{"id":"7b9016ba-f997-4e58-8122-7ab707d3ebf0","slug":"turbopentest-mcp","kind":"mcp","name":"turbopentest-mcp","summary":"MCP server for TurboPentest — AI-powered penetration testing from your coding assistant","owner":"IntegSec","repoUrl":"https://github.com/IntegSec/turbopentest-mcp","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-03-16T06:32:52.000Z","addedAt":"2026-10-14T05:39:09.571Z","logoUrl":"https://avatars.githubusercontent.com/u/273169999?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","cloud-infra"],"tags":[],"runtime":"node","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":true,"reviewed":false,"syncedAt":"2026-10-17T16:09:54.209Z","sample":false,"url":"https://conduits.dev/tools/turbopentest-mcp","language":"TypeScript","transports":["stdio"],"install":{"npm":"@turbopentest/mcp-server"},"requirements":{"env":[{"name":"TURBOPENTEST_API_KEY","secret":true,"required":true,"description":"Your TurboPentest API key for authentication"},{"name":"TURBOPENTEST_API_URL","secret":false,"required":false,"description":"Custom API base URL (default: https://turbopentest.com/api)"}],"upstreamMayCharge":false},"tools":null,"readme":"# @turbopentest/mcp-server\n\nMCP server for [TurboPentest](https://turbopentest.com) — launch AI-powered penetration tests, review vulnerability findings, and generate security reports, all without leaving your coding assistant.\n\n## What it does\n\nAsk your AI assistant to run a pentest, check progress, and walk you through remediation — the server handles all the API calls. Every completed scan is anchored to the blockchain, giving you a tamper-proof attestation you can share with customers or auditors.\n\n## Quick start\n\n### 1. Get your API key\n\nSign up and create an API key at [turbopentest.com/settings/api-keys](https://turbopentest.com/settings/api-keys).\n\n### 2. Verify a domain\n\nBefore scanning, verify that you own the target domain at [turbopentest.com/domains](https://turbopentest.com/domains).\n\n### 3. Add the server to your MCP client\n\n**Claude Code** (`.mcp.json` in your project root):\n\n```json\n{\n  \"mcpServers\": {\n    \"turbopentest\": {\n      \"command\": \"npx\",\n      \"args\": [\"@turbopentest/mcp-server\"],\n      \"env\": {\n        \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n      }\n    }\n  }\n}\n```\n\n**Claude Desktop** (`claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"turbopentest\": {\n      \"command\": \"npx\",\n      \"args\": [\"@turbopentest/mcp-server\"],\n      \"env\": {\n        \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n      }\n    }\n  }\n}\n```\n\n**Cursor** (Settings > MCP Servers > Add):\n\n```json\n{\n  \"command\": \"npx\",\n  \"args\": [\"@turbopentest/mcp-server\"],\n  \"env\": {\n    \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n  }\n}\n```\n\n**OpenAI Codex CLI** (`~/.codex/config.toml`, or run `codex mcp add turbopentest -- npx @turbopentest/mcp-server` and set the env var when prompted):\n\n```toml\n[mcp_servers.turbopentest]\ncommand = \"npx\"\nargs = [\"@turbopentest/mcp-server\"]\n\n[mcp_servers.turbopentest.env]\nTURBOPENTEST_API_KEY = \"tp_live_...\"\n```\n\nThen run `/mcp` inside Codex to confirm `turbopentest` is listed. Codex's MCP\nclient doesn't support the \"prompts\" primitive, so the four guided workflows\nare also exposed as plain tools (`turbopentest_workflow_*`, see below) and\ndescribed in this repo's `AGENTS.md`, which Codex reads automatically.\n\n## Example session\n\n```\nYou:    \"Run a standard pentest on staging.example.com\"\nClaude: Checks domain is verified, confirms credit balance,\n        calls start_pentest → \"Started tp_abc123, 4 agents, ~1 hour\"\n\nYou:    \"Any findings yet?\"\nClaude: Calls get_pentest → \"62% complete — 3 findings (1 high, 2 medium)\"\n\nYou:    \"Show me the high severity ones\"\nClaude: Calls get_findings(severity: \"high\") →\n        [1] HIGH: SQL Injection in /api/search\n            CVSS: 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\n            CWE: CWE-89\n            PoC: POST /api/search?q=' OR 1=1--\n            Remediation: Use parameterized queries...\n            Retest: sqlmap -u \"https://staging.example.com/api/search\" ...\n\nYou:    \"Give me a prioritized remediation plan\"\nClaude: Uses the analyze_findings prompt → produces a full markdown\n        remediation plan grouped by severity and effort\n```\n\n## White-box scanning\n\nPass a GitHub repository URL to `start_pentest` to enable white-box mode. In addition to black-box testing, the scan will include:\n\n- **SAST** — static code analysis for common vulnerability patterns\n- **Secret detection** — leaked API keys, credentials, and tokens in source\n- **SCA** — dependency audit for known CVEs\n\n```\nYou:  \"Pentest staging.example.com, the repo is github.com/myorg/myapp\"\n```\n\n## Tools\n\n| Tool | Description |\n|------|-------------|\n| `turbopentest_start_pentest` | Launch a pentest against a verified domain. Supports four tiers and optional GitHub repo for white-box scanning. |\n| `turbopentest_get_pentest` | Get scan status, progress, findings summary, executive summary, attack surface map, and STRIDE threat model. |\n| `turbopentest_list_pentests` | List all pentests with status and finding counts. Filterable by status. |\n| `turbopentest_get_findings` | Retrieve structured findings with severity, CVSS, CWE, OWASP category, PoC, remediation steps, and retest commands. Filterable by severity. |\n| `turbopentest_download_report` | Download a report in markdown (best for AI), JSON, or PDF format. |\n| `turbopentest_get_credits` | Check your credit balance and available scan tiers with pricing. |\n| `turbopentest_verify_attestation` | Verify a blockchain-anchored attestation by SHA-256 hash. No API key required — public endpoint. |\n| `turbopentest_list_domains` | List your verified domains and their verification status. |\n| `turbopentest_workflow_run_pentest` | Returns the `run_pentest` workflow instructions as tool output (for clients without prompts support, e.g. Codex). |\n| `turbopentest_workflow_analyze_findings` | Returns the `analyze_findings` workflow instructions as tool output. |\n| `turbopentest_workflow_compare_pentests` | Returns the `compare_pentests` workflow instructions as tool output. |\n| `turbopentest_workflow_security_posture` | Returns the `security_posture` workflow instructions as tool output. |\n\n**Security note:** `turbopentest_start_pentest` checks domain verification\nitself before calling the API — it will refuse (`isError: true`) to launch\nagainst a target whose domain isn't verified on your account, rather than\nrelying solely on the agent to check first.\n\n## Prompts\n\nBuilt-in prompts guide your AI assistant through multi-step workflows. Invoke them by name in any MCP client that supports prompts (Claude Code, Claude Desktop, Cursor). In clients that only support tools (Codex), use the matching `turbopentest_workflow_*` tool above instead — the text is identical.\n\n| Prompt | Equivalent tool | Description |\n|--------|------------------|-------------|\n| `run_pentest` | `turbopentest_workflow_run_pentest` | Full-lifecycle pentest: domain check → credit verification → launch → progress monitoring → findings summary → report download |\n| `analyze_findings` | `turbopentest_workflow_analyze_findings` | Deep-dive analysis of a single pentest's findings, producing a prioritized remediation plan with effort estimates and retest commands |\n| `compare_pentests` | `turbopentest_workflow_compare_pentests` | Diff two pentests on the same target — shows what's new, what's been fixed, and what's still unresolved |\n| `security_posture` | `turbopentest_workflow_security_posture` | Executive briefing across your 5 most recent pentests: risk trends, highest-risk targets, and top 3 recommended actions |\n\n## Scan tiers\n\n| Tier | Agents | Duration | Price |\n|------|--------|----------|-------|\n| Recon | 1 | ~30 min | $49 |\n| Standard | 4 | ~1 hour | $99 |\n| Deep | 10 | ~2 hours | $299 |\n| Blitz | 20 | ~4 hours | $699 |\n\nDefault tier is `standard`. Use `recon` for a quick surface sweep or `blitz` for maximum coverage on critical assets.\n\n## Blockchain attestation\n\nEvery completed pentest is anchored on-chain as a tamper-proof attestation. The SHA-256 hash is included in the report and can be independently verified — by you, your customers, or auditors — with no API key required:\n\n```\nYou:  \"Verify attestation abc123def456...\"\n```\n\n`turbopentest_verify_attestation` returns the scan metadata (tier, agents, duration, risk score, findings summary) alongside the blockchain proof (chain ID, transaction hash, block number, merkle root).\n\n## Configuration\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `TURBOPENTEST_API_KEY` | Yes | — | API key from turbopentest.com/settings/api-keys |\n| `TURBOPENTEST_API_URL` | No | `https://turbopentest.com/api` | Override the API base URL (for testing) |\n\n## Requirements\n\n- Node.js 18+\n- A [TurboPentest](https://turbopentest.com) account with at least one verified domain\n\n## Using with OpenAI Codex\n\nSee [docs/CODEX.md](docs/CODEX.md) for the full Codex guide — configuration,\nthe tool list, the authorization model, and why the guided workflows are\nexposed as `turbopentest_workflow_*` tools instead of MCP prompts.\n\n## Privacy & support\n\n- **Privacy policy:** https://turbopentest.com/privacy\n- **Subprocessors:** https://turbopentest.com/subprocessors\n- **Support:** open a case at https://turbopentest.com/support (typically\n  answered within a few hours on business days) or join the\n  [Discord](https://discord.gg/6eRf5UMvf2)\n- **Bugs in this MCP server:** https://github.com/integsec/turbopentest-mcp/issues\n\nYour API key is sent only to `turbopentest.com/api` as a bearer token over\nHTTPS. It is never logged and never transmitted anywhere else. Customer pentest\ncontent is not used to train public AI models.\n\n## License\n\nMIT\n"}