Turbopentest

@turbopentest/mcp-server

MCP server for TurboPentest — launch AI-powered penetration tests, review vulnerability findings, and generate security reports, all without leaving your coding assistant.

What it does

Ask your AI assistant to run a pentest, check progress, and walk you through remediation — the server handles all the API calls. Every completed scan is anchored to the blockchain, giving you a tamper-proof attestation you can share with customers or auditors.

Quick start

1. Get your API key

Sign up and create an API key at turbopentest.com/settings/api-keys.

2. Verify a domain

Before scanning, verify that you own the target domain at turbopentest.com/domains.

3. Add the server to your MCP client

Claude Code (.mcp.json in your project root):

{  "mcpServers": {    "turbopentest": {      "command": "npx",      "args": ["@turbopentest/mcp-server"],      "env": {        "TURBOPENTEST_API_KEY": "tp_live_..."      }    }  }}

Claude Desktop (claude_desktop_config.json):

{  "mcpServers": {    "turbopentest": {      "command": "npx",      "args": ["@turbopentest/mcp-server"],      "env": {        "TURBOPENTEST_API_KEY": "tp_live_..."      }    }  }}

Cursor (Settings > MCP Servers > Add):

{  "command": "npx",  "args": ["@turbopentest/mcp-server"],  "env": {    "TURBOPENTEST_API_KEY": "tp_live_..."  }}

OpenAI Codex CLI (~/.codex/config.toml, or run codex mcp add turbopentest -- npx @turbopentest/mcp-server and set the env var when prompted):

[mcp_servers.turbopentest]command = "npx"args = ["@turbopentest/mcp-server"]
[mcp_servers.turbopentest.env]TURBOPENTEST_API_KEY = "tp_live_..."

Then run /mcp inside Codex to confirm turbopentest is listed. Codex's MCP client doesn't support the "prompts" primitive, so the four guided workflows are also exposed as plain tools (turbopentest_workflow_*, see below) and described in this repo's AGENTS.md, which Codex reads automatically.

Example session

You:    "Run a standard pentest on staging.example.com"Claude: Checks domain is verified, confirms credit balance,        calls start_pentest → "Started tp_abc123, 4 agents, ~1 hour"
You:    "Any findings yet?"Claude: Calls get_pentest → "62% complete — 3 findings (1 high, 2 medium)"
You:    "Show me the high severity ones"Claude: Calls get_findings(severity: "high") →        [1] HIGH: SQL Injection in /api/search            CVSS: 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)            CWE: CWE-89            PoC: POST /api/search?q=' OR 1=1--            Remediation: Use parameterized queries...            Retest: sqlmap -u "https://staging.example.com/api/search" ...
You:    "Give me a prioritized remediation plan"Claude: Uses the analyze_findings prompt → produces a full markdown        remediation plan grouped by severity and effort

White-box scanning

Pass a GitHub repository URL to start_pentest to enable white-box mode. In addition to black-box testing, the scan will include:

• SAST — static code analysis for common vulnerability patterns
• Secret detection — leaked API keys, credentials, and tokens in source
• SCA — dependency audit for known CVEs

You:  "Pentest staging.example.com, the repo is github.com/myorg/myapp"

Tools

Security note: turbopentest_start_pentest checks domain verification itself before calling the API — it will refuse (isError: true) to launch against a target whose domain isn't verified on your account, rather than relying solely on the agent to check first.

Prompts

Built-in prompts guide your AI assistant through multi-step workflows. Invoke them by name in any MCP client that supports prompts (Claude Code, Claude Desktop, Cursor). In clients that only support tools (Codex), use the matching turbopentest_workflow_* tool above instead — the text is identical.

Scan tiers

Default tier is standard. Use recon for a quick surface sweep or blitz for maximum coverage on critical assets.

Blockchain attestation

Every completed pentest is anchored on-chain as a tamper-proof attestation. The SHA-256 hash is included in the report and can be independently verified — by you, your customers, or auditors — with no API key required:

You:  "Verify attestation abc123def456..."

turbopentest_verify_attestation returns the scan metadata (tier, agents, duration, risk score, findings summary) alongside the blockchain proof (chain ID, transaction hash, block number, merkle root).

Configuration

Requirements

• Node.js 18+
• A TurboPentest account with at least one verified domain

Using with OpenAI Codex

See docs/CODEX.md for the full Codex guide — configuration, the tool list, the authorization model, and why the guided workflows are exposed as turbopentest_workflow_* tools instead of MCP prompts.

Privacy & support

• Privacy policy: https://turbopentest.com/privacy
• Subprocessors: https://turbopentest.com/subprocessors
• Support: open a case at https://turbopentest.com/support (typically answered within a few hours on business days) or join the Discord
• Bugs in this MCP server: https://github.com/integsec/turbopentest-mcp/issues

Your API key is sent only to turbopentest.com/api as a bearer token over HTTPS. It is never logged and never transmitted anywhere else. Customer pentest content is not used to train public AI models.

License

MIT