How ramkansal/pentestmcp works
pentestMCP is an MCP server that exposes penetration-testing tools to compatible client hosts; the host, not this repository, mediates the LLM. The main workflow is tool discovery and invocation, scan execution, then result retrieval—often asynchronously from output files. The README also describes broad web/network testing, ZAP integration, and Active Directory operations. Sampled source confirms several scan helpers and AD parsing/state utilities; other tool implementations are not shown, so their internal wiring is left unspecified.
Main entry points: pentestMCP.py MCP Tool Handlers · ad_tools.py AD Operations · tools Additional Tools · nmap.py Nmap Helper
Components 24
MCP Server
- stdio Transport
pentestMCP.py - HTTP Transport
pentestMCP-sse.py - MCP Tool Handlers
pentestMCP.py - Additional Tools
tools
Scan Execution
- Nmap Helper
tools/nmap.py - Nuclei Helper
tools/nuclei.py - Gofang Helper
tools/gofang.py - Arjun Helper
tools/arjun_tool.py - Curl Helper
tools/curl_tool.py - SecLists Wordlists
seclists
Active Directory
- AD Operations
tools/ad_tools.py - AD Output Parser
utils/parser.py
Results And State
- Scan Findings State
utils/state.py - Scan Output Files
Other components
- User
- MCP Client Host
- LLM
- Nmap
- Nuclei
- Gofang
- Arjun
- curl
- OWASP ZAP
- AD CLI Tools
Connections 28
- User → MCP Client Host: prompts
- MCP Client Host → LLM: sends context
- MCP Client Host → stdio Transport: connects via stdio
- MCP Client Host → HTTP Transport: connects via HTTP
- stdio Transport → MCP Tool Handlers: dispatches tools
- HTTP Transport → MCP Tool Handlers: dispatches tools
- MCP Tool Handlers → MCP Client Host: returns results
- MCP Tool Handlers → Nmap Helper: launches or fetches
- MCP Tool Handlers → Nuclei Helper: launches or fetches
- MCP Tool Handlers → Gofang Helper: launches scans
- MCP Tool Handlers → Arjun Helper: launches or fetches
- MCP Tool Handlers → Curl Helper: runs requests
- Nmap Helper → Nmap: runs
- Nuclei Helper → Nuclei: runs
- Gofang Helper → Gofang: runs
- Arjun Helper → Arjun: runs
- Curl Helper → curl: runs
- Nmap Helper → Scan Output Files: writes and reads
- Nuclei Helper → Scan Output Files: writes and reads
- Gofang Helper → Scan Output Files: writes and reads
- Arjun Helper → Scan Output Files: writes and reads
- MCP Tool Handlers → AD Operations: wraps AD calls
- AD Operations → AD CLI Tools: runs commands
- AD Operations → AD Output Parser: parses output
- AD Operations → Scan Findings State: records findings
- MCP Tool Handlers → Additional Tools: exposes capabilities
- Additional Tools → OWASP ZAP: integrates scanning
- Additional Tools → SecLists Wordlists: uses wordlists