Pentest Tools MCP Server

An MCP (Model Context Protocol) server for penetration testing tools, designed to work with various LLM clients like Claude Desktop, Roo Code, and other compatible MCP clients.

Features

Comprehensive pentesting tools:
- Directory scanning (FFuf, Dirsearch)
- Vulnerability scanning (Nuclei, XSStrike)
- API testing
- Reconnaissance
- And more...
Pre-configured wordlists from SecLists
Automated report generation
Claude Desktop integration

Prerequisites

Docker and Docker Compose (for containerized setup)
Claude Desktop application or other MCP-compatible client
Python 3.10+ and uv (for local setup)

Directory Setup

Create the required directories:

# Create directories
mkdir -p reports templates wordlists

Directory structure should look like this:

pentest-tools/
├── reports/          # For storing scan reports
├── templates/        # For report templates
├── wordlists/        # For custom wordlists
├── pentest-tools-mcp-server.py
├── config.json
├── requirements.txt
├── docker-compose.yml
└── Dockerfile

Setup

Docker Setup (Recommended)

Build and start the container:

docker-compose up -d --build

Verify the container is running:

docker-compose ps

Check logs if needed:

docker-compose logs -f

Local Setup

Install dependencies:

uv venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
uv pip install -r requirements.txt

Install required system tools (example for Ubuntu/Debian):

sudo apt-get install nmap whatweb dnsrecon theharvester ffuf dirsearch sqlmap

Claude Desktop Integration

Configure Claude Desktop:

Windows:

%APPDATA%\Claude\claude_desktop_config.json

MacOS/Linux:

~/Library/Application Support/Claude/claude_desktop_config.json

Add server configuration:

For Docker setup:

{
    "mcpServers": {
        "pentest-tools": {
            "command": "docker-compose",
            "args": [
                "run",
                "--rm",
                "pentest-tools",
                "python3",
                "pentest-tools-mcp-server.py"
            ],
            "cwd": "\\Path\\to\\pentest-tools"
        }
    }
}

If the above configuration doesn't work on Windows, try this alternative approach:

{
    "mcpServers": {
        "pentest-tools": {
            "command": "cmd",
            "args": [
                "/c",
                "cd /d \\path\\to\\pentest-tools && docker-compose run --rm pentest-tools python3 pentest-tools-mcp-server.py"
            ]
        }
    }
}

Note about cwd (Current Working Directory):

cwd tells Claude Desktop which directory to run the command from
It must be the absolute path to the directory containing docker-compose.yml
On Windows, use double backslashes (\\) in paths
On Linux/MacOS, use forward slashes (/)

Restart Claude Desktop

Usage

Available commands in Claude Desktop:

Reconnaissance:

/recon example.com

Directory scanning:

/scan example.com --type directory

Vulnerability scanning:

/scan example.com --type full
/scan example.com --type xss
/scan example.com --type sqli
/scan example.com --type ssrf

API testing:

/scan api.example.com --type api

Natural language commands:

"Run a full security scan on example.com"
"Check for XSS vulnerabilities on example.com"
"Perform reconnaissance on example.com"

Directory Structure Details

pentest-tools/
├── reports/            # Scan reports directory
│   ├── recon/         # Reconnaissance reports
│   ├── vulns/         # Vulnerability scan reports
│   └── api/           # API testing reports
├── templates/          # Report templates
│   ├── recon.html     # Template for recon reports
│   ├── vuln.html      # Template for vulnerability reports
│   └── api.html       # Template for API test reports
├── wordlists/         # Custom wordlists
│   ├── SecLists/     # Cloned from SecLists repo
│   ├── custom/       # Your custom wordlists
│   └── generated/    # Tool-generated wordlists
├── pentest-tools-mcp-server.py # Main MCP server
├── config.json        # Tool configuration
├── requirements.txt   # Python dependencies
├── docker-compose.yml # Docker configuration
└── Dockerfile        # Container definition

Security Notes

Always ensure you have permission to scan targets
Keep tools and dependencies updated
Review scan results carefully
Follow responsible disclosure practices