Turbopentest

What turbopentest MCP server does

The turbopentest MCP server provides an MCP interface to TurboPentest’s penetration-testing API. It lets an AI assistant start a scan for a verified domain, check its progress, inspect findings, and retrieve reports without requiring manual API calls. The server supports four scan tiers: Recon, Standard, Deep, and Blitz. The default is Standard, while the available tiers vary in agent count, estimated duration, and price.

A scan can include a GitHub repository URL for white-box testing. In that mode, TurboPentest adds static analysis, secret detection, and dependency checks for known CVEs alongside black-box testing. The target domain must already be verified on the TurboPentest account. The launch tool checks this condition before requesting the scan and refuses unverified targets.

How it works

The turbopentest MCP server runs locally through npx and sends authenticated requests to TurboPentest over HTTPS. A completed assessment includes scan metadata and a SHA-256 hash for a blockchain-anchored attestation. The public attestation verification tool can validate that hash without an API key and returns available scan metadata together with blockchain proof details.

The server also exposes guided workflow tools for clients that do not support MCP prompts. These return instructions for running a full pentest, analyzing findings, comparing two assessments, and preparing a security-posture briefing. Clients with prompt support can use the corresponding prompts instead.

Setup and configuration

Install Node.js 18 or newer, create a TurboPentest account, generate an API key, and verify at least one domain in the TurboPentest dashboard. Configure the MCP client to run:

{
  "command": "npx",
  "args": ["@turbopentest/mcp-server"],
  "env": {
    "TURBOPENTEST_API_KEY": "tp_live_..."
  }
}

The required TURBOPENTEST_API_KEY value comes from the account’s API-key settings. TURBOPENTEST_API_URL is optional and defaults to https://turbopentest.com/api; it can override the API base URL for testing. The API key is sent as a bearer token to the TurboPentest API and is not logged by the server.

Tools and capabilities

The turbopentest MCP server exposes tools to:

• Start scans with a selected tier and optional GitHub repository.
• Retrieve progress, finding totals, executive summaries, attack-surface maps, and STRIDE threat models.
• List assessments and filter them by status.
• Retrieve findings filtered by severity, including CVSS, CWE, OWASP category, proof of concept, remediation, and retest commands.
• Download Markdown, JSON, or PDF reports.
• Check credit balance, scan tiers, and pricing.
• List verified domains and their verification states.
• Verify blockchain attestations by SHA-256 hash.
• Return workflow instructions as tools for clients without prompt support.

Limitations and notes

Scanning is restricted to domains verified on the TurboPentest account. The service uses credits, and the documented tiers are priced from $49 for Recon through $699 for Blitz. Scan durations are approximate, ranging from about 30 minutes to four hours depending on tier.

Prompt-based workflows are documented for Claude Code, Claude Desktop, and Cursor. OpenAI Codex does not support the MCP prompts primitive, so the matching turbopentest_workflow_* tools provide those instructions instead. Completed scans can be independently checked through their blockchain attestation, but the attestation endpoint is the only listed tool that does not require an API key.