection, and path traversal. The Engagement Manager tracks the seven-phase PTES lifecycle and links all findings to a specific engagement. The Finding Tracker records and categorizes security findings with CVSS severity scoring. The MITRE ATT&CK Mapper automatically correlates findings using 160 keyword-based mapping rules covering all 14 ATT&CK Enterprise tactics with configurable confidence thresholding (default 0.65). The Job Manager handles async long-running scans with progress tracking and cancellation. The CVE Enrichment module queries the NVD REST API v2.0 for CVE details, CVSS scores, and CWE mappings.

Plugin Dispatch System

Tools implement the ToolPlugin abstract base class. The PluginRegistry auto-discovers plugins at startup by scanning the plugins/ directory. Each tool receives sanitized, scope-validated parameters, executes via subprocess with enforced timeouts, and returns a structured dictionary.

SQLite Persistence Layer

All engagement data, findings, ATT&CK mappings, and CVE cache entries are stored in a local SQLite database, enabling cross-session reporting and complete audit trails.

Tip

For a detailed architecture deep-dive with component diagrams, see docs/architecture.md.

Installation & Setup

Prerequisites

Requirement	Minimum Version	Notes
Python	3.10+	3.12 recommended
uv	latest	Recommended package manager (install guide)
Git	2.x	For cloning the repository

Step 1 — Clone and Install

git clone https://github.com/Codexhack286/MCP_server_Pentest.git
cd MCP_server_Pentest
uv sync

Step 2 — Install External Binaries

The security tools require external binaries. Install the ones you need:

Binary	Tool(s)	Install
`nmap`	transport_security, port_scan, alert_trigger	nmap.org
`ffuf`	dir_enum, rate_limit	`go install github.com/ffuf/ffuf/v2@latest`
`sqlmap`	sqli_check	`pip install sqlmap`
`nuclei`	security_check	`go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`
`dalfox`	xss_check	`go install github.com/hahwul/dalfox/v2@latest`
`hydra`	auth_check	THC Hydra releases
`trivy`	sbom_analysis	Trivy releases
`semgrep`	sast_scan	`pip install semgrep`
`commix`	command_injection	Commix repo
`arjun`	param_discovery	`pip install arjun`
`httpx`	ssrf_check	`go install github.com/projectdiscovery/httpx/cmd/httpx@latest`
`katana`	web_crawl	`go install github.com/projectdiscovery/katana/cmd/katana@latest`
`wafw00f`	waf_detect	`pip install wafw00f`
`cosign`	code_signing	Sigstore releases
`trufflehog`	secret_scan	TruffleHog releases
`wad`	component_version	`pip install wad`
`qsreplace`	ssrf_check	`go install github.com/tomnomnom/qsreplace@latest`
`subfinder`	subdomain_enum	`go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest`
`naabu`	port_scan	`go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest`

Note

See docs/SETUP.md for a comprehensive platform-specific installation walkthrough, including Windows binary placement.

Step 3 — Start the MCP Server

cd mcp_server_industry
uv run server_mcp.py

Step 4 — Connect an MCP Client

Claude Desktop / LM Studio — add to your MCP configuration:

{
  "mcpServers": {
    "pentest": {
      "command": "uv",
      "args": ["run", "server_mcp.py"],
      "cwd": "/path/to/MCP_server_Pentest/mcp_server_industry"
    }
  }
}

MCP Inspector — interactive tool exploration:

npx @modelcontextprotocol/inspector uv run server_mcp.py
# Open http://localhost:6274

Engagement Lifecycle

Every penetration test follows a structured seven-phase lifecycle managed by the server:

 RECONNAISSANCE ──> SCANNING ──> ENUMERATION ──> VULNERABILITY ASSESSMENT
                                                          |
 REPORTING <── POST-EXPLOITATION <── EXPLOITATION <───────┘

Phase	Description	Typical Tools
Reconnaissance	Passive information gathering, scope definition	`set_scope`, `subdomain_enum`, `web_crawl`
Scanning	Active network and service discovery	`port_scan`, `waf_detect`, `component_version`
Enumeration	Deep service and parameter enumeration	`dir_enum`, `param_discovery`, `secret_scan`
Vulnerability Assessment	Automated vulnerability identification	`sqli_check`, `xss_check`, `security_check`, `sast_scan`
Exploitation	Controlled exploitation of confirmed vulnerabilities	`command_injection`, `auth_check`, `ssrf_check`
Post-Exploitation	Impact assessment and evidence collection	`alert_trigger`, `code_signing`, `sbom_analysis`
Reporting	Findings compilation and deliverable generation	`generate_report`, `get_findings_by_severity`

The LLM advances through phases with advance_phase. Each tool invocation is automatically linked to the active engagement and its current phase. Findings, evidence, and ATT&CK mappings accumulate in SQLite, and at the end, generate_report produces a complete deliverable.

Tool Reference

Security Tools (OWASP Top 10)

Tool	OWASP	Description	Binary
`dir_enum`	A01	Directory and file brute-forcing	ffuf
`transport_security`	A02	TLS/SSL cipher and certificate analysis	nmap
`secret_scan`	A02	Detect secrets and credentials in repositories	trufflehog
`sqli_check`	A03	SQL injection testing	sqlmap
`command_injection`	A03	OS command injection testing	commix
`xss_check`	A03	Cross-site scripting detection	dalfox
`param_discovery`	A03	Hidden HTTP parameter discovery	arjun
`rate_limit`	A04	Rate limiting and access control testing	ffuf
`security_check`	A05	Template-based vulnerability scanning	nuclei
`subdomain_enum`	A05	Subdomain enumeration via passive sources	subfinder
`port_scan`	A05	TCP port scanning with service detection	naabu
`web_crawl`	A05	Web application crawling and endpoint discovery	katana
`waf_detect`	A05	Web application firewall detection	wafw00f
`component_version`	A06	Web technology and version fingerprinting	wad
`sbom_analysis`	A06	Software bill of materials and CVE scanning	trivy
`sast_scan`	A06	Static application security testing	semgrep
`auth_check`	A07	Authentication and credential brute-forcing	hydra
`code_signing`	A08	Container image signature verification	cosign
`alert_trigger`	A09	Security monitoring and alerting validation	nmap
`ssrf_check`	A10	Server-side request forgery testing	qsreplace + httpx

Scope Management Tools

Tool	Description
`set_scope`	Define allowed targets (IPs, CIDRs, domains, URL patterns)
`get_scope`	View the current engagement scope
`add_to_scope`	Add targets to the active scope
`remove_from_scope`	Remove targets from scope
`clear_scope`	Reset scope to empty
`validate_target`	Check whether a target is in scope before scanning

Engagement Tools

Tool	Description
`start_engagement`	Begin a new penetration test engagement
`get_engagement_status`	View current phase, findings count, and metadata
`advance_phase`	Move to the next lifecycle phase
`end_engagement`	Close the engagement and finalize records
`list_engagements`	List all past and current engagements

Finding Tools

Tool	Description
`list_findings`	List all findings for the current engagement
`get_finding`	Retrieve a specific finding by ID
`update_finding_status`	Change finding status (open, confirmed, false positive)
`add_manual_finding`	Record a manually discovered vulnerability
`get_findings_by_severity`	Filter findings by severity level

Analysis & Reporting Tools

Tool	Description
`get_attack_mapping`	View MITRE ATT&CK technique mappings for findings
`enrich_cve`	Fetch CVE details from the NVD API
`enrich_cves_from_finding`	Enrich all CVEs associated with a finding
`generate_report`	Produce Markdown, JSON, or HTML report with OWASP heatmap

Job Management Tools

Tool	Description
`start_scan_job`	Submit a long-running scan as an async background job
`list_active_jobs`	List all async jobs with status
`get_job_status`	Check the status and progress of a background scan
`get_job_result`	Retrieve the result of a completed job
`cancel_job`	Cancel a running background job

Note

For detailed parameter schemas, example payloads, and expected output formats for every tool, see docs/TOOLS_DOCUMENTATION.md.

Plugin Architecture

Extend the server with custom tools by implementing the ToolPlugin abstract base class:

from core.plugin_base import ToolPlugin

class MyCustomScanner(ToolPlugin):
    @property
    def name(self) -> str:
        return "my_custom_scanner"

    @property
    def description(self) -> str:
        return "Describe when the LLM should use this tool."

    @property
    def input_schema(self) -> dict:
        return {
            "type": "object",
            "properties": {
                "target": {"type": "string", "description": "Target URL"}
            },
            "required": ["target"]
        }

    @property
    def binary_name(self) -> str:
        return "my-binary"  # checked at startup

    def run(self, params: dict) -> dict:
        # Your scanning logic here
        return {"vulnerable": False, "tool_used": "my_custom_scanner", "results": {}}

Drop the file into mcp_server_industry/plugins/ and the server discovers it automatically at startup. No registration code needed.

How Auto-Discovery Works

On startup, the PluginRegistry scans mcp_server_industry/plugins/ for .py files
Each file is dynamically imported and inspected for ToolPlugin subclasses
Concrete (non-abstract) subclasses are instantiated and registered
The is_available() method checks if the required binary exists in PATH
Registered plugins appear alongside built-in tools in the MCP tool list

Tip

For a complete plugin development guide with advanced examples, see docs/PLUGIN_DEVELOPMENT.md.

Research & Methodology

Security Research Foundation

The tool design and classification framework are grounded in established cybersecurity standards. Each of the 20 security tools maps directly to one of the OWASP Top 10 (2021) categories, ensuring systematic coverage of the most critical web application security risks. An additional 23 management tools handle scope, engagement lifecycle, finding management, CVE enrichment, async jobs, and reporting — totalling 43 MCP tool endpoints. Findings are automatically correlated to MITRE ATT&CK techniques via 160 keyword-based mapping rules, providing threat intelligence context for every discovered vulnerability.

The engagement lifecycle follows the methodology outlined in the Penetration Testing Execution Standard (PTES), adapted for LLM-driven workflows. Each phase constrains the set of appropriate tools and generates phase-specific artifacts that accumulate into the final report.

LLM Configuration

Note

The LLM is a separate component from this MCP server. Our evaluation uses a fine-tuned Qwen 7B parameter model served locally via LM Studio v0.3.x (context: 32K tokens, temperature: 0.7, top-p: 0.95). Any MCP-compatible client (Claude Desktop, LM Studio, MCP Inspector, etc.) can connect.

Frameworks & Standards

Framework	Version	Role in This Project
OWASP Top 10	2021	Tool classification and coverage mapping
MITRE ATT&CK	v14	Automatic technique correlation (160 rules, 14 tactics)
CVSS	v3.1	Vulnerability severity scoring
NVD / CVE	Current	CVE enrichment via NVD REST API v2.0
MCP	1.0	Protocol layer for LLM-tool communication
PTES	1.0	Engagement lifecycle methodology

Evaluation Results

Evaluated against a 215-finding ground-truth corpus spanning 25 tool categories:

Metric	Value	Details
ATT&CK F1	0.771	95% CI [0.734, 0.805]; hmean(P=0.671, R=0.907)
ATT&CK Ablation F1	0.745	Best of 7 methods (keyword matching outperformed TF-IDF, BM25, SBERT)
NVD External Recall	0.879	50 real-world CVEs from the National Vulnerability Database
Scope Enforcement	200/200	100% accuracy across 8 adversarial attack categories
Scope Features	18/18	vs. OWASP ZAP 5/18, Burp Suite 6/18
Methodology Adherence	0.971 ± 0.054	vs. 0.605 unconstrained (Cohen's d = 4.43, p < 0.001)
DVWA Coverage	14/14	All vulnerability modules detected across 5 PTES phases

Adversarial Scope Testing (200 vectors, 8 categories × 25)

Category	Tests	Accuracy	Attack Type
IP obfuscation	25	100%	Hex/octal/percent-encoding
CIDR edge cases	25	100%	Boundary/broadcast addresses
Domain manipulation	25	100%	Suffix/prefix/trailing dots
URL tricks	25	100%	Multiple schemes/userinfo
IDNA homograph	25	100%	Cyrillic/fullwidth Unicode
Path-prefix scope	25	100%	Path traversal/case sensitivity
Injection-style	25	100%	CRLF/null-byte/shell expansion
Edge cases	25	100%	IPv6/file scheme/empty input

Ablation Study (7 methods, Wilcoxon p < 0.001, Friedman χ² = 65.63)

Method	F1	ML?
Keyword + threshold (ours)	0.745	No
Keyword, no threshold	0.443	No
SBERT embedding	0.410	Yes
BM25 ranking	0.403	Yes
TF-IDF cosine	0.395	Yes
Majority-class	0.142	No
Random baseline	0.025	No

Evaluation artifacts, including the 215-finding corpus, metrics, generated figures, and all evaluation scripts, are available in the mcp_server_industry/eval/ directory. See docs/REPRODUCIBILITY.md for exact commands to reproduce all results.

Ethical Use & Legal Notice

Warning

This software is intended exclusively for authorized security assessments, academic research, and educational purposes. Unauthorized use against systems you do not own or have explicit written permission to test is illegal and punishable under applicable law, including the Computer Fraud and Abuse Act (CFAA) and equivalent international legislation.

By using this software, you acknowledge and agree to the following obligations:

Authorization required. You must have explicit, written permission from the system owner before testing any target. Unauthorized access to computer systems is a criminal offense in most jurisdictions.
Scope enforcement is a safety net, not a guarantee. The built-in scope manager helps prevent accidental out-of-scope testing, but the operator bears full legal responsibility for all actions taken.
No warranty. This software is provided "as is" without warranty of any kind, express or implied. The authors are not liable for any damages or legal consequences arising from its use.
Responsible disclosure. If you discover vulnerabilities using this tool, follow responsible disclosure practices. Report findings to the affected organization before any public disclosure.
Compliance. Ensure your testing complies with all applicable local, state, national, and international laws and regulations, including but not limited to the CFAA, GDPR, the UK Computer Misuse Act, and equivalent legislation in your jurisdiction.

Project Structure

MCP_server_Pentest/
├── README.md                           # This file
├── LICENSE                             # MIT License
├── CHANGELOG.md                        # Version history
├── SECURITY.md                         # Security policy
├── CONTRIBUTING.md                     # Contribution guidelines
├── .gitignore                          # Git ignore rules
├── pyproject.toml                      # Project metadata and dependencies
├── requirements.txt                    # Pip-compatible dependency list
│
├── mcp_server_industry/                # Core server
│   ├── server_mcp.py                   #   FastMCP stdio entry point (primary)
│   ├── server.py                       #   FastAPI REST entry point (alternative)
│   ├── executor.py                     #   Tool dispatch with schema validation
│   ├── registry.py                     #   Tool metadata registry
│   ├── config.py                       #   Centralized configuration
│   ├── core/                           #   Business logic managers
│   │   ├── scope_manager.py            #     Scope enforcement engine
│   │   ├── engagement_manager.py       #     7-phase lifecycle manager
│   │   ├── finding_tracker.py          #     Finding storage with CVSS/CVE
│   │   ├── mitre_mapper.py             #     ATT&CK technique correlation
│   │   ├── job_manager.py              #     Async job execution and tracking
│   │   ├── cve_enrichment.py           #     NVD API client with caching
│   │   ├── report_generator.py         #     MD/JSON/HTML report generation
│   │   ├── database.py                 #     SQLite async database layer
│   │   └── plugin_base.py              #     ToolPlugin ABC and PluginRegistry
│   ├── tools/                          #   Security tool implementations
│   │   ├── A01/ – A10/                 #     Organized by OWASP category
│   │   └── report/                     #     Report generation tools
│   ├── plugins/                        #   Community plugin drop-in directory
│   ├── utils/                          #   Rate limiting, session logging, helpers
│   ├── eval/                           #   Evaluation pipeline and corpus
│   ├── logs/                           #   Execution logs (gitignored)
│   └── reports/                        #   Generated report output (gitignored)
│
├── docs/                               # Documentation
│   ├── SETUP.md                        #   Binary installation walkthrough
│   ├── TOOLS_DOCUMENTATION.md          #   Detailed tool specifications
│   ├── PLUGIN_DEVELOPMENT.md           #   Plugin development guide
│   ├── REPRODUCIBILITY.md              #   Experiment reproduction guide
│   └── architecture.md                 #   Architecture deep-dive
│
├── paper/                              # Research paper artifacts
├── tests/                              # Integration and validation tests
│   ├── test_tools.py                   #   Dynamic tool testing suite
│   ├── test_bad_requests.py            #   Input validation tests
│   └── vulnerable_app.py              #   Intentionally vulnerable Flask app
│
├── scripts/                            # Utility scripts
│   └── run_agent.py                    #   Local LLM agent test harness
│
└── data/                               # Data artifacts
    └── train.jsonl                     #   Training data

Requirements

Runtime Environment

Requirement	Specification
Python	>= 3.10 (3.12 recommended)
Package Manager	uv (recommended) or pip
Operating System	Windows 11, Linux, macOS

Core Python Dependencies

Package	Purpose
`mcp[cli]`	Model Context Protocol server framework
`fastapi`	REST API alternative entry point
`pydantic`	Data validation and settings management
`aiosqlite`	Async SQLite database access
`python-nmap`	Nmap Python bindings
`requests`	HTTP client for web crawling and API calls
`jsonschema`	JSON Schema validation for tool inputs

External Binary Dependencies

All 19 external binaries are listed in the Installation section above. Tools gracefully degrade when their binary is unavailable — the server starts normally and reports which tools are offline.

Contributing & Citation

Contributions are welcome. See CONTRIBUTING.md for guidelines on adding tools, writing plugins, and submitting pull requests.

Citation

If you use this software in academic research, please cite it as follows:

@inproceedings{mukunda2026pentestmcp,
  title     = {Constrained MCP Tool Architecture for Methodologically Consistent
               Penetration Testing: Enforcing Scope Boundaries, Phase Ordering,
               and Automated ATT\&CK Correlation},
  author    = {Mukunda, Vittal and Fernandez, Ryan Dave and Manohar, Minal},
  booktitle = {Proceedings of the IEEE International Conference},
  year      = {2026},
  url       = {https://github.com/Codexhack286/MCP_server_Pentest},
  note      = {Source code, 215-finding evaluation corpus, and reproducibility
               scripts available at repository}
}

License

This project is licensed under the MIT License. See LICENSE for details.

_{Built for the security research community. Use responsibly.}

Name		Name	Last commit message	Last commit date
data		data
docs		docs
mcp_server_industry		mcp_server_industry
scripts		scripts
tests		tests
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
pyproject.toml		pyproject.toml
requirements.txt		requirements.txt
start-juice-shop.ps1		start-juice-shop.ps1
uv.lock		uv.lock

Latest commit

History

Folders and files

Repository files navigation

MCP Pentest Server

A Structured, Scope-Enforced Penetration Testing Framework for Large Language Models via the Model Context Protocol

Abstract

Overview

Who Is This For

Comparison with Existing MCP Pentest Tools

Architecture

Communication Layer

Core Manager Pipeline

Plugin Dispatch System

SQLite Persistence Layer

Installation & Setup

Prerequisites

Step 1 — Clone and Install

Step 2 — Install External Binaries

Step 3 — Start the MCP Server

Step 4 — Connect an MCP Client

Engagement Lifecycle

Tool Reference

Security Tools (OWASP Top 10)

Scope Management Tools

Engagement Tools

Finding Tools

Analysis & Reporting Tools

Job Management Tools

Plugin Architecture

How Auto-Discovery Works

Research & Methodology

Security Research Foundation

LLM Configuration

Frameworks & Standards

Evaluation Results

Adversarial Scope Testing (200 vectors, 8 categories × 25)

Ablation Study (7 methods, Wilcoxon p < 0.001, Friedman χ² = 65.63)

Ethical Use & Legal Notice

Project Structure

Requirements

Runtime Environment

Core Python Dependencies

External Binary Dependencies

Contributing & Citation

Citation

License

About

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages