Pentest Tools

com.pentest-toolsPublished by pentest-tools.comOfficial publisherv0.1.13Updated Oct 24, 2026

MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server for Pentest-Tools.com that lets an assistant run vulnerability scans, manage targets and findings, and generate reports.

What you can do
Run Website Scanner, Subdomain Finder and Network Scanner scans against targets, including deep scans and freemium scans via the CLI or MCP tools, and chain them into multi-phase recon and triage workflows from plain-language prompts. Manage targets, workspaces, scans and findings, including triaging results. Generate and download reports, including translated reports for regional teams.
When to use it
Use it when you want an AI assistant to drive authorized security testing of your own web applications and network infrastructure: launching scans, reviewing and triaging findings, and producing reports without leaving the chat.
Requirements
A remote endpoint at mcp.pentest-tools.com over streamable HTTP, or the local Python package (Python 3.10+) run as ptt mcp. Requires a Pentest-Tools.com API key from a paid plan, sent as an Authorization bearer header (or PTT_API_KEY / --key locally). Network access to the service.
Before you install
The API key is a credential: keep it out of shared configs and logs. Scans actively probe the target systems, so only scan assets you are authorized to test. The server can create and change targets, workspaces, scans and findings and generate reports, and scan activity and results are held by Pentest-Tools.com.

Installation

In SourceWeft

  1. Open Pentest Tools in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.pentest-tools%2Fmcp-server/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "pentest-tools": {
      "type": "http",
      "url": "https://mcp.pentest-tools.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

Pentest-Tools.com CLI & MCP Server

Command-line interface, Python bindings, and MCP server for Pentest-Tools.com, a platform for scanning web applications and network infrastructure for vulnerabilities.

MCP Server

Connect any MCP-compatible AI assistant to your Pentest-Tools.com account to run scans, triage findings, and generate reports. You'll need an API key from a paid plan. Get one at My Account > API.

Supported clients: Claude, Cursor, VS Code, Gemini CLI, and any MCP-compatible tool. Full documentation: pentest-tools.com/docs/ai/mcp/overview

What you can do

  • Run Website Scanner, Subdomain Finder, and Network Scanner scans
  • Manage targets, workspaces, scans, and findings
  • Generate and download reports, including translated reports for regional teams
  • Chain tools into multi-phase workflows that include recon, vulnerability triage, and executive summaries, through plain language prompts

Quick setup: remote server (recommended)

For terminal-based clients, use directly:

Claude Code

bash
claude mcp add --transport http ptt-mcp https://mcp.pentest-tools.com/mcp --header "Authorization: Bearer your_api_key_here"

Gemini CLI

bash
gemini mcp add ptt-mcp --transport http https://mcp.pentest-tools.com/mcp --header "Authorization: Bearer your_api_key_here"

Cursor: paste this URL in your browser for one-click install, then add your API key:

cursor://anysphere.cursor-deeplink/mcp/install?name=ptt-mcp&config=eyJ1cmwiOiJodHRwczovL21jcC5wZW50ZXN0LXRvb2xzLmNvbS9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIgeW91cl9hcGlfa2V5X2hlcmUifX0=

Or manually add according to your preferred agent and config file location:

{  "servers": {    "ptt-mcp": {      "type": "http",      "url": "https://mcp.pentest-tools.com/mcp",      "headers": { "Authorization": "Bearer your_api_key_here" }    }  }}

Local server

Requires Python 3.10+.

bash
pip install "pentesttools[mcp]"PTT_API_KEY=your_api_key_here ptt mcp

You can also pass the key inline: --key your_api_key_here. For client-specific local setup, see the full documentation.

CLI

Run scans from the terminal or integrate PTT into your scripts and CI/CD pipelines.

For AI assistant integration, see the MCP Server section above.

Installing

PentestTools Python module is delivered through PyPI, so it can be installed directly via pip:

bash
pip install pentesttools

Usage

The pentesttools package provides a command line interface through the ptt utility. Right now it supports the Website Scanner service.

Example for the simplest scan:

bash
ptt run website_scanner <url>

This runs a freemium Website Scanner scan on the <url>. Unlike in the platform itself, you can omit the schema part from the url.

Global arguments, like a suitable key for a deep scan, have to be passed straight to ptt. Tool arguments have to be passed to the tool.

bash
ptt --key <key> run website_scanner --scan_type deep <url>

If you want the command to fail if the report contains vulnerabilities with a higher risk than some value, you can use the --fail argument.

bash
ptt --fail high run website_scanner <url>

You can also run ptt using docker. The docker image has ptt as an entrypoint, so you don't have to type it anymore. Note that the old ptt-scan name is still used on docker.

bash
docker run pentesttoolscom/ptt-scan:latest run website_scanner <url>

Development installation

If you want to easily modify the sources and your modifications:

bash
pip install --edit .

Uninstalling

bash
pip uninstall pentesttools

Testing and Coverage

You can run the tests and make coverage reports like this:

bash
python3 -m pytest src/tests
bash
coverage run -m pytest src/testscoverage report -m

Source: README.md at commit 52361b7

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.1.13LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts