pentest-mcp-server

io.github.cyanheads/pentest-mcp-serverVersion 0.3.0

Offline methodology engine for authorized penetration testing, CTF, and security research.

Status

Responds557 msNov 14, 2026, 14:48 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:48 UTC
Latency: 557 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://pentest.caseyjhand.com/mcpResponds557 msNov 14, 2026, 14:48 UTC

No sign-in

Claude Code

claude mcp add --transport http pentest-mcp-server https://pentest.caseyjhand.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: pentest-mcp-server
Remote MCP server URL: https://pentest.caseyjhand.com/mcp

Cursor

{
  "mcpServers": {
    "pentest-mcp-server": {
      "url": "https://pentest.caseyjhand.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"pentest-mcp-server","type":"http","url":"https://pentest.caseyjhand.com/mcp"}'

Streamable HTTP

npm: @cyanheads/pentest-mcp-server 0.3.0

Package only

npm (npx)

claude mcp add pentest-mcp-server -- npx -y @cyanheads/pentest-mcp-server@0.3.0

Streamable HTTP

npm: @cyanheads/pentest-mcp-server 0.3.0

Package only

npm (npx)

claude mcp add pentest-mcp-server -- npx -y @cyanheads/pentest-mcp-server@0.3.0

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

7 tools

Tools of pentest-mcp-server
	Description		Read-only	Idempotent	Open world
`pentest_analyze_response`Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.	Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.	Not declared	Yes	Yes	No
`pentest_encode_payload`Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.	Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.	Not declared	Yes	Yes	No
`pentest_generate_payloads`Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.	Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.	Not declared	Yes	Yes	No
`pentest_get_guide`Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.	Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.	Not declared	Yes	Yes	No
`pentest_lookup_group`Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.	Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.	Not declared	Yes	Yes	No
`pentest_lookup_technique`Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.	Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.	Not declared	Yes	Yes	No
`pentest_map_techniques`Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.	Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.	Not declared	Yes	Yes	No

Details

Registry status: Active
Published: Oct 30, 2026
Updated: Oct 30, 2026
Website: Not given
Repository: https://github.com/cyanheads/pentest-mcp-server⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing