Pentest MCP Server
Professional pentest MCP server with stdio + Streamable HTTP transports, bundled MCP Inspector launcher, bearer auth, SoW-aware reporting, and modern tooling across sniffing/finding/bruteforce/cracking/priv-esc/extraction workflows.
context tax
pending
security
97/100
cold start
pending
freshness
Stale7mo ago
Our reading of Pentest, from the data
Pentest is a security MCP server from dmontgomery40.
We haven't measured its tool list yet, so its token cost is unknown.
It looks stale: the newest commit, release or package publish we found was 7 months ago (2026-03-23). For comparison, 67% of security servers are active or maintained.
With 150 GitHub stars it ranks #42 of 1,263 security servers we index.
It runs locally on your machine over stdio.
Install Pentest MCP server
Install in Claude Code
claude mcp add pentest-dmontgomery40 -- npx -y pentest-mcpInstall in Cursor
{
"mcpServers": {
"pentest-dmontgomery40": {
"command": "npx",
"args": [
"-y",
"pentest-mcp"
]
}
}
}Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project).
Install in Claude Desktop
{
"mcpServers": {
"pentest-dmontgomery40": {
"command": "npx",
"args": [
"-y",
"pentest-mcp"
]
}
}
}Settings → Developer → Edit Config (claude_desktop_config.json), then restart.
Install in VS Code
{
"servers": {
"pentest-dmontgomery40": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"pentest-mcp"
]
}
}
}Add to .vscode/mcp.json in your workspace.
Install in Windsurf
{
"mcpServers": {
"pentest-dmontgomery40": {
"command": "npx",
"args": [
"-y",
"pentest-mcp"
]
}
}
}Add to ~/.codeium/windsurf/mcp_config.json.
Security signals
97/100 — no known issues found as of 2026-10-19, from the checks below. This is not a guarantee of safety; review what a server can do before connecting it.
Deductions
- No security policy (SECURITY.md)-3
Checks
- ✓Repository hygiene (archived, activity, license, security policy)
- ○Package metadata (install scripts, provenance) — pending
- ○Tool descriptions (prompt-injection and hidden-text heuristics) — pending
- ○Source scan (secrets, CVEs, risky code) by vectra-guard — pending
Scan it yourself before installing with vectra-guard, the open-source agent security CLI. Scoring rules
Freshness
Stale — last maintenance signal 7mo ago. The newest of the signals below sets the band.
Last commit (default branch)
2026-03-23 · 7mo ago · GitHub
Latest release
no data · GitHub
Package published
no data · npm/PyPI
Registry entry updated
no data · official registry
How it compares in Security
Against the most-starred security servers we index. Token cost is per model turn, measured from each server's live tool list.
| Server | Stars | Tools | Tokens / turn | Freshness | Runs |
|---|---|---|---|---|---|
| Pentest (this) | 150 | — | not measured | Stale | local |
| Semgrep | 17,123 | — | not measured | Active | — |
| Ida Pro | 13,002 | — | not measured | Active | — |
| Ghidra | 11,390 | — | not measured | Active | — |
| Robin: AI-Powered Dark Web OSINT | 7,591 | — | not measured | Active | local |
| Claude Code Ultimate Guide | 6,196 | — | not measured | Active | local |
FAQ
›How do I install the Pentest MCP server in Claude Code?
Run: claude mcp add pentest-dmontgomery40 -- npx -y pentest-mcp. For Cursor, VS Code, Claude Desktop and Windsurf, use the install tabs above.
›Does Pentest require an API key?
No required environment variables are declared in its published metadata.
›Can I use Pentest as a remote (hosted) MCP server?
No hosted endpoint is published; it runs locally over stdio.
›Is Pentest in the official MCP registry?
No. It was indexed from npm.
Sources and method
- GitHub repository
- fetched 2026-10-19
- Package registry (npm / PyPI)
- listed
- Security signals, computed by us
- 2026-10-19
- Last checked against all sources
- 2026-10-19
The description, packages and links come from the maintainer's own published metadata. Token cost, security signals, freshness and the reading above are MCPSkillHub's own measurements; see the methodology. Spot an error? Request a correction or claim the listing.
Alternatives to Pentest
Other security MCP servers.
SemgrepActiveScan code for security vulnerabilities using Semgrep.
Ida ProActiveIDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.
GhidraActiveAutonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.
Robin: AI-Powered Dark Web OSINTActiveDark web OSINT over Tor: search onion engines, scrape pages, report with your own model.
Claude Code Ultimate GuideActiveSearch the Claude Code Ultimate Guide, official Anthropic documentation, releases, examples, security references, agent harness data, and translations from any MCP-compatible client.
Jadx AIActiveJADX decompiler plugin providing live, LLM-assisted reverse engineering.