Pentest Tools

An MCP (Model Context Protocol) server for penetration testing tools, designed to work with various LLM clients like Claude Desktop, Roo Code, and other compatible MCP clients.

Features

• Comprehensive pentesting tools:
  • Directory scanning (FFuf, Dirsearch)
  • Vulnerability scanning (Nuclei, XSStrike)
  • API testing
  • Reconnaissance
  • And more...
• Pre-configured wordlists from SecLists
• Automated report generation
• Claude Desktop integration

Prerequisites

• Docker and Docker Compose (for containerized setup)
• Claude Desktop application or other MCP-compatible client
• Python 3.10+ and uv (for local setup)

Directory Setup

1. Create the required directories:

# Create directories
mkdir -p reports templates wordlists

2. Directory structure should look like this:

pentest-tools/
├── reports/          # For storing scan reports
├── templates/        # For report templates
├── wordlists/        # For custom wordlists
├── pentest-tools-mcp-server.py
├── config.json
├── requirements.txt
├── docker-compose.yml
└── Dockerfile

Setup

Docker Setup (Recommended)

1. Build and start the container:

docker-compose up -d --build

2. Verify the container is running:

docker-compose ps

3. Check logs if needed:

docker-compose logs -f

Local Setup

1. Install dependencies:

uv venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
uv pip install -r requirements.txt

2. Install required system tools (example for Ubuntu/Debian):

sudo apt-get install nmap whatweb dnsrecon theharvester ffuf dirsearch sqlmap

Claude Desktop Integration

1. Configure Claude Desktop:

Windows:

%APPDATA%\Claude\claude_desktop_config.json

MacOS/Linux:

~/Library/Application Support/Claude/claude_desktop_config.json

2. Add server configuration:

For Docker setup:

{
    "mcpServers": {
        "pentest-tools": {
            "command": "docker-compose",
            "args": [
                "run",
                "--rm",
                "pentest-tools",
                "python3",
                "pentest-tools-mcp-server.py"
            ],
            "cwd": "\\Path\\to\\pentest-tools"
        }
    }
}

If the above configuration doesn't work on Windows, try this alternative approach:

{
    "mcpServers": {
        "pentest-tools": {
            "command": "cmd",
            "args": [
                "/c",
                "cd /d \\path\\to\\pentest-tools && docker-compose run --rm pentest-tools python3 pentest-tools-mcp-server.py"
            ]
        }
    }
}

Note about cwd (Current Working Directory):

• cwd tells Claude Desktop which directory to run the command from
• It must be the absolute path to the directory containing docker-compose.yml
• On Windows, use double backslashes (\\) in paths
• On Linux/MacOS, use forward slashes (/)

3. Restart Claude Desktop

Usage

Available commands in Claude Desktop:

1. Reconnaissance:

/recon example.com

2. Directory scanning:

/scan example.com --type directory

3. Vulnerability scanning:

/scan example.com --type full
/scan example.com --type xss
/scan example.com --type sqli
/scan example.com --type ssrf

4. API testing:

/scan api.example.com --type api

Natural language commands:

• "Run a full security scan on example.com"
• "Check for XSS vulnerabilities on example.com"
• "Perform reconnaissance on example.com"

Directory Structure Details

pentest-tools/
├── reports/            # Scan reports directory
│   ├── recon/         # Reconnaissance reports
│   ├── vulns/         # Vulnerability scan reports
│   └── api/           # API testing reports
├── templates/          # Report templates
│   ├── recon.html     # Template for recon reports
│   ├── vuln.html      # Template for vulnerability reports
│   └── api.html       # Template for API test reports
├── wordlists/         # Custom wordlists
│   ├── SecLists/     # Cloned from SecLists repo
│   ├── custom/       # Your custom wordlists
│   └── generated/    # Tool-generated wordlists
├── pentest-tools-mcp-server.py # Main MCP server
├── config.json        # Tool configuration
├── requirements.txt   # Python dependencies
├── docker-compose.yml # Docker configuration
└── Dockerfile        # Container definition

Security Notes

• Always ensure you have permission to scan targets
• Keep tools and dependencies updated
• Review scan results carefully
• Follow responsible disclosure practices