Turbopentest

integsec/turbopentest-mcp

Connects Claude to TurboPentest's API so you can launch pentests, poll for findings, and pull reports without switching windows. Exposes seven tools covering the full workflow: start scans against verified domains, filter findings by severity, download reports in markdown or PDF, and verify blockchain attestations. Four built-in prompts handle common sequences like compare_pentests for diff'ing two runs or security_posture for an executive view across recent scans. Supports white-box mode if you pass a GitHub repo URL, adding SAST and secret detection on top of black-box testing. Each completed scan gets anchored on-chain with a SHA-256 hash you can verify independently. Useful when you want security testing in the same loop as code review and deployment prep.

tools: 8
auth: Secret needed
transport: STDIO
env vars: 2
last updated: Mar 16, 2026

View on GitHub

Tools

8 tools

Public tool metadata for what this MCP can expose to an agent.

turbopentest_download_reportDownload a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-readable analysis, 'json' for structured programmatic data, or 'pdf' for a professionally formatted document sui...2 params

Download a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-readable analysis, 'json' for structured programmatic data, or 'pdf' for a professionally formatted document sui...

Parameters* required

formatstring

one of json · markdown · pdf

pentest_idstring

turbopentest_get_creditsCheck your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one credit of the matching type. Call this before turbopentest_start_scan to verify you have sufficient cr...

Check your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one credit of the matching type. Call this before turbopentest_start_scan to verify you have sufficient cr...

No parameter schema in public metadata yet.

turbopentest_get_findingsRetrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of concept, remediation steps, and a retest command. Returns up to 20 findings at a time — use the severity...2 params

Retrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of concept, remediation steps, and a retest command. Returns up to 20 findings at a time — use the severity...

Parameters* required

pentest_idstring

severitystring

one of critical · high · medium · low · info

turbopentest_get_scanRetrieve full details for a specific penetration test by its ID. Returns current status, scan progress percentage, findings summary by severity, executive summary, attack surface map, and STRIDE threat model. Use this to monitor a running scan or review completed results. For...1 params

Retrieve full details for a specific penetration test by its ID. Returns current status, scan progress percentage, findings summary by severity, executive summary, attack surface map, and STRIDE threat model. Use this to monitor a running scan or review completed results. For...

Parameters* required

pentest_idstring

turbopentest_list_domainsList all domains in your account with their verification status and expiry dates. A domain must have status 'verified' before it can be used as a target in turbopentest_start_scan. To verify a new domain, add a DNS TXT record via the TurboPentest dashboard at turbopentest.com/...

List all domains in your account with their verification status and expiry dates. A domain must have status 'verified' before it can be used as a target in turbopentest_start_scan. To verify a new domain, add a DNS TXT record via the TurboPentest dashboard at turbopentest.com/...

No parameter schema in public metadata yet.

turbopentest_list_scansList all your penetration tests with their status and finding counts, ordered newest first. Use this to find pentest IDs, check which scans are running, or review past results. Supports filtering by status and limiting result count. Use turbopentest_get_scan with a specific ID...2 params

List all your penetration tests with their status and finding counts, ordered newest first. Use this to find pentest IDs, check which scans are running, or review past results. Supports filtering by status and limiting result count. Use turbopentest_get_scan with a specific ID...

Parameters* required

limitinteger

default: 10

statusstring

one of queued · scanning · complete · failed

turbopentest_start_scanLaunch an AI-powered penetration test against a target URL. The target domain must be verified first — use turbopentest_list_domains to check. Requires an available credit matching the selected tier — use turbopentest_get_credits to check balance. Returns a pentest ID that can...3 params

Launch an AI-powered penetration test against a target URL. The target domain must be verified first — use turbopentest_list_domains to check. Requires an available credit matching the selected tier — use turbopentest_get_credits to check balance. Returns a pentest ID that can...

Parameters* required

repo_urlstring

target_urlstring

tierstring

one of recon · standard · deep · blitzdefault: standard

turbopentest_verify_attestationVerify a blockchain-anchored penetration test attestation by its SHA-256 hash. Returns scan metadata (tier, agents, duration, risk score, finding summary) and blockchain proof (chain ID, transaction hash, block number, merkle root) if anchored. This is a public endpoint — no A...1 params

Verify a blockchain-anchored penetration test attestation by its SHA-256 hash. Returns scan metadata (tier, agents, duration, risk score, finding summary) and blockchain proof (chain ID, transaction hash, block number, merkle root) if anchored. This is a public endpoint — no A...

Parameters* required

hashstring

Configuration

TURBOPENTEST_API_KEY*secret

Your TurboPentest API key for authentication

TURBOPENTEST_API_URL

Custom API base URL (default: https://turbopentest.com/api)

Readme

@turbopentest/mcp-server

MCP server for TurboPentest — launch AI-powered penetration tests, review vulnerability findings, and generate security reports, all without leaving your coding assistant.

What it does

Ask your AI assistant to run a pentest, check progress, and walk you through remediation — the server handles all the API calls. Every completed scan is anchored to the blockchain, giving you a tamper-proof attestation you can share with customers or auditors.

Quick start

1. Get your API key

2. Verify a domain

Before scanning, verify that you own the target domain at turbopentest.com/domains.

3. Add the server to your MCP client

Claude Code (.mcp.json in your project root):

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_live_..."
      }
    }
  }
}

Claude Desktop (claude_desktop_config.json):

View the full README on GitHub

Details

Repository: github.com/integsec/turbopentest-mcp
Package: @turbopentest/mcp-server
Transport: STDIO
Auth: Required
Registry: MCP registry, active