@DMontgomery40
基本信息
NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.
工具列表暂未提供
当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。
工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。
A professional penetration-testing MCP server that integrates with common security tools (nmap, John the Ripper, hashcat, gobuster, nikto, subfinder, httpx, ffuf, nuclei, hydra, sqlmap, tcpdump) and provides an agent-friendly interface for reconnaissance, exploitation, reporting, and engagement management. It targets penetration testers and red teams who want to automate tool orchestration via MCP.
Install globally with npm install -g pentest-mcp. Run locally over stdio with pentest-mcp, or over the network with MCP_TRANSPORT=http MCP_SERVER_HOST=0.0.0.0 MCP_SERVER_PORT=8000 pentest-mcp. Use pentest-mcp inspector to launch the bundled MCP Inspector. Tools are invoked via MCP tool calls (e.g., subfinderEnum, nucleiScan). Auth can be enabled with bearer tokens and OIDC when using HTTP transport.
stdio is the default for local MCP clients; Streamable HTTP (set `MCP_TRANSPORT=http`) is the recommended network transport. SSE is available only as a deprecated compatibility mode and will be removed in a future major release.
Set `MCP_AUTH_ENABLED=true` and `MCP_AUTH_MODE=bearer` when using HTTP (or deprecated SSE) transport. Configure OIDC with `MCP_OIDC_ISSUER`, `MCP_OIDC_JWKS_URL`, and optionally `MCP_OIDC_INTROSPECTION_URL`. Legacy aliases (`MCP_OAUTH_ENABLED`, etc.) are temporarily accepted.
Ensure these binaries are in `PATH`: `nmap`, `john`, `hashcat`, `gobuster`, `nikto`, `subfinder`, `httpx-toolkit` (or validated ProjectDiscovery `httpx` as fallback), `ffuf`, `nuclei`, `hydra`, `sqlmap`, `tcpdump`.
Use `createClientReport` with `scopeMode=ask` (elicits from user interactively), `scopeMode=provided` (paste SoW text directly into `scopeOfWork`), or `scopeMode=template` (uses a built-in generic authorized-testing template). Elicitation is recommended; if unavailable, the template is used as fallback.
No. The README states "Authorized use only. Run against systems/networks where you have explicit written permission." Prompt injection risks are documented, and mitigations like least privilege, allowlists, and human confirmation for destructive actions are recommended.
Nebelus is an enterprise agentic-AI platform for regulated industries. This MCP server exposes the Nebelus Construction API: ~48 tools that give an MCP client full agent build parity — create/update/probe agents, edit ag
ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation
The tools your AI needs to make your games. Turn prompts into production-ready game assets — animated characters with their weapons attached, seamless textures, terrain, VFX, HUDs — and playable game kits Unity, Godot, U
Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.
Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott
评论