CanopiiCanopiiAll serversEnterprise →
io.github.cyanheads/pentest-mcp-server

io.github.cyanheads/pentest-mcp-server v0.1.8

Security Trust Score
Grade A · Strong posture
Tier 1 · Public sourceHigh confidence · 99%
Declared MCP capabilities
ResourcesPrompts

Host io.github.cyanheads/pentest-mcp-server in a governed environment — SSO in front, every tool call attributed and audited.

Reputation1stars1forks599downloads/mo7open issues6d agolast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Warn
    Strict JSON Schema Enforcementschemas not strict

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

    Fix: Set additionalProperties:false and require explicit parameters on every tool.

  • Pass
    Indirect Prompt Injection (IPI) Defensesguardno injection markers

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent.

  • Pass
    Tool Definition Integrityguardtool definitions stable; no risky changes in version history

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns.

  • Pass
    User-in-the-Loop / Approval Scopeguardno destructive tool scope

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval.

Application Security Checks

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Published with provenanceno provenance attestation

    Build provenance attests the artifact was built from the claimed source by CI.

    Fix: Publish with npm provenance (--provenance) from a trusted CI.

  • Warn
    Established maintainersingle maintainer

    Brand-new / single anonymous maintainers raise takeover and malware risk.

    Fix: Publish under an established account/org; add multiple maintainers.

  • Warn
    Has a security policyno security policy

    A SECURITY.md gives a private path to report vulnerabilities.

    Fix: Add SECURITY.md with a disclosure contact and process.

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No path traversalguardno sinks found

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

  • Pass
    No SSRF sinksguardno sinks found

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    No known-vulnerable dependencies1 runtime deps, no known CVEs

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Pass
    No install/post-install scriptsguardno install scripts

    install hooks run arbitrary code on every consumer at install time.

  • Pass
    Package name not typosquattingguarddistinct package name

    Names mimicking popular packages are a common malware delivery vector.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Declares a licenseApache-2.0

    A clear license is required for legal enterprise use.

  • Pass
    Adoption & popularityestablished adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

Transport & Trust Model

  • Warn
    Network Exposurebinds 0.0.0.0

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

    Fix: Bind to 127.0.0.1 by default; never ship open debug endpoints.

  • Pass
    Transport Encryption (TLS)guardall remotes use HTTPS

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • Pass
    IAM / Authentication ScopingOAuth / PRM handling detected

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

  • Pass
    Execution Sandboxingcontainerized

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (80)

CSP analysisTest for CSRFTest for SSTIFilter probingUUID/hash IDORBoolean probingInput discoveryBlind extractionInternal port scanReflection huntingJWT header analysisSession persistenceCloud metadata probeUsername enumerationCredential extractionOut-of-band detectionTest Role DefinitionsTest Session FixationTest for ClickjackingToken/cookie analysisColumn count discoveryContext identificationFingerprint Web ServerTest for SQL InjectionTest for SSI InjectionTest for XML InjectionData extraction (UNION)Database fingerprintingOAuth misconfigurationsRS256→HS256 confusionTest for Code InjectionTest for LDAP InjectionWeak secret brute-forceTest Default CredentialsTest for Buffer OverflowTest for Race ConditionsTest for XPath InjectionAWS credential extractionAuth endpoint enumerationInternal service proxyingLockout mechanism testingSequential ID enumerationCSP bypass (if applicable)Test for Command InjectionGopher protocol exploitationJWT token location discoveryObject reference enumerationURL parameter identificationTest for Privilege EscalationDOM-based impact demonstrationMass data access demonstrationSession token exfiltration PoCTest Session Management SchemaTest for Weak Lockout MechanismTest for Improper Error HandlingTwo-account cross-access testingIdentify Application Entry PointsTest for HTTP Parameter PollutionTest Cross Origin Resource SharingAlgorithm confusion test (alg:none)File read (if DB privilege permits)JWT attacks (alg:none, weak secret)Test Business Logic Data ValidationTest HTTP Strict Transport SecurityVertical privilege escalation probeTest Remember Password FunctionalityTest for Server Side Request ForgeryTest for Stored Cross Site ScriptingTest Directory Traversal File IncludeTest for HTTP Splitting and SmugglingTest for Weak Transport Layer SecurityTest for Bypassing Authorization SchemaTest for DOM-Based Cross Site ScriptingTest for Reflected Cross Site ScriptingTest for Insecure Direct Object ReferencesPrivilege escalation via claim manipulationOS command execution via DB (MSSQL xp_cmdshell)Test for Weaker Authentication in Alternative ChannelTest Credentials Transported over an Encrypted ChannelEnumerate Infrastructure and Application Admin Interfaces