@pisteyo/penta-mcp

Pentaomax MCP server + Claude Code Skill. Scan your own repo and walk through fixes from inside Claude.

What you get

• MCP tools for Claude Desktop / Claude Code (stdio transport): penta_scan_repo, penta_scan_paste, penta_get_findings, penta_get_finding_detail, penta_gate_check, penta_report_completed, penta_compliance_status.
• A Claude Skill (.claude/skills/penta-review.md) that teaches Claude when and how to call the tools, materializes findings as local files under Penta/<MMDDYY-HHMM>/1.ToBeWork/<severity>/, and walks the engineer through the fix loop.
• A pre-push gate hook that calls Pentaomax's deploy-gate API before every git push and exits non-zero on block when PENTA_STRICT=1.

Quick start

# 1. Mint an API key at https://penta.pisteyo.ai/settings/api-keys
# 2. From your repo root:
npx -y @pisteyo/penta-mcp-init
# answer the three prompts; the snippet you need is printed at the end
# 3. Paste the snippet into your Claude config and restart Claude
# 4. Run claude in the same directory:
claude
> Penta review

What init writes

• .claude/skills/penta-review.md — the Skill the Claude clients load.
• .penta-config.json — per-repo config (repoFullName, gitHubIssues).

Then prints a claude_desktop_config.json snippet pre-filled with your API key.

Pre-push gate hook

Once per repo:

npx -y @pisteyo/penta-mcp-init install-hook

Idempotent — re-running just refreshes the Penta block of your existing pre-push hook. Detects .husky/ (preferred) or .git/hooks/.

Required env at push time:

export PENTA_API_KEY=pk_live_...
export PENTA_REPO=owner/repo
# optional:
export PENTA_BASE_URL=https://penta.pisteyo.ai
export PENTA_STRICT=1     # make `block` verdicts fail the push

Bypass any time with git push --no-verify.

Reporting completed work

The Skill nudges you to move finished finding markdown from 1.ToBeWork/<sev>/ to 2.WorkedCompleted/<sev>/ after fixes land. To push the batch to Penta:

# inside `claude`:
> let Penta know what I finished

Claude invokes penta_report_completed which walks Penta/<scan>/2.WorkedCompleted/, parses fingerprints from frontmatter, and posts to /api/v1/scans/<id>/reconcile. If you skip this step the next scheduled Penta scan picks up the fixed code automatically.

Environment variables

| Var | Required | Default | Purpose | |-------------------|----------|-------------------------------|----------------------------------| | PENTA_API_KEY | yes | — | Bearer token for the Penta API. | | PENTA_BASE_URL | no | https://penta.pisteyo.ai | Override for self-hosted Penta. | | PENTA_REPO | hook-only| — | owner/repo for the gate hook. | | PENTA_STRICT | no | unset | 1 makes hook fail on block. |

File layout it writes in your repo

Penta/
├── current → 060426-1430                    (symlink to latest scan)
├── 060426-1430/
│   ├── _scan-meta.json
│   ├── 1.ToBeWork/
│   │   ├── critical/F-9a3b1c-sql-injection.md
│   │   ├── high/
│   │   ├── medium/
│   │   └── low/
│   └── 2.WorkedCompleted/                   (you move files here as fixes land)
│       └── critical/
└── .penta-config.json

Commit Penta/ to git for an audit trail across the team, or add it to .gitignore if you'd rather keep findings local.

Subcommands

| Command | Purpose | |--------------------------------------|---------------------------------------------| | penta-mcp-init | Interactive setup. Default subcommand. | | penta-mcp-init install-hook | Install the pre-push gate hook. | | penta-mcp | The MCP server (invoked by your client). |

License

Apache-2.0