Pentest-Tools.com MCP server

Available on all paid plans. You'll need to generate an API key from My Account -> API from inside the product. Free plan users don't have API access, so the MCP server won't work on the free edition.

The remote server requires no installation and works with just your API key and a compatible client. Use it if you want the fastest setup. The local server requires Python 3.10+ and the [mcp] package, but keeps all communication between your LLM client and the Pentest-Tools.com API, with nothing passing through our MCP server. If you're working with sensitive client data or operating under strict data handling policies, the local option gives you more control.

Yes. You'll need a VPN profile configured in your Pentest-Tools.com account to make your internal environment reachable by our scanners. To get access, you’ll need to buy the “Internal network scanning” add-on.

Yes. The Python package is publicly available on GitHub at https://github.com/pentesttoolscom/pentesttools-pypi. You can inspect the code and host it yourself. When running locally, only standard API calls reach Pentest-Tools.com. Nothing else you share with your LLM passes through our infrastructure.

Any client that supports the Model Context Protocol. We provide ready-made configuration guides for Claude, VS Code, and Gemini CLI. Other MCP-compatible clients will also work. You can connect using either the remote server URL with an Authorization header, or by running the local server via the ptt mcp command.

No. By default, most MCP clients ask for your explicit confirmation before executing any tool call. You can see exactly which API call the LLM is about to make, and you can reject it. However, some clients allow you to disable these confirmation prompts if you're confident in your setup.

The LLM reads the full tool specification from the MCP server every time it connects. If we update the API or change parameters, the LLM picks up the new definitions automatically. You don't need to update any scripts, configs, or client-side code. This is one of the key advantages over writing direct API integrations.

True parallel execution across multiple scans depends on your plan's parallel scan limit and on how your LLM client handles concurrent tool calls, which most clients don't fully support yet.

Yes. The Website Scanner supports login form, cookie, and header authentication through the MCP. Authenticated scanning involves more complex parameters than a standard scan, so you may need to be more explicit in your prompt about how the login works (URL, credentials, form fields). Recorded authentication is not supported, as the API doesn't support that method either.

A few things to keep in mind: the report translation tool (translate_report) is capped at roughly 50 findings per hour due to API import limits. Your scan capacity (parallel scans, queued scans, assets per cycle) depends on your subscription plan. Some clients, including VS Code, can't display progress bars for long-running scans, though you'll still get status updates. And the MCP intentionally exposes a small number of tools to keep LLM performance reliable, since most clients degrade as the tool count grows.

Yes. Since MCP is an open standard, you can configure multiple MCP servers in the same client. For example, connect the Pentest-Tools.com MCP alongside Linear to push findings directly into project tasks, or alongside GitHub to reference code while reviewing scan results. The more MCPs your client supports, the more you can automate in a single conversation.

Your LLM client processes whatever data the MCP server returns, which includes scan results, findings, and report content. This is the same data you'd see in the API response. If you run the hosted version, Pentest-Tools.com sees both the API calls and the MCP tool calls. If you run locally, we only see API calls. Your API key is passed as an environment variable or HTTP header and is not shared with the LLM itself. However, if you use authenticated scanning and include credentials in your prompt, those credentials are visible to your LLM provider.