PentestGPT-MCP

by yuhano

Not rated

GitHub

About

An advanced penetration testing tool for automated, LLM-driven security assessments using tools like nmap and dirb.

Details

Author: yuhano
Categories: Developer Tools, Security, AI

1. Clone the Repository and Set Up a Virtual Environment

git clone https://github.com/your-username/PentestGPT-MCP.git cd PentestGPT-MCP python -m venv venv source venv/bin/activate # On Windows, use venv\Scripts\activate`

Install the required Python packages fromrequirements.txt.


PentestGPT-MCP requires API keys to interact with Large Language Models. Set the appropriate environment variables for the model you wish to use.
export OPENAI_API_KEY="your-openai-api-key"

export GOOGLE_API_KEY="your-google-api-key"

The tool manages connections to MCP servers through a central JSON configuration file.

Copy the example file from theconfig/directory to the project root.


cp config/mcp_servers.json.example ./mcp_servers.json

Openmcp_servers.jsonand customize it to match your environment.


{ "mcpServers": { "pentest-tools": { "command": "python", "args": ](https://www.usenix.org/conference/usenixsecurity24/presentation/deng)[ "mcp_servers/pentest_tools_server.py" ] }, "kali_mcp": { "command": "python3", "args": [ "/absolute/path/to/mcp_server.py", "http://LINUX_IP:5000/" ] } } }

- mcpServers: The root object containing all server configurations. -"server-name": A unique, user-defined name for each server (e.g.,"pentest-tools"). -command: The command to execute the server (e.g.,python,python3,node). -args: An array of arguments to pass to the command. The first argument is typically the path to the server script.

Important: The defaultmcp_servers/pentest_tools_server.pyassumes that tools likenmapanddirbare installed and available in the system's PATH. It is highly recommended to run this in an environment where these tools are present, such as Kali Linux.


Start the application from the project root directory.
You can use several command-line arguments to customize the session:
- Change Models:
python main.py --reasoning gpt-4o --parsing gpt-4o

python main.py --mcp-config /path/to/your/mcp_servers.json

-
Provide Initial Information: When prompted, briefly describe the penetration testing target and objective.
Please describe the penetration testing task in one line... > Penetration test on the web server at http://10.0.2.15

- next: Input the results from a manual scan or any text you want to analyze. PentestGPT will process the input and suggest the next steps in the Penetration Testing Tree (PTT). -todo: Ask PentestGPT to recommend the next task based on the current PTT.

- Typeautoat the prompt to execute the most recently suggested task via an MCP server. - You will be asked to select which configured MCP server to use for the task. - Choose the interactive mode (y) to review and confirm each tool command before execution, ensuring a safe and controlled process.

- next: Submit test results for analysis and receive suggestions for the next task. -todo: Ask for a recommendation on what to do next. -more: Request a more detailed explanation of the current task. -auto: Automatically execute the latest suggested task using a connected MCP server. -discuss: Engage in a free-form conversation with PentestGPT. -quit`: End the current session (you will be prompted to save the session before exiting).

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Cyber Host Artificial Intelligence (C.H.A.I) is Autonomous penetration testing MCP (Model Context Protocol) server with an integrated AI decision engine, multi-provider LLM support, and an extensible plugin architecture.

Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server

Security scanner for MCP servers and AI agent tooling. Detects prompt injection, command injection, auth bypass, and excessive permissions.

Remote MCP server (Streamable HTTP) at https://mcp.agenticrail.nz/ — deterministic step-order enforcement for AI agents. evaluate_step returns ALLOW or DENY before a step runs; verify_receipt proves a sequence's Ed25519-signed, hash-chained receipt chain is intact. No auth required: omit the bearer token and calls run on the public demo key. That first clause matters — the form has no "remote/hosted" field, and putting the endpoint in the description is the convention on that list ("Fully REMOTE! Just use…"). The rest mirrors your own server card verbatim, so the listing and the card can't drift.

Deterministic security preflight for AI agents. Check URLs, files and shell commands before acting.

EU AI Act compliance scanner for Python AI agents — 10 tools for scanning, analysis, and remediation

Arcjet is the runtime security platform that ships with your AI code.

A secure sandbox for executing code in Docker containers, providing a safe environment for AI applications.

Remediate vulnerabilities found by Contrast products using LLM and Coding Agent capabilities.

AES-256-GCM + Argon2id encrypted local vault that resolves {{PLACEHOLDER}} secrets for AI agent credentials.

This project is an advanced penetration testing tool based on the original "PentestGPT" paper. It extends the core capabilities by integrating with Model Context Protocol servers (MCPs) to perform automated, LLM-driven security assessments.

- Original GitHub Repository:https://github.com/GreyDGL/PentestGPT
- Original Research Paper (USENIX Security '24):https://www.usenix.org/conference/usenixsecurity24/presentation/deng

- Dynamic MCP Server Integration: Connects to various tool servers running locally or remotely via a flexiblemcp_servers.jsonconfiguration file.
- Automated Task Execution (automode): Automatically executes LLM-suggested tasks using tools provided by a connected MCP server.
- Interactive "Human-in-the-Loop" Mode: Supports user confirmation before each tool execution, enhancing safety and control during automated scans.
- Flexible Model Support: Works with a wide range of LLM providers, including OpenAI (GPT series) and Google (Gemini series).

1. Clone the Repository and Set Up a Virtual Environment

git clone https://github.com/your-username/PentestGPT-MCP.git cd PentestGPT-MCP python -m venv venv source venv/bin/activate # On Windows, use venv\Scripts\activate`

Install the required Python packages fromrequirements.txt.


PentestGPT-MCP requires API keys to interact with Large Language Models. Set the appropriate environment variables for the model you wish to use.
export OPENAI_API_KEY="your-openai-api-key"

export GOOGLE_API_KEY="your-google-api-key"

The tool manages connections to MCP servers through a central JSON configuration file.

Copy the example file from theconfig/directory to the project root.


cp config/mcp_servers.json.example ./mcp_servers.json

Openmcp_servers.jsonand customize it to match your environment.

{ "mcpServers": { "pentest-tools": { "command": "python", "args": [ "mcp_servers/pentest_tools_server.py" ] }, "kali_mcp": { "command": "python3", "args": [ "/absolute/path/to/mcp_server.py", "http://LINUX_IP:5000/" ] } } }


Start the application from the project root directory.
You can use several command-line arguments to customize the session:
- Change Models:
python main.py --reasoning gpt-4o --parsing gpt-4o

python main.py --mcp-config /path/to/your/mcp_servers.json

-
Provide Initial Information: When prompted, briefly describe the penetration testing target and objective.
Please describe the penetration testing task in one line... > Penetration test on the web server at http://10.0.2.15