Findings are the unit of work in a pentest report, and here they are first class: created, patched and listed against a live SysReptor project, with the schema readable so the fields line up. The generated plugin tools mean scanner output moves into the report without an intermediate step.
An MCP server built on the reptor CLI, exposing SysReptor's pentest reporting and automation as tools. Findings get full create, read, update and delete through reptor's Python API, and every reptor plugin — nmap, nessus, burp, zap, sslyze and the rest — is turned into a tool automatically.
- Findings created, read in detail, patched and deleted against a SysReptor project (create_finding, get_finding_details, patch_finding, delete_finding)
- Every finding on a project listed in one call (list_findings)
- The finding schema itself, so fields are discovered rather than guessed (get_finding_schema)
- One tool per reptor plugin, generated automatically — nmap, nessus, burp, zap, sslyze and others
- Template management alongside findings
- Sensitive fields stripped from data before it reaches the model, configured through REPTOR_MCP_EXCLUDE_FIELDS
- A non-blocking event loop with thread-safe, serialised plugin execution
Python 3.10+ with uv or pip, and a running SysReptor instance: its address and an API token are both required, and you can name a default project so calls need not carry one. The server carries no authentication of its own and is built for local use — keep it off the internet and off untrusted networks. The underlying reptor CLI is alpha, so its API can still change.