MCP Server & Dev Tools

TurboPentest plugs into the tools you already use. Run pentests from an AI coding agent through the Model Context Protocol (MCP), from Burp Suite Professional, or from VS Code - all authenticated with your tp_... API key.

All of these tools authenticate with an API key using an Authorization: Bearer tp_... header (created in Dashboard > API Keys).

Local MCP server (stdio)

@turbopentest/mcp-server is a local stdio MCP server. It runs on demand via npx, is listed on Smithery, and authenticates with the TURBOPENTEST_API_KEY environment variable (sent as a Bearer token under the hood).

Tools

All tools are exposed under a turbopentest_ prefix (the same names the remote server uses):

• turbopentest_start_pentest - launch a new pentest
• turbopentest_get_pentest - fetch a pentest's status and details
• turbopentest_list_pentests - list your pentests
• turbopentest_get_findings - retrieve findings for a pentest
• turbopentest_download_report - download a report
• turbopentest_get_credits - check your credit balance
• turbopentest_verify_attestation - verify a report attestation
• turbopentest_list_domains - list your verified domains

Prompts

• analyze_findings - reason over the findings of a pentest
• compare_pentests - diff two pentests
• run_pentest - guided pentest launch
• security_posture - summarize overall security posture

Compatible clients

The local server works with Claude Code, Cursor, VS Code + Copilot, and Windsurf.

Configuration

Add the server to your client's MCP config. For Claude Code and other .mcp.json clients:

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}

For Claude Desktop, use the same block in claude_desktop_config.json:

{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}

Remote MCP server (HTTP)

As an alternative to the local stdio server, TurboPentest also offers a remote HTTP MCP server. It exposes the same turbopentest_* tools plus MCP Resources, and is a good fit for clients that connect to remote MCP endpoints rather than spawning a local process.

Endpoint: https://mcp.turbopentest.com/mcp

Authenticate with an Authorization: Bearer tp_... header (or complete the hosted OAuth authorize flow).

{
  "mcpServers": {
    "turbopentest": {
      "type": "url",
      "url": "https://mcp.turbopentest.com/mcp",
      "headers": {
        "Authorization": "Bearer tp_your_api_key_here"
      }
    }
  }
}

Grok custom connector

Grok custom connectors do not accept an API key field, and many sessions never open an OAuth browser. The reliable path is a personal connector URL.

Recommended (works without OAuth)

1. Create an API key under Dashboard → API Keys.
2. Open https://mcp.turbopentest.com/connect.
3. Paste the key → Generate Grok connector URL.
4. Copy the URL (shape: https://mcp.turbopentest.com/c/{token}/mcp).
5. grok.com/connectors → New Connector → Custom → paste that full URL.
6. In chat: list domains, check credits, or start a pentest on a verified target.

Treat the personal URL like a password (1-year signed token). Rotate the API key to revoke it.

Optional OAuth path

If Grok does open a browser for https://mcp.turbopentest.com/mcp, you can authorize there instead. Many users never see that page — use the personal URL above.

OAuth discovery (for clients that support it):

• Protected resource: https://mcp.turbopentest.com/.well-known/oauth-protected-resource
• Authorization server: https://mcp.turbopentest.com/.well-known/oauth-authorization-server

Other MCP clients that support header config can still use:

Authorization: Bearer tp_your_api_key_here

xAI API (Remote MCP tools)

Developers calling the xAI API can attach TurboPentest as a remote MCP tool:

{
  "type": "mcp",
  "server_url": "https://mcp.turbopentest.com/mcp",
  "server_label": "turbopentest",
  "authorization": "tp_your_api_key_here"
}

Burp Suite Professional extension

The TurboPentest extension for Burp Suite Professional is built on the Montoya API and brings agentic pentesting into Burp:

• Launch pentests directly from Burp
• Live agent chat with the Paladin agents as they work
• Export Burp context (in-scope targets, requests) to seed a pentest
• Native findings - TurboPentest findings are imported as native Burp Scanner AuditIssue entries so they appear alongside Burp's own results

The extension talks to the backend under /api/v2/burp/*. Source and releases: integsec/turbopentest-burp-extension.

VS Code extension

The TurboPentest VS Code extension (publisher integsec, id turbopentest) puts pentesting in your editor:

• Launch, chat, activity, and findings views
• Focus presets to scope what the agents concentrate on
• Download report directly from VS Code

Point it at your instance with the turbopentest.baseUrl setting:

{
  "turbopentest.baseUrl": "https://turbopentest.com"
}

Authenticate the extension with your tp_... API key.