io.github.cyanheads/pentest-mcp-server
io.github.cyanheads/pentest-mcp-server
MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/1fd65817-3a73-4f80-9aee-c877fd7ad9e9/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "io.github.cyanheads/pentest-mcp-server"
title: null
description: "Offline methodology engine for authorized penetration testing, CTF, and security research."
version: "0.3.0"
homepage_url: null
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "io.github.cyanheads"
display_name: "io.github.cyanheads"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/cyanheads/pentest-mcp-server"
provider: "github"
owner: "cyanheads"
name: "pentest-mcp-server"
verified: false
packages[2]
0{4}
registry_type: "npm"
identifier: "@cyanheads/pentest-mcp-server"
version: "0.3.0"
transport: "stdio"
1{4}
registry_type: "npm"
identifier: "@cyanheads/pentest-mcp-server"
version: "0.3.0"
transport: "streamable-http"
transports[3]
0{5}
kind: "package"
type: "stdio"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
1{5}
kind: "package"
type: "streamable-http"
endpoint_url: null
endpoint_host: null
auth_type: "unknown"
2{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://pentest.caseyjhand.com/mcp"
endpoint_host: "pentest.caseyjhand.com"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "modern"
negotiated_version: "2026-07-28"
supported_versions[0]
transport_type: "streamable-http"
tools[7]
0{9}
name: "pentest_analyze_response"
title: "Pentest Analyze Response"
effect: "READ"
effect_confidence: 0.813
capabilities[1]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.632
risk_severity: "INFO"
fingerprint: "749c9e3d65d980be5c0cfb764f6d95794f0950bf7e3dbd69f7ba73fc1dc6e259"
input_schema_fingerprint: "a00146e381a70962c37bb352e8fb2b7528cf1e32db5f681c72050c418cdd25ff"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
1{9}
name: "pentest_encode_payload"
title: "Pentest Encode"
effect: "READ"
effect_confidence: 0.626
capabilities[0]
risk_severity: "INFO"
fingerprint: "ef93ecc5d8110f6f4e6bb88eda3857bf4fba2317c172371d5ca3677b437f5cb7"
input_schema_fingerprint: "0bea1601a57c80bdf2b88a2e58216b45fb753a18c9268da05964cded65b71fba"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
2{9}
name: "pentest_generate_payloads"
title: "Pentest Generate Payloads"
effect: "READ"
effect_confidence: 0.78
capabilities[0]
risk_severity: "INFO"
fingerprint: "41db90be787d7862094bcff518b67f12e545a6a00a5f9d1ab5c1502e5fc2d1a0"
input_schema_fingerprint: "23817aa27e6fa69747e6be6e46adc1defe5234ba7e759a3992b0c0949e70a96c"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
3{9}
name: "pentest_get_guide"
title: "Pentest Guide"
effect: "READ"
effect_confidence: 0.813
capabilities[0]
risk_severity: "INFO"
fingerprint: "431978a85c8903daa42daffcc6ad0def36aadc5e945bf69254b8f50db249f822"
input_schema_fingerprint: "029cd811240633387da605066074f8d37bc155f000461a6c5c81b7aa03f57e68"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
4{9}
name: "pentest_lookup_group"
title: "Pentest Lookup Group"
effect: "READ"
effect_confidence: 0.813
capabilities[0]
risk_severity: "INFO"
fingerprint: "ed52cfa664f2a292b1dda40cb479fd3493ac87a3174005bad654b26bbcc0b2f2"
input_schema_fingerprint: "71c250fe5c828bdf460c9acfa7e8fb298de7e172e72ee483504fd432e3df65b6"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
5{9}
name: "pentest_lookup_technique"
title: "Pentest Lookup Technique"
effect: "EXECUTE"
effect_confidence: 0.6
capabilities[0]
risk_severity: "CRITICAL"
fingerprint: "de46d34921d62e6a601b7e85d3bd2b09957f87d824a6b5d0a9b1223b1d1f47d5"
input_schema_fingerprint: "fd5a2feab478b2c07684ca1d1275a764d70c66abaf321add92994c96f1dc47ed"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
6{9}
name: "pentest_map_techniques"
title: "Pentest Map Techniques"
effect: "READ"
effect_confidence: 0.56
capabilities[1]
0{2}
capability: "LOCATION"
confidence: 0.675
risk_severity: "LOW"
fingerprint: "95a8b92027c6e0ed39a4222d5a136d87d0129b3f9703af15bc6a8b24c31a8b0a"
input_schema_fingerprint: "5e7e83b0c57fe1aca065604037be21fadd240f38c33d41d00cacbaefc9680feb"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: null
idempotentHint: true
openWorldHint: false
resources[2]
0{4}
key: "skill://pentest-guide/SKILL.md"
kind: "resource"
mime_type: "text/markdown"
fingerprint: "712f21b30a82c6b73991b207939473e30e76940c2699ab87f94fa5351a72a3a4"
1{4}
key: "skill://{+path}"
kind: "template"
mime_type: null
fingerprint: "9777dc7f1cf468158c157032a0ccebf9b50270f4e8753af9ccaf2fe99890ccf0"
prompts[0]
extensions[1]
0: "io.modelcontextprotocol/skills"
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "pentest.caseyjhand.com"
registrable_domain: "caseyjhand.com"
source: "transport"
findings[4]
0{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "MEDIUM"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-ANNOTATION-UNDERCLAIM"
category: "annotations"
severity: "MEDIUM"
title: "Annotations understate what the tool does"
subject_type: "tool"
subject_name: "pentest_lookup_technique"
2{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "INFO"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "pentest_analyze_response"
3{6}
check_id: "SQ-TOOL-TITLE-EFFECT-MISMATCH"
category: "deceptive_metadata"
severity: "HIGH"
title: "Display title describes a lower-impact action than the name"
subject_type: "tool"
subject_name: "pentest_lookup_technique"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "partial"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "io.github.cyanheads/pentest-mcp-server"
registry_content_sha256: "bc4b9c568746b1631cb2f12513afbb5b2b48fb80028fbc7a46c9f27933a7a697"
scan_snapshot_fingerprint: "7b5c963d7e84019f4e67767f2029698eaca8acbcb1675117fd36fa27f1c35b08"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T02:14:07.961Z"
observed_at: "2026-11-08T22:36:19.447+00:00"
registry_published_at: "2026-10-30T09:25:39.20216+00:00"
registry_updated_at: null