MCP Server

ModernPentest ships a remote Model Context Protocol server. Connect it to an AI assistant and that assistant can read your applications, scans, vulnerabilities, reports and letters of attestation — and, if you grant it the right permissions, register applications and start pentests on your behalf.

https://modernpentest.com/mcp

Nothing to install, no key to paste into a config file: you sign in through your browser with the account you already have, approve the permissions, and the server acts as you, in your organization.

You can find the server address, the permissions a connection is granted, and a log of what your connected assistants have done under Account → MCP in the dashboard.

The MCP server is on every plan. Your plan does not change which tools appear — it changes what they can do. A call that exceeds a limit comes back as a plan-limit error naming the limit you hit.

Connect your client

claude mcp add --transport http modernpentest https://modernpentest.com/mcp

Then run /mcp inside Claude Code and choose Authenticate. A browser window opens, you sign in and approve the permissions, and the connection is live.

Open Settings → Connectors → Add custom connector and give it:

Name: ModernPentest
URL: https://modernpentest.com/mcp

Claude sends you through the sign-in and consent screen, then the tools appear in the connectors menu of a new chat.

Open Settings → Connectors → Create, add https://modernpentest.com/mcp as a remote MCP server with OAuth authentication, and approve the ModernPentest consent screen when it opens.

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "mcpServers": {
    "modernpentest": {
      "url": "https://modernpentest.com/mcp"
    }
  }
}

Reload Cursor, then click Needs login next to the server in Settings → MCP to complete the browser sign-in.

Add the server to .vscode/mcp.json in your workspace:

{
  "servers": {
    "modernpentest": {
      "type": "http",
      "url": "https://modernpentest.com/mcp"
    }
  }
}

Open the server from the MCP view and authorize it when prompted.

Any client that speaks remote MCP over HTTP with OAuth works. The only two things you ever need to enter are the URL above and "this server uses OAuth".

What you can ask for

Once connected, questions like these are answered from your live data rather than from something you pasted into the chat:

"Which of my applications has an open critical, and how old is it?"
"Summarise what changed in the last pentest of the checkout API."
"Walk me through fixing the SSRF finding."
"Mark that finding as a false positive — the endpoint is internal-only."
"Start a pentest of the staging app."

Before you connect

Starting a pentest is a real action. It sends genuine attack traffic at the systems you registered and spends a scan from your monthly quota. Most clients will ask you to confirm first.
Exploit detail is withheld by default. Proof-of-concept code, injection payloads and raw request/response logs come back only when the assistant explicitly asks. Credentials are never returned, at any permission level.
Report and attestation PDF links are permanent and unauthenticated. Once created, anyone who receives the link can read it.
An application registered over MCP must prove domain ownership with a DNS TXT record before it can be scanned.

Finding titles and descriptions are partly written from content our agents read on your target, so they can contain text an attacker planted there. The server marks that text as untrusted and tells your assistant to treat it as data, never as instructions. If an assistant ever says a finding "asked" it to do something, do not act on it.

Connect your client

What you can ask for

Before you connect

Next steps

Permissions and access

Tools

Agents as customers

On this page