@turbopentest/mcp-server 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/prompts/analyze-findings.js +34 -34
- package/dist/prompts/compare-pentests.js +34 -34
- package/dist/prompts/run-pentest.js +16 -16
- package/dist/prompts/security-posture.js +32 -32
- package/package.json +46 -46
|
@@ -13,40 +13,40 @@ export function registerAnalyzeFindings(server) {
|
|
|
13
13
|
role: "user",
|
|
14
14
|
content: {
|
|
15
15
|
type: "text",
|
|
16
|
-
text: `You are a security analyst producing a prioritized remediation plan for pentest ${pentest_id}.
|
|
17
|
-
|
|
18
|
-
Follow these steps:
|
|
19
|
-
|
|
20
|
-
1. **Get pentest context** - Call turbopentest_get_pentest with pentest_id="${pentest_id}". Note the target URL, executive summary, attack surface, and STRIDE threat model. If the pentest is not complete, tell the user and stop.
|
|
21
|
-
|
|
22
|
-
2. **Gather all findings** - Call turbopentest_get_findings with pentest_id="${pentest_id}" for each severity level separately:
|
|
23
|
-
- First with severity="critical"
|
|
24
|
-
- Then severity="high"
|
|
25
|
-
- Then severity="medium"
|
|
26
|
-
- Then severity="low"
|
|
27
|
-
This ensures you see all findings even if there are many.
|
|
28
|
-
|
|
29
|
-
3. **Produce a prioritized remediation plan** organized as follows:
|
|
30
|
-
|
|
31
|
-
**Executive Summary** - One paragraph overview of the security posture.
|
|
32
|
-
|
|
33
|
-
**Critical & High Priority** - For each critical/high finding:
|
|
34
|
-
- Title and affected URL
|
|
35
|
-
- Why it matters (business impact)
|
|
36
|
-
- Specific remediation steps
|
|
37
|
-
- Retest command to verify the fix
|
|
38
|
-
- Estimated effort (quick fix / moderate / significant)
|
|
39
|
-
|
|
40
|
-
**Quick Wins** - Findings that are easy to fix regardless of severity. Look for:
|
|
41
|
-
- Missing security headers
|
|
42
|
-
- Outdated software versions
|
|
43
|
-
- Default credentials
|
|
44
|
-
- Information disclosure
|
|
45
|
-
|
|
46
|
-
**Medium & Low Priority** - Grouped summary with remediation themes rather than individual findings.
|
|
47
|
-
|
|
48
|
-
**Recommended Fix Order** - Numbered list of what to fix first, considering both severity and effort. Prioritize: critical issues, then quick wins, then high-effort items.
|
|
49
|
-
|
|
16
|
+
text: `You are a security analyst producing a prioritized remediation plan for pentest ${pentest_id}.
|
|
17
|
+
|
|
18
|
+
Follow these steps:
|
|
19
|
+
|
|
20
|
+
1. **Get pentest context** - Call turbopentest_get_pentest with pentest_id="${pentest_id}". Note the target URL, executive summary, attack surface, and STRIDE threat model. If the pentest is not complete, tell the user and stop.
|
|
21
|
+
|
|
22
|
+
2. **Gather all findings** - Call turbopentest_get_findings with pentest_id="${pentest_id}" for each severity level separately:
|
|
23
|
+
- First with severity="critical"
|
|
24
|
+
- Then severity="high"
|
|
25
|
+
- Then severity="medium"
|
|
26
|
+
- Then severity="low"
|
|
27
|
+
This ensures you see all findings even if there are many.
|
|
28
|
+
|
|
29
|
+
3. **Produce a prioritized remediation plan** organized as follows:
|
|
30
|
+
|
|
31
|
+
**Executive Summary** - One paragraph overview of the security posture.
|
|
32
|
+
|
|
33
|
+
**Critical & High Priority** - For each critical/high finding:
|
|
34
|
+
- Title and affected URL
|
|
35
|
+
- Why it matters (business impact)
|
|
36
|
+
- Specific remediation steps
|
|
37
|
+
- Retest command to verify the fix
|
|
38
|
+
- Estimated effort (quick fix / moderate / significant)
|
|
39
|
+
|
|
40
|
+
**Quick Wins** - Findings that are easy to fix regardless of severity. Look for:
|
|
41
|
+
- Missing security headers
|
|
42
|
+
- Outdated software versions
|
|
43
|
+
- Default credentials
|
|
44
|
+
- Information disclosure
|
|
45
|
+
|
|
46
|
+
**Medium & Low Priority** - Grouped summary with remediation themes rather than individual findings.
|
|
47
|
+
|
|
48
|
+
**Recommended Fix Order** - Numbered list of what to fix first, considering both severity and effort. Prioritize: critical issues, then quick wins, then high-effort items.
|
|
49
|
+
|
|
50
50
|
Present the plan in clean markdown with clear sections.`,
|
|
51
51
|
},
|
|
52
52
|
},
|
|
@@ -14,40 +14,40 @@ export function registerComparePentests(server) {
|
|
|
14
14
|
role: "user",
|
|
15
15
|
content: {
|
|
16
16
|
type: "text",
|
|
17
|
-
text: `You are comparing two penetration tests to track security posture changes.
|
|
18
|
-
|
|
19
|
-
- Baseline (earlier): ${baseline_id}
|
|
20
|
-
- Current (later): ${current_id}
|
|
21
|
-
|
|
22
|
-
Follow these steps:
|
|
23
|
-
|
|
24
|
-
1. **Get both pentests** - Call turbopentest_get_pentest for "${baseline_id}" and "${current_id}". Verify both are complete. Note their target URLs and completion dates.
|
|
25
|
-
|
|
26
|
-
2. **Get all findings** - Call turbopentest_get_findings for both pentest IDs.
|
|
27
|
-
|
|
28
|
-
3. **Compare findings** - Match findings between the two tests:
|
|
29
|
-
- Match by fingerprint first (exact match on the fingerprint field)
|
|
30
|
-
- If a finding has no fingerprint (null), fall back to matching by title
|
|
31
|
-
- Categorize each finding as:
|
|
32
|
-
- **New** - in current but not in baseline (regression)
|
|
33
|
-
- **Fixed** - in baseline but not in current (improvement)
|
|
34
|
-
- **Persistent** - in both tests (unresolved)
|
|
35
|
-
|
|
36
|
-
4. **Present the comparison** in this format:
|
|
37
|
-
|
|
38
|
-
**Summary**
|
|
39
|
-
- Baseline: [target] tested on [date], [N] findings
|
|
40
|
-
- Current: [target] tested on [date], [N] findings
|
|
41
|
-
- Trend: Improving / Declining / Stable
|
|
42
|
-
|
|
43
|
-
**Fixed (improvements)** - List each with severity and title. Celebrate these.
|
|
44
|
-
|
|
45
|
-
**New (regressions)** - List each with severity, title, and remediation. Flag these as needing attention.
|
|
46
|
-
|
|
47
|
-
**Persistent (unresolved)** - List each with severity and title. Note how long they've been open.
|
|
48
|
-
|
|
49
|
-
**Severity Trend** - Table comparing critical/high/medium/low/info counts between baseline and current.
|
|
50
|
-
|
|
17
|
+
text: `You are comparing two penetration tests to track security posture changes.
|
|
18
|
+
|
|
19
|
+
- Baseline (earlier): ${baseline_id}
|
|
20
|
+
- Current (later): ${current_id}
|
|
21
|
+
|
|
22
|
+
Follow these steps:
|
|
23
|
+
|
|
24
|
+
1. **Get both pentests** - Call turbopentest_get_pentest for "${baseline_id}" and "${current_id}". Verify both are complete. Note their target URLs and completion dates.
|
|
25
|
+
|
|
26
|
+
2. **Get all findings** - Call turbopentest_get_findings for both pentest IDs.
|
|
27
|
+
|
|
28
|
+
3. **Compare findings** - Match findings between the two tests:
|
|
29
|
+
- Match by fingerprint first (exact match on the fingerprint field)
|
|
30
|
+
- If a finding has no fingerprint (null), fall back to matching by title
|
|
31
|
+
- Categorize each finding as:
|
|
32
|
+
- **New** - in current but not in baseline (regression)
|
|
33
|
+
- **Fixed** - in baseline but not in current (improvement)
|
|
34
|
+
- **Persistent** - in both tests (unresolved)
|
|
35
|
+
|
|
36
|
+
4. **Present the comparison** in this format:
|
|
37
|
+
|
|
38
|
+
**Summary**
|
|
39
|
+
- Baseline: [target] tested on [date], [N] findings
|
|
40
|
+
- Current: [target] tested on [date], [N] findings
|
|
41
|
+
- Trend: Improving / Declining / Stable
|
|
42
|
+
|
|
43
|
+
**Fixed (improvements)** - List each with severity and title. Celebrate these.
|
|
44
|
+
|
|
45
|
+
**New (regressions)** - List each with severity, title, and remediation. Flag these as needing attention.
|
|
46
|
+
|
|
47
|
+
**Persistent (unresolved)** - List each with severity and title. Note how long they've been open.
|
|
48
|
+
|
|
49
|
+
**Severity Trend** - Table comparing critical/high/medium/low/info counts between baseline and current.
|
|
50
|
+
|
|
51
51
|
**Recommendation** - One paragraph on overall trajectory and top priority actions.`,
|
|
52
52
|
},
|
|
53
53
|
},
|
|
@@ -17,22 +17,22 @@ export function registerRunPentest(server) {
|
|
|
17
17
|
role: "user",
|
|
18
18
|
content: {
|
|
19
19
|
type: "text",
|
|
20
|
-
text: `You are helping a security engineer run a penetration test against ${target_url} using the "${tier}" tier.
|
|
21
|
-
|
|
22
|
-
Follow these steps in order:
|
|
23
|
-
|
|
24
|
-
1. **Verify the domain** - Call turbopentest_list_domains and check that the domain for ${target_url} appears and is verified. If not, tell the user they need to verify the domain first at https://turbopentest.com/domains.
|
|
25
|
-
|
|
26
|
-
2. **Check credits** - Call turbopentest_get_credits and confirm the user has at least one "${tier}" credit available. If not, tell them their current balance and suggest alternatives.
|
|
27
|
-
|
|
28
|
-
3. **Launch the pentest** - Call turbopentest_start_pentest with target_url="${target_url}" and tier="${tier}". Note the pentest ID from the response.
|
|
29
|
-
|
|
30
|
-
4. **Monitor progress** - Call turbopentest_get_pentest with the pentest ID to check status. If status is "scanning", report the progress percentage and which tools are running, then wait 30 seconds and check again. Repeat until status is "complete" or "failed". Do not poll more than 240 times (2 hours max).
|
|
31
|
-
|
|
32
|
-
5. **Summarize findings** - Once complete, call turbopentest_get_findings with the pentest ID. Present a severity breakdown (critical/high/medium/low/info counts) and list the top findings with their titles, severity, and remediation advice.
|
|
33
|
-
|
|
34
|
-
6. **Offer the report** - Ask the user if they'd like to download the full report. If yes, call turbopentest_download_report with their preferred format (markdown is best for reading here, json for structured data, pdf for sharing).
|
|
35
|
-
|
|
20
|
+
text: `You are helping a security engineer run a penetration test against ${target_url} using the "${tier}" tier.
|
|
21
|
+
|
|
22
|
+
Follow these steps in order:
|
|
23
|
+
|
|
24
|
+
1. **Verify the domain** - Call turbopentest_list_domains and check that the domain for ${target_url} appears and is verified. If not, tell the user they need to verify the domain first at https://turbopentest.com/domains.
|
|
25
|
+
|
|
26
|
+
2. **Check credits** - Call turbopentest_get_credits and confirm the user has at least one "${tier}" credit available. If not, tell them their current balance and suggest alternatives.
|
|
27
|
+
|
|
28
|
+
3. **Launch the pentest** - Call turbopentest_start_pentest with target_url="${target_url}" and tier="${tier}". Note the pentest ID from the response.
|
|
29
|
+
|
|
30
|
+
4. **Monitor progress** - Call turbopentest_get_pentest with the pentest ID to check status. If status is "scanning", report the progress percentage and which tools are running, then wait 30 seconds and check again. Repeat until status is "complete" or "failed". Do not poll more than 240 times (2 hours max).
|
|
31
|
+
|
|
32
|
+
5. **Summarize findings** - Once complete, call turbopentest_get_findings with the pentest ID. Present a severity breakdown (critical/high/medium/low/info counts) and list the top findings with their titles, severity, and remediation advice.
|
|
33
|
+
|
|
34
|
+
6. **Offer the report** - Ask the user if they'd like to download the full report. If yes, call turbopentest_download_report with their preferred format (markdown is best for reading here, json for structured data, pdf for sharing).
|
|
35
|
+
|
|
36
36
|
If any step fails, explain the error clearly and suggest how to resolve it.`,
|
|
37
37
|
},
|
|
38
38
|
},
|
|
@@ -8,38 +8,38 @@ export function registerSecurityPosture(server) {
|
|
|
8
8
|
role: "user",
|
|
9
9
|
content: {
|
|
10
10
|
type: "text",
|
|
11
|
-
text: `You are producing an executive security posture report for this user's organization.
|
|
12
|
-
|
|
13
|
-
Follow these steps:
|
|
14
|
-
|
|
15
|
-
1. **Get recent pentests** - Call turbopentest_list_pentests with limit=20. Note how many are complete vs in-progress.
|
|
16
|
-
|
|
17
|
-
2. **Gather findings for recent completed tests** - For the 5 most recently completed pentests, call turbopentest_get_findings for each. This caps API calls while giving a representative view.
|
|
18
|
-
|
|
19
|
-
3. **Produce an executive summary** with these sections:
|
|
20
|
-
|
|
21
|
-
**Overview**
|
|
22
|
-
- Total pentests run (from the list)
|
|
23
|
-
- Targets tested (unique URLs)
|
|
24
|
-
- Date range covered
|
|
25
|
-
|
|
26
|
-
**Vulnerability Summary**
|
|
27
|
-
- Total findings by severity across all 5 analyzed tests
|
|
28
|
-
- Most common vulnerability types (group by title similarity)
|
|
29
|
-
- Average findings per test
|
|
30
|
-
|
|
31
|
-
**Highest Risk Targets**
|
|
32
|
-
- Which targets have the most critical/high findings
|
|
33
|
-
- Any targets with unresolved critical issues
|
|
34
|
-
|
|
35
|
-
**Trends** (if multiple tests exist for the same target)
|
|
36
|
-
- Is the finding count going up or down?
|
|
37
|
-
- Are critical issues being resolved?
|
|
38
|
-
|
|
39
|
-
**Top 3 Recommended Actions**
|
|
40
|
-
- Specific, actionable items based on the findings
|
|
41
|
-
- Prioritize by impact and prevalence
|
|
42
|
-
|
|
11
|
+
text: `You are producing an executive security posture report for this user's organization.
|
|
12
|
+
|
|
13
|
+
Follow these steps:
|
|
14
|
+
|
|
15
|
+
1. **Get recent pentests** - Call turbopentest_list_pentests with limit=20. Note how many are complete vs in-progress.
|
|
16
|
+
|
|
17
|
+
2. **Gather findings for recent completed tests** - For the 5 most recently completed pentests, call turbopentest_get_findings for each. This caps API calls while giving a representative view.
|
|
18
|
+
|
|
19
|
+
3. **Produce an executive summary** with these sections:
|
|
20
|
+
|
|
21
|
+
**Overview**
|
|
22
|
+
- Total pentests run (from the list)
|
|
23
|
+
- Targets tested (unique URLs)
|
|
24
|
+
- Date range covered
|
|
25
|
+
|
|
26
|
+
**Vulnerability Summary**
|
|
27
|
+
- Total findings by severity across all 5 analyzed tests
|
|
28
|
+
- Most common vulnerability types (group by title similarity)
|
|
29
|
+
- Average findings per test
|
|
30
|
+
|
|
31
|
+
**Highest Risk Targets**
|
|
32
|
+
- Which targets have the most critical/high findings
|
|
33
|
+
- Any targets with unresolved critical issues
|
|
34
|
+
|
|
35
|
+
**Trends** (if multiple tests exist for the same target)
|
|
36
|
+
- Is the finding count going up or down?
|
|
37
|
+
- Are critical issues being resolved?
|
|
38
|
+
|
|
39
|
+
**Top 3 Recommended Actions**
|
|
40
|
+
- Specific, actionable items based on the findings
|
|
41
|
+
- Prioritize by impact and prevalence
|
|
42
|
+
|
|
43
43
|
Present this as a clean executive briefing suitable for sharing with leadership. Use bullet points and tables where appropriate.`,
|
|
44
44
|
},
|
|
45
45
|
},
|
package/package.json
CHANGED
|
@@ -1,46 +1,46 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@turbopentest/mcp-server",
|
|
3
|
-
"version": "0.2.
|
|
4
|
-
"description": "MCP server for TurboPentest — AI-powered penetration testing from your coding assistant",
|
|
5
|
-
"type": "module",
|
|
6
|
-
"main": "dist/index.js",
|
|
7
|
-
"bin": {
|
|
8
|
-
"turbopentest-mcp": "dist/index.js"
|
|
9
|
-
},
|
|
10
|
-
"files": [
|
|
11
|
-
"dist"
|
|
12
|
-
],
|
|
13
|
-
"scripts": {
|
|
14
|
-
"build": "tsc",
|
|
15
|
-
"dev": "tsx src/index.ts",
|
|
16
|
-
"prepublishOnly": "npm run build"
|
|
17
|
-
},
|
|
18
|
-
"keywords": [
|
|
19
|
-
"mcp",
|
|
20
|
-
"model-context-protocol",
|
|
21
|
-
"pentest",
|
|
22
|
-
"security",
|
|
23
|
-
"turbopentest",
|
|
24
|
-
"ai"
|
|
25
|
-
],
|
|
26
|
-
"author": "IntegSec Inc.",
|
|
27
|
-
"license": "MIT",
|
|
28
|
-
"mcpName": "io.github.integsec/turbopentest",
|
|
29
|
-
"repository": {
|
|
30
|
-
"type": "git",
|
|
31
|
-
"url": "https://github.com/integsec/turbopentest-mcp.git"
|
|
32
|
-
},
|
|
33
|
-
"homepage": "https://turbopentest.com",
|
|
34
|
-
"engines": {
|
|
35
|
-
"node": ">=18.0.0"
|
|
36
|
-
},
|
|
37
|
-
"dependencies": {
|
|
38
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
39
|
-
"zod": "^4.3.6"
|
|
40
|
-
},
|
|
41
|
-
"devDependencies": {
|
|
42
|
-
"@types/node": "^25.3.5",
|
|
43
|
-
"tsx": "^4.19.0",
|
|
44
|
-
"typescript": "^5.7.0"
|
|
45
|
-
}
|
|
46
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@turbopentest/mcp-server",
|
|
3
|
+
"version": "0.2.1",
|
|
4
|
+
"description": "MCP server for TurboPentest — AI-powered penetration testing from your coding assistant",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"main": "dist/index.js",
|
|
7
|
+
"bin": {
|
|
8
|
+
"turbopentest-mcp": "dist/index.js"
|
|
9
|
+
},
|
|
10
|
+
"files": [
|
|
11
|
+
"dist"
|
|
12
|
+
],
|
|
13
|
+
"scripts": {
|
|
14
|
+
"build": "tsc",
|
|
15
|
+
"dev": "tsx src/index.ts",
|
|
16
|
+
"prepublishOnly": "npm run build"
|
|
17
|
+
},
|
|
18
|
+
"keywords": [
|
|
19
|
+
"mcp",
|
|
20
|
+
"model-context-protocol",
|
|
21
|
+
"pentest",
|
|
22
|
+
"security",
|
|
23
|
+
"turbopentest",
|
|
24
|
+
"ai"
|
|
25
|
+
],
|
|
26
|
+
"author": "IntegSec Inc.",
|
|
27
|
+
"license": "MIT",
|
|
28
|
+
"mcpName": "io.github.integsec/turbopentest",
|
|
29
|
+
"repository": {
|
|
30
|
+
"type": "git",
|
|
31
|
+
"url": "https://github.com/integsec/turbopentest-mcp.git"
|
|
32
|
+
},
|
|
33
|
+
"homepage": "https://turbopentest.com",
|
|
34
|
+
"engines": {
|
|
35
|
+
"node": ">=18.0.0"
|
|
36
|
+
},
|
|
37
|
+
"dependencies": {
|
|
38
|
+
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
39
|
+
"zod": "^4.3.6"
|
|
40
|
+
},
|
|
41
|
+
"devDependencies": {
|
|
42
|
+
"@types/node": "^25.3.5",
|
|
43
|
+
"tsx": "^4.19.0",
|
|
44
|
+
"typescript": "^5.7.0"
|
|
45
|
+
}
|
|
46
|
+
}
|