@pentatrail/mcp-server

PentaTrail MCP Server for accessing CTEM (Continuous Threat Exposure Management) data via Model Context Protocol.

This package is a thin stdio wrapper over the PentaTrail Customer API. It works with Claude Code, Claude Desktop, and any MCP-compatible client.

The published MCP server is read-only. It exposes only the 9 public CTEM read tools; internal MCP-only tools are not registered by default.

Setup

Run

The simplest way to use the server is with npx:

npx @pentatrail/mcp-server

Publish

Release the package from this directory:

cd packages/pentatrail-mcp
npm login --registry=https://registry.npmjs.org/
npm run build
npm pack --dry-run --cache /tmp/npm-cache
npm publish --access public

Notes:

• Scoped packages require --access public for a public npm release.
• If you are already logged in, npm login can be skipped.
• Bump the version before publishing a new release, for example with npm version patch --no-git-tag-version.

Configure

Add to your MCP client config (e.g. ~/.claude/settings.json or claude_desktop_config.json):

{
  "mcpServers": {
    "pentatrail": {
      "command": "npx",
      "args": ["@pentatrail/mcp-server"],
      "env": {
        "PENTATRAIL_API_KEY": "ptk_your_api_key_here",
        "PENTATRAIL_API_URL": "https://api.pentatrail.co"
      }
    }
  }
}

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | PENTATRAIL_API_KEY | Yes | Your API key (ptk_...). Generate from PentaTrail Dashboard > Settings. | | PENTATRAIL_API_URL | Yes | https://api.pentatrail.co (production) |

Available Tools

CTEM Read

| Tool | Description | |------|-------------| | ctem_list_domains | List all monitored domains for your contract | | ctem_list_hosts | List hosts with enrichment (port/tech/finding counts, sortable) | | ctem_list_findings | List vulnerabilities sorted by Threat Discovery Level (TDL) | | ctem_get_asset_counts | Get asset type counts (hosts, IPs, ports, tech, buckets, URLs) | | ctem_get_tdl_counts | Get open finding counts grouped by TDL (tdl5=most critical) | | ctem_get_scores | Get live domain scores (asset counts + findings breakdown) | | ctem_get_score_trend | Get security score trend over time (7-365 days) | | ctem_list_ports | List ports grouped by target, port, and protocol | | ctem_list_tech | List detected technologies grouped by category and name |

Usage Examples

Once configured, ask your AI assistant:

• "Show me all monitored domains"
• "List critical findings for domain X"
• "What's the security score trend for the last 30 days?"
• "How many assets do we have?"
• "Show my threat exposure risk level for this domain"

Requirements

• Node.js >= 20
• PentaTrail account with an active contract
• API key with ctem:read scope

Integration tests

End-to-end tests against dev Supabase. See INTEGRATION_TESTS.md for setup, local execution, and failure triage.

License

UNLICENSED - Proprietary software. All rights reserved.