LabscoMCP early access ↗
ramkansalMCP SERVER · OFFICIAL PROJECT

pentestMCP

Drive over 20 standard penetration-testing tools — Nmap, Nuclei, ZAP, SQLMap and more — from an AI client in natural language, all inside one Docker container.

by ramkansal ↗Vulnerability Scanning & Application Security✓ Official

LABSCO SUMMARY

The pentest toolbox, driven in plain language.

Packing Nmap, Nuclei, ZAP, SQLMap and an Active Directory attack set into one container means an agent can run a whole assessment flow without you juggling installs — and the long scans launch-and-fetch, so they never freeze the session. Two things gate real use: authorization, which the README puts in bold, and ZAP, which you have to run yourself for the web-scanner tools to work.

What it is

An MCP server that exposes a curated suite of security-assessment utilities as callable tools, so an agent in an MCP client can run recon, scanning and exploitation-support tasks by describing them. It runs entirely inside Docker and speaks to the client over stdio, embedding no LLM of its own.

What you get

  • Reconnaissance and enumeration: subdomain discovery, DNS lookups, WHOIS, HTTP interaction, OSINT and web crawling — run_subfinder, run_dig_tool, fetch_whois_data, run_curl_tool, run_harvester, launch_gofang_scan
  • Network scanning run asynchronously so a long scan does not block the connection — launch_nmap_scan / fetch_nmap_results, run_gobuster_scan / check_gobuster_status
  • Template-based vulnerability scanning with Nuclei — launch_nuclei_scan / fetch_nuclei_results
  • Web-app analysis and exploitation support: hidden-parameter discovery, Exploit-DB search, and SQL injection testing — launch_arjun_scan, run_searchsploit, run_sqlmap_tool / check_sqlmap_status
  • Active Directory enumeration, coercion and credential operations — ad_user_enum, ad_kerberoast, ad_asreproast, ad_dcsync, ad_secrets_dump and more
  • OWASP ZAP active scan and AJAX spider control

Requirements

Docker running on the host. The recommended path is docker pull ramgameer/pentest-mcp:latest; building locally is supported and, per the README, most reliable on Linux. Git is needed only for a local build. ZAP-related tools need a separately running OWASP ZAP instance reachable from inside the container, and the Gobuster/fuzzing tools work best after cloning SecLists. The client launches the server with docker run --rm -i. The pyproject names the package pentest-mcp at 0.1.0. The README's disclaimer is explicit: use only against systems you have written authorization to test — unauthorized scanning is illegal.

Setup effort

One command — docker run --rm -i ramgameer/pentest-mcp:latest

See installation options