TurboPentest

MCP server for TurboPentest.

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • Turbopentest Download Report: Download a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-reada
  • Turbopentest Get Credits: Check your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one
  • Turbopentest Get Findings: Retrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of c

What data it sees

Do you need an account

No: the server works without sign-in

MCP server for TurboPentest. Blockchain-attested collaborative agentic penetration testing from your AI assistant.

How to connect

How to connect TurboPentest to Claude

The server address to paste into Claude settings:

https://turbopentest--integsec.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect TurboPentest to ChatGPT

The server address to paste into ChatGPT settings:

https://turbopentest--integsec.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect TurboPentest to Cursor

The server address to paste into Cursor settings:

https://turbopentest--integsec.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (8)

Raw names from tools/list. Only developers need these.

turbopentest_download_reportDownload a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-readable analysis, 'json' for structured programmatic data, or 'pdf' for a professionally formatted document suitable for stakeholders.
turbopentest_get_creditsCheck your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one credit of the matching type. Call this before turbopentest_start_scan to verify you have sufficient credits for the desired tier.
turbopentest_get_findingsRetrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of concept, remediation steps, and a retest command. Returns up to 20 findings at a time — use the severity filter to focus on specific risk levels. Use turbopentest_download_report for a complete exportable report.
turbopentest_get_scanRetrieve full details for a specific penetration test by its ID. Returns current status, scan progress percentage, findings summary by severity, executive summary, attack surface map, and STRIDE threat model. Use this to monitor a running scan or review completed results. For detailed vulnerability data, follow up with turbopentest_get_findings.
turbopentest_list_domainsList all domains in your account with their verification status and expiry dates. A domain must have status 'verified' before it can be used as a target in turbopentest_start_scan. To verify a new domain, add a DNS TXT record via the TurboPentest dashboard at turbopentest.com/domains.
turbopentest_list_scansList all your penetration tests with their status and finding counts, ordered newest first. Use this to find pentest IDs, check which scans are running, or review past results. Supports filtering by status and limiting result count. Use turbopentest_get_scan with a specific ID for full details.
turbopentest_start_scanLaunch an AI-powered penetration test against a target URL. The target domain must be verified first — use turbopentest_list_domains to check. Requires an available credit matching the selected tier — use turbopentest_get_credits to check balance. Returns a pentest ID that can be used with turbopentest_get_scan to monitor progress.
turbopentest_verify_attestationVerify a blockchain-anchored penetration test attestation by its SHA-256 hash. Returns scan metadata (tier, agents, duration, risk score, finding summary) and blockchain proof (chain ID, transaction hash, block number, merkle root) if anchored. This is a public endpoint — no API key is required. Use this to independently confirm that a pentest was performed and its results are tamper-proof.