Search / io.github.cyanheads/pentest-mcp-server
protogridR0· no sign-inOffline methodology engine for authorized penetration testing, CTF, and security research.
v0.2.0 · active · repository · descriptor JSON · versions
{
"mcpServers": {
"pentest-mcp-server": {
"type": "http",
"url": "https://pentest.caseyjhand.com/mcp"
}
}
}claude mcp add --transport http pentest-mcp-server https://pentest.caseyjhand.com/mcp[mcp_servers.pentest-mcp-server]
url = "https://pentest.caseyjhand.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"pentest-mcp-server": {
"type": "remote",
"url": "https://pentest.caseyjhand.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"pentest-mcp-server": {
"type": "http",
"url": "https://pentest.caseyjhand.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=pentest-mcp-server&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vcGVudGVzdC5jYXNleWpoYW5kLmNvbS9tY3AifQ%3D%3D"
}{
"servers": {
"pentest-mcp-server": {
"type": "http",
"url": "https://pentest.caseyjhand.com/mcp"
}
}
}{
"mcpServers": {
"pentest-mcp-server": {
"httpUrl": "https://pentest.caseyjhand.com/mcp"
}
}
}extensions:
"pentest-mcp-server":
enabled: true
name: "pentest-mcp-server"
type: streamable_http
uri: "https://pentest.caseyjhand.com/mcp"
timeout: 300
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every useauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations7 of 7 tools declare readOnlyHint or destructiveHinttools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: pentest_get_guide (destructiveHint); pentest_analyze_response (destructiveHint); pentest_lookup_group (destructiveHint); …tools.token_costabout 2,392 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes6 tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvabledeps.dev does not know @cyanheads/[email protected], @cyanheads/[email protected]pentest_encoderemovedTransform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.
pentest_guideremovedReturn an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.
pentest_encode_payloadaddedTransform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.
pentest_map_techniqueschangedoutput schemapentest_analyze_responsechangedoutput schemapentest_get_guideaddedReturn an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.
Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +reachable +uptime-100% +updated-4d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
@cyanheads/[email protected] npmthis version is not known to the dependency resolver
@cyanheads/[email protected] npmthis version is not known to the dependency resolver
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://pentest.caseyjhand.com/mcp streamable-http | none | yes | 100% | 195 ms | 2026-07-28 | 2026-10-19 |
| package | registry | version | runtime | secrets |
|---|---|---|---|---|
@cyanheads/pentest-mcp-server | npm | 0.2.0 | npx | |
@cyanheads/pentest-mcp-server | npm | 0.2.0 | npx |
pentest_analyze_responseread-only | Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors. |
pentest_encode_payloadread-only | Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs. |
pentest_generate_payloadsread-only | Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant. |
pentest_get_guideread-only | Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors. |
pentest_lookup_groupread-only | Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting. |
pentest_lookup_techniqueread-only | Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version. |
pentest_map_techniquesread-only | Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors. |
Schemas: list_tools.
And 136 more from this publisher.
{
"name": "io.github.cyanheads/pentest-mcp-server",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://pentest.caseyjhand.com/mcp",
"type": "streamable-http"
}
],
"version": "0.2.0",
"packages": [
{
"version": "0.2.0",
"transport": {
"type": "stdio"
},
"identifier": "@cyanheads/pentest-mcp-server",
"runtimeHint": "npx",
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"environmentVariables": [
{
"name": "PENTEST_ENABLE_PAYLOAD_GENERATION",
"format": "boolean",
"default": "true",
"description": "Enable payload generation and encoding. Set false to retain the five reference tools only."
},
{
"name": "MCP_LOG_LEVEL",
"format": "string",
"default": "info",
"description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
}
]
},
{
"version": "0.2.0",
"transport": {
"url": "http://localhost:3010/mcp",
"type": "streamable-http"
},
"identifier": "@cyanheads/pentest-mcp-server",
"runtimeHint": "npx",
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"environmentVariables": [
{
"name": "PENTEST_ENABLE_PAYLOAD_GENERATION",
"format": "boolean",
"default": "true",
"description": "Enable payload generation and encoding. Set false to retain the five reference tools only."
},
{
"name": "MCP_TRANSPORT_TYPE",
"value": "http",
"format": "string",
"description": "Selects the HTTP transport."
},
{
"name": "MCP_HTTP_HOST",
"format": "string",
"default": "127.0.0.1",
"description": "The hostname for the HTTP server."
},
{
"name": "MCP_HTTP_PORT",
"format": "string",
"default": "3010",
"description": "The port to run the HTTP server on."
},
{
"name": "MCP_HTTP_ENDPOINT_PATH",
"format": "string",
"default": "/mcp",
"description": "The endpoint path for the MCP server."
},
{
"name": "MCP_AUTH_MODE",
"format": "string",
"default": "none",
"description": "Authentication mode to use: 'none', 'jwt', or 'oauth'."
},
{
"name": "MCP_LOG_LEVEL",
"format": "string",
"default": "info",
"description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
}
]
}
],
"repository": {
"url": "https://github.com/cyanheads/pentest-mcp-server",
"source": "github"
},
"description": "Offline methodology engine for authorized penetration testing, CTF, and security research."
}