Reptor MCP

What it is

An MCP server built on the reptor CLI, exposing SysReptor's pentest reporting and automation as tools. Findings get full create, read, update and delete through reptor's Python API, and every reptor plugin — nmap, nessus, burp, zap, sslyze and the rest — is turned into a tool automatically.

What you get

• Findings created, read in detail, patched and deleted against a SysReptor project (create_finding, get_finding_details, patch_finding, delete_finding)
• Every finding on a project listed in one call (list_findings)
• The finding schema itself, so fields are discovered rather than guessed (get_finding_schema)
• One tool per reptor plugin, generated automatically — nmap, nessus, burp, zap, sslyze and others
• Template management alongside findings
• Sensitive fields stripped from data before it reaches the model, configured through REPTOR_MCP_EXCLUDE_FIELDS
• A non-blocking event loop with thread-safe, serialised plugin execution

Requirements

Python 3.10+ with uv or pip, and a running SysReptor instance: its address and an API token are both required, and you can name a default project so calls need not carry one. The server carries no authentication of its own and is built for local use — keep it off the internet and off untrusted networks. The underlying reptor CLI is alpha, so its API can still change.

Setup effort

Build from source — git clone https://github.com/slvnlrt/reptor-mcp.git

Tools you get

31 tools named in the project's documentation. Seven are the server's own finding tools; the other twenty-four wrap installed reptor CLI plugins, so the count changes with your reptor version and with exclusions in tool_config.py.

Requires

• Python 3.10+
• REPTOR_TOKEN in your environment
• REPTOR_SERVER in your environment

Where it runs

The documented client runs the server on your machine.