{
  "markdown": "# @turbopentest/mcp-server\n\nMCP server for [TurboPentest](https://turbopentest.com) — launch AI-powered penetration tests, review vulnerability findings, and generate security reports, all without leaving your coding assistant.\n\n## What it does\n\nAsk your AI assistant to run a pentest, check progress, and walk you through remediation — the server handles all the API calls. Every completed scan is anchored to the blockchain, giving you a tamper-proof attestation you can share with customers or auditors.\n\n## Quick start\n\n### 1. Get your API key\n\nSign up and create an API key at [turbopentest.com/settings/api-keys](https://turbopentest.com/settings/api-keys).\n\n### 2. Verify a domain\n\nBefore scanning, verify that you own the target domain at [turbopentest.com/domains](https://turbopentest.com/domains).\n\n### 3. Add the server to your MCP client\n\n**Claude Code** (`.mcp.json` in your project root):\n\n```json\n{\n  \"mcpServers\": {\n    \"turbopentest\": {\n      \"command\": \"npx\",\n      \"args\": [\"@turbopentest/mcp-server\"],\n      \"env\": {\n        \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n      }\n    }\n  }\n}\n```\n\n**Claude Desktop** (`claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"turbopentest\": {\n      \"command\": \"npx\",\n      \"args\": [\"@turbopentest/mcp-server\"],\n      \"env\": {\n        \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n      }\n    }\n  }\n}\n```\n\n**Cursor** (Settings > MCP Servers > Add):\n\n```json\n{\n  \"command\": \"npx\",\n  \"args\": [\"@turbopentest/mcp-server\"],\n  \"env\": {\n    \"TURBOPENTEST_API_KEY\": \"tp_live_...\"\n  }\n}\n```\n\n## Example session\n\n```\nYou:    \"Run a standard pentest on staging.example.com\"\nClaude: Checks domain is verified, confirms credit balance,\n        calls start_pentest → \"Started tp_abc123, 4 agents, ~1 hour\"\n\nYou:    \"Any findings yet?\"\nClaude: Calls get_pentest → \"62% complete — 3 findings (1 high, 2 medium)\"\n\nYou:    \"Show me the high severity ones\"\nClaude: Calls get_findings(severity: \"high\") →\n        [1] HIGH: SQL Injection in /api/search\n            CVSS: 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\n            CWE: CWE-89\n            PoC: POST /api/search?q=' OR 1=1--\n            Remediation: Use parameterized queries...\n            Retest: sqlmap -u \"https://staging.example.com/api/search\" ...\n\nYou:    \"Give me a prioritized remediation plan\"\nClaude: Uses the analyze_findings prompt → produces a full markdown\n        remediation plan grouped by severity and effort\n```\n\n## White-box scanning\n\nPass a GitHub repository URL to `start_pentest` to enable white-box mode. In addition to black-box testing, the scan will include:\n\n- **SAST** — static code analysis for common vulnerability patterns\n- **Secret detection** — leaked API keys, credentials, and tokens in source\n- **SCA** — dependency audit for known CVEs\n\n```\nYou:  \"Pentest staging.example.com, the repo is github.com/myorg/myapp\"\n```\n\n## Tools\n\n| Tool | Description |\n|------|-------------|\n| `turbopentest_start_pentest` | Launch a pentest against a verified domain. Supports four tiers and optional GitHub repo for white-box scanning. |\n| `turbopentest_get_pentest` | Get scan status, progress, findings summary, executive summary, attack surface map, and STRIDE threat model. |\n| `turbopentest_list_pentests` | List all pentests with status and finding counts. Filterable by status. |\n| `turbopentest_get_findings` | Retrieve structured findings with severity, CVSS, CWE, OWASP category, PoC, remediation steps, and retest commands. Filterable by severity. |\n| `turbopentest_download_report` | Download a report in markdown (best for AI), JSON, or PDF format. |\n| `turbopentest_get_credits` | Check your credit balance and available scan tiers with pricing. |\n| `turbopentest_verify_attestation` | Verify a blockchain-anchored attestation by SHA-256 hash. No API key required — public endpoint. |\n| `turbopentest_list_domains` | List your verified domains and their verification status. |\n\n## Prompts\n\nBuilt-in prompts guide your AI assistant through multi-step workflows. Invoke them by name in any MCP client that supports prompts.\n\n| Prompt | Description |\n|--------|-------------|\n| `run_pentest` | Full-lifecycle pentest: domain check → credit verification → launch → progress monitoring → findings summary → report download |\n| `analyze_findings` | Deep-dive analysis of a single pentest's findings, producing a prioritized remediation plan with effort estimates and retest commands |\n| `compare_pentests` | Diff two pentests on the same target — shows what's new, what's been fixed, and what's still unresolved |\n| `security_posture` | Executive briefing across your 5 most recent pentests: risk trends, highest-risk targets, and top 3 recommended actions |\n\n## Scan tiers\n\n| Tier | Agents | Duration | Price |\n|------|--------|----------|-------|\n| Recon | 1 | ~30 min | $49 |\n| Standard | 4 | ~1 hour | $99 |\n| Deep | 10 | ~2 hours | $299 |\n| Blitz | 20 | ~4 hours | $699 |\n\nDefault tier is `standard`. Use `recon` for a quick surface sweep or `blitz` for maximum coverage on critical assets.\n\n## Blockchain attestation\n\nEvery completed pentest is anchored on-chain as a tamper-proof attestation. The SHA-256 hash is included in the report and can be independently verified — by you, your customers, or auditors — with no API key required:\n\n```\nYou:  \"Verify attestation abc123def456...\"\n```\n\n`turbopentest_verify_attestation` returns the scan metadata (tier, agents, duration, risk score, findings summary) alongside the blockchain proof (chain ID, transaction hash, block number, merkle root).\n\n## Configuration\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `TURBOPENTEST_API_KEY` | Yes | — | API key from turbopentest.com/settings/api-keys |\n| `TURBOPENTEST_API_URL` | No | `https://turbopentest.com/api` | Override the API base URL (for testing) |\n\n## Requirements\n\n- Node.js 18+\n- A [TurboPentest](https://turbopentest.com) account with at least one verified domain\n\n## License\n\nMIT\n",
  "bytes": 5974,
  "sha": "6b24fc540e22ad9d3eb6850ea915dcc61c0ede02cbc64f64a8ab2bf51fb27207",
  "repo_slug": "integsec/turbopentest-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_integsec_turbopentest_7becd05a/readme"
}