Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
github_topic

pentest-mcp

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

→ DMontgomery40/pentest-mcp· listed on github_topic
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Tool annotations don’t match behaviour
9 read-only tools perform write/delete/exec — nmapScan (line 484: spawn('nmap', args)); gobuster (line 670: spawn('which', [candidate])); nikto (line 670: spawn('which', [candidate]))
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: MCP_OAUTH_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highfast-xml-parser@5.3.6GHSA-8gc5-j5rx-235r

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

lowfast-xml-parser@5.3.6GHSA-fj3w-jwp8-x2g3

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

lowfast-xml-parser@5.3.6GHSA-gh4j-gqv2-49f6

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

lowfast-xml-parser@5.3.6GHSA-jp2q-39xq-3w4g

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configMCP_ALLOWED_ORIGINS— Origin validation (HTTP) 403 on invalid Origin when is set
configMCP_AUTH_AUDIENCE
configMCP_AUTH_ENABLED
configMCP_AUTH_MODE
configMCP_AUTH_SCOPES— read,write
configMCP_COMMAND_OUTPUT_LIMIT_BYTES
configMCP_COMMAND_TIMEOUT_MS
configMCP_OAUTH_CLIENT_ID
🔐 secretMCP_OAUTH_CLIENT_SECRET
configMCP_OAUTH_ENABLED
configMCP_OAUTH_PROVIDER_URL
configMCP_OAUTH_SCOPES
configMCP_OIDC_INTROSPECTION_URL
configMCP_OIDC_ISSUER
configMCP_OIDC_JWKS_URL
configMCP_SERVER_HOST— MCP_TRANSPORT=http =0.0.0.0 MCP_SERVER_PORT=8000 pentest-mcp
configMCP_SERVER_PORT— MCP_TRANSPORT=http MCP_SERVER_HOST=0.0.0.0 =8000 pentest-mcp
configMCP_TRANSPORT— Streamable HTTP is now the primary network transport (=http)
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/dmontgomery40-pentest-mcp-fpxqdm)](https://m8ven.ai/mcp/dmontgomery40-pentest-mcp-fpxqdm)
commit: b644b150a8b837dba8311aad7ab01d90a86c177c
code hash: a12a2573994d62778616499bd15a44c6d43cbdc6baa779810a8580bc60cb71a5
verified: 6/14/2026, 10:32:00 AM
view raw JSON →