@turbopentest/mcp-server

MCP server for TurboPentest — run AI-powered penetration tests and review findings from your coding assistant.

Setup

1. Get your API key

Create an API key at turbopentest.com/settings/api-keys.

2. Add to your MCP client

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_live_..."
      }
    }
  }
}

Claude Code (.mcp.json in your project root):

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_live_..."
      }
    }
  }
}

Cursor (Settings > MCP Servers > Add):

{
  "command": "npx",
  "args": ["@turbopentest/mcp-server"],
  "env": {
    "TURBOPENTEST_API_KEY": "tp_live_..."
  }
}

Tools

| Tool | Description | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | start_pentest | Launch a pentest against a verified domain. Supports recon/standard/deep/blitz tiers and optional GitHub repo for white-box scanning. | | get_pentest | Get full scan details: status, progress, findings summary, executive summary, attack surface map, STRIDE threat model. | | list_pentests | List all your pentests with status and finding counts. Filter by status, limit results. | | get_findings | Get structured vulnerability findings with severity, CVSS, CWE, PoC, remediation, and retest commands. Filter by severity. | | download_report | Download a pentest report as markdown (best for AI), JSON, or PDF. | | get_credits | Check your credit balance and available scan tiers with pricing. | | verify_attestation | Verify a blockchain-anchored pentest attestation by hash (public, no API key required). | | list_domains | List your verified domains and their verification status. |

Scan Tiers

| Tier | Agents | Duration | Price | | -------- | ------ | -------- | ----- | | Recon | 1 | 30 min | $49 | | Standard | 4 | 1 hour | $99 | | Deep | 10 | 2 hours | $299 | | Blitz | 20 | 4 hours | $699 |

Example

You:    "Run a pentest on staging.example.com"
Claude: Calls start_pentest → "Started pentest tp_abc123, 4 agents, ~1 hour"

You:    "How's it going?"
Claude: Calls get_pentest → "60% complete, 3 findings so far (1 high, 2 medium)"

You:    "Show me the high severity findings"
Claude: Calls get_findings(severity: "high") → Shows SQL injection details with PoC and remediation

Configuration

| Environment Variable | Description | Default | | ---------------------- | ------------------------------------ | ------------------------------ | | TURBOPENTEST_API_KEY | Your TurboPentest API key (required) | — | | TURBOPENTEST_API_URL | Custom API base URL (for testing) | https://turbopentest.com/api |

Requirements

• Node.js 18+
• A TurboPentest account with API access

License

MIT