{"server":{"name":"io.github.cyanheads/pentest-mcp-server","$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","remotes":[{"url":"https://pentest.caseyjhand.com/mcp","type":"streamable-http"}],"version":"0.2.0","packages":[{"version":"0.2.0","transport":{"type":"stdio"},"identifier":"@cyanheads/pentest-mcp-server","runtimeHint":"npx","registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","environmentVariables":[{"name":"PENTEST_ENABLE_PAYLOAD_GENERATION","format":"boolean","default":"true","description":"Enable payload generation and encoding. Set false to retain the five reference tools only."},{"name":"MCP_LOG_LEVEL","format":"string","default":"info","description":"Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."}]},{"version":"0.2.0","transport":{"url":"http://localhost:3010/mcp","type":"streamable-http"},"identifier":"@cyanheads/pentest-mcp-server","runtimeHint":"npx","registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","environmentVariables":[{"name":"PENTEST_ENABLE_PAYLOAD_GENERATION","format":"boolean","default":"true","description":"Enable payload generation and encoding. Set false to retain the five reference tools only."},{"name":"MCP_TRANSPORT_TYPE","value":"http","format":"string","description":"Selects the HTTP transport."},{"name":"MCP_HTTP_HOST","format":"string","default":"127.0.0.1","description":"The hostname for the HTTP server."},{"name":"MCP_HTTP_PORT","format":"string","default":"3010","description":"The port to run the HTTP server on."},{"name":"MCP_HTTP_ENDPOINT_PATH","format":"string","default":"/mcp","description":"The endpoint path for the MCP server."},{"name":"MCP_AUTH_MODE","format":"string","default":"none","description":"Authentication mode to use: 'none', 'jwt', or 'oauth'."},{"name":"MCP_LOG_LEVEL","format":"string","default":"info","description":"Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."}]}],"repository":{"url":"https://github.com/cyanheads/pentest-mcp-server","source":"github"},"description":"Offline methodology engine for authorized penetration testing, CTF, and security research."},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","isLatest":true,"updatedAt":"2026-10-15T11:30:37.528537Z","publishedAt":"2026-10-15T11:30:37.528537Z","statusChangedAt":"2026-10-15T11:30:37.528537Z"},"dev.protogrid/connectability":{"class":"R0","autonomous":true,"human_steps":[],"preferred":{"kind":"remote","idx":0},"remotes":[{"idx":0,"url":"https://pentest.caseyjhand.com/mcp","transport":"streamable-http","templated":false,"headers":[],"auth":{"type":"none","location":null,"secret_name":null,"oauth":null},"protocol":{"supported_versions":["2026-07-28"],"stateless":true},"health":{"reachable":true,"uptime_30d":1,"latency_ms_p50":195,"consecutive_failures":0,"last_probe_at":"2026-10-19T07:46:55.345Z","last_ok_at":"2026-10-19T07:46:55.345Z"}}],"packages":[{"idx":0,"registry_type":"npm","identifier":"@cyanheads/pentest-mcp-server","version":"0.2.0","runtime_hint":"npx","transport":"stdio","secrets":[],"requires_execution":true},{"idx":1,"registry_type":"npm","identifier":"@cyanheads/pentest-mcp-server","version":"0.2.0","runtime_hint":"npx","transport":"streamable-http","secrets":[],"requires_execution":true}]},"dev.protogrid/tools":[{"name":"pentest_analyze_response","title":"Pentest Analyze Response","description":"Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_encode_payload","title":"Pentest Encode","description":"Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_generate_payloads","title":"Pentest Generate Payloads","description":"Generate context-specific payload templates for authorized systems. Each template includes its vulnerability category, context rationale, WAF/IDS detection signature, mitigation, optional WAF research note, and optional encoded variant.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_get_guide","title":"Pentest Guide","description":"Return an authorized-testing methodology for a selected vector and optional target context. The playbook covers reconnaissance, enumeration, exploitation, and post-exploitation phases with objectives, techniques, detection signals, mitigations, common pitfalls, references, and context-derived tool suggestions across 15 vectors.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_lookup_group","title":"Pentest Lookup Group","description":"Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_lookup_technique","title":"Pentest Lookup Technique","description":"Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"},{"name":"pentest_map_techniques","title":"Pentest Map Techniques","description":"Rank ATT&CK techniques and OWASP test cases against an authorized target profile of technology stack, exposed services, authentication type, and operating system. Results include profile-specific relevance, detection opportunities, mitigations, and associated methodology vectors.","annotations":{"readOnlyHint":true,"openWorldHint":false,"idempotentHint":true},"source":"probe","observed_at":"2026-10-19T07:46:55.345Z"}],"dev.protogrid/trust":{"score":94,"components":{"hygiene":100,"liveness":100,"freshness":100,"provenance":80},"drivers":["+repository","+namespace-matches-repo","+reachable","+uptime-100%","+updated-4d-ago"],"flags":[],"blocked":false,"computed_at":"2026-10-19T12:11:55.063Z","disclaimer":"Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed."},"dev.protogrid/quality":{"score":84,"label":"good","components":{"auth":null,"hygiene":86,"protocol":88,"stability":75,"dependencies":null},"checks":[{"id":"protocol.modern","detail":"supports 2026-07-28 (server/discover)","status":"pass","category":"protocol"},{"id":"protocol.stateless","detail":"answers without a session","status":"pass","category":"protocol"},{"id":"protocol.transport","detail":"streamable HTTP","status":"pass","category":"protocol"},{"id":"protocol.list_ttl","detail":"tools/list declares ttlMs 0, so clients re-fetch it on every use","status":"warn","category":"protocol"},{"id":"auth.prm","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.as_metadata","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.cimd","detail":"no remote uses OAuth","status":"na","category":"auth"},{"id":"auth.secret_in_url","detail":"no templated URL","status":"na","category":"auth"},{"id":"tools.descriptions","detail":"every tool has a description","status":"pass","category":"hygiene"},{"id":"tools.description_length","detail":"descriptions are concise","status":"pass","category":"hygiene"},{"id":"tools.schemas","detail":"every tool has an object input schema","status":"pass","category":"hygiene"},{"id":"tools.annotations","detail":"7 of 7 tools declare readOnlyHint or destructiveHint","status":"pass","category":"hygiene"},{"id":"tools.directory_hints","detail":"no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: pentest_get_guide (destructiveHint); pentest_analyze_response (destructiveHint); pentest_lookup_group (destructiveHint); …","status":"fail","category":"hygiene"},{"id":"tools.token_cost","detail":"about 2,392 tokens to load every tool","status":"pass","category":"hygiene"},{"id":"tools.api_dump","detail":"tools are not a one-to-one API dump","status":"pass","category":"hygiene"},{"id":"stability.changes","detail":"6 tool changes in 30 days","status":"warn","category":"stability"},{"id":"stability.rug_pull","detail":"no tool changed its meaning under the same name","status":"pass","category":"stability"},{"id":"deps.known_vulns","detail":"deps.dev does not know @cyanheads/pentest-mcp-server@0.2.0, @cyanheads/pentest-mcp-server@0.2.0","status":"na","category":"dependencies"},{"id":"deps.mcp_sdk_version","detail":"deps.dev does not know @cyanheads/pentest-mcp-server@0.2.0, @cyanheads/pentest-mcp-server@0.2.0","status":"na","category":"dependencies"},{"id":"deps.resolvable","detail":"deps.dev does not know @cyanheads/pentest-mcp-server@0.2.0, @cyanheads/pentest-mcp-server@0.2.0","status":"na","category":"dependencies"}],"drivers":["-tools.directory_hints","~protocol.list_ttl","~stability.changes"],"flags":[],"tool_count":7,"token_estimate":2392,"tools_hash":"8a8b7659a999b09057adae507d6fd63f","tools_changed_at":"2026-10-15T13:59:09.623Z","computed_at":"2026-10-19T12:00:19.663Z","disclaimer":"Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed."},"dev.protogrid/identity":{"canonical_id":"io.github.cyanheads/pentest-mcp-server","aliases":[],"alias_count":0,"repository_key":"github:cyanheads/pentest-mcp-server","owner":{"verified":false,"method":null,"since":null}}},"next_actions":[{"action":"list_tools","description":"Every current tool with input schemas","href":"/v1/servers/io.github.cyanheads%2Fpentest-mcp-server/tools","arguments":{"name":"io.github.cyanheads/pentest-mcp-server"}},{"action":"get_connection","description":"Minimal connection block for the preferred remote or package","href":"/v1/servers/io.github.cyanheads%2Fpentest-mcp-server/connection?target=mcpServers","arguments":{"name":"io.github.cyanheads/pentest-mcp-server","target":"mcpServers"}},{"action":"search","description":"Find other servers by intent","href":"/v1/search?q={query}","arguments":{"q":"{query}"}}]}