MCP Server & Dev Tools

TurboPentest plugs into the tools you already use. Run pentests from an AI coding agent through the Model Context Protocol (MCP), from Burp Suite Professional, or from VS Code - all authenticated with your tp_... API key.

All of these tools authenticate with an API key using an Authorization: Bearer tp_... header (created in Dashboard > API Keys).

Local MCP server (stdio)

@turbopentest/mcp-server is a local stdio MCP server. It runs on demand via npx, is listed on Smithery, and authenticates with the TURBOPENTEST_API_KEY environment variable (sent as a Bearer token under the hood).

Tools

• start_pentest - launch a new pentest
• get_pentest - fetch a pentest's status and details
• list_pentests - list your pentests
• get_findings - retrieve findings for a pentest
• download_report - download a report
• get_credits - check your credit balance
• verify_attestation - verify a report attestation
• list_domains - list your verified domains

Prompts

• analyze_findings - reason over the findings of a pentest
• compare_pentests - diff two pentests
• run_pentest - guided pentest launch
• security_posture - summarize overall security posture

Compatible clients

The local server works with Claude Code, Cursor, VS Code + Copilot, and Windsurf.

Configuration

Add the server to your client's MCP config. For Claude Code and other .mcp.json clients:

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}

For Claude Desktop, use the same block in claude_desktop_config.json:

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}

Remote MCP server (HTTP)

As an alternative to the local stdio server, TurboPentest also offers a remote HTTP MCP server. It exposes the same capabilities as turbopentest_* tools plus MCP Resources, and is a good fit for clients that connect to remote MCP endpoints rather than spawning a local process. Authenticate with an Authorization: Bearer tp_... header.

Burp Suite Professional extension

The TurboPentest extension for Burp Suite Professional is built on the Montoya API and brings agentic pentesting into Burp:

• Launch pentests directly from Burp
• Live agent chat with the Paladin agents as they work
• Export Burp context (in-scope targets, requests) to seed a pentest
• Native findings - TurboPentest findings are imported as native Burp Scanner AuditIssue entries so they appear alongside Burp's own results

The extension talks to the backend under /api/v2/burp/*. Source and releases: integsec/turbopentest-burp-extension.

VS Code extension

The TurboPentest VS Code extension (publisher integsec, id turbopentest) puts pentesting in your editor:

• Launch, chat, activity, and findings views
• Focus presets to scope what the agents concentrate on
• Download report directly from VS Code

Point it at your instance with the turbopentest.baseUrl setting:

{
  "turbopentest.baseUrl": "https://turbopentest.com"
}

Authenticate the extension with your tp_... API key.