---
title: "MCP Server & Dev Tools"
description: "Drive TurboPentest from your editor and terminal - a local and remote MCP server for AI coding agents, plus native Burp Suite and VS Code extensions."
canonical: https://turbopentest.com/docs/integrations/mcp
source: "TurboPentest Docs"
---

# MCP Server & Dev Tools

TurboPentest plugs into the tools you already use. Run pentests from an AI coding agent through the Model Context Protocol (MCP), from Burp Suite Professional, or from VS Code - all authenticated with your `tp_...` API key.

All of these tools authenticate with an API key using an `Authorization: Bearer tp_...` header (created in **Dashboard > API Keys**).

## Local MCP server (stdio)

`@turbopentest/mcp-server` is a local stdio MCP server. It runs on demand via `npx`, is listed on [Smithery](https://smithery.ai), and authenticates with the `TURBOPENTEST_API_KEY` environment variable (sent as a Bearer token under the hood).

### Tools

All tools are exposed under a `turbopentest_` prefix (the same names the remote server uses):

- `turbopentest_start_pentest` - launch a new pentest
- `turbopentest_get_pentest` - fetch a pentest's status and details
- `turbopentest_list_pentests` - list your pentests
- `turbopentest_get_findings` - retrieve findings for a pentest
- `turbopentest_download_report` - download a report
- `turbopentest_get_credits` - check your credit balance
- `turbopentest_verify_attestation` - verify a report attestation
- `turbopentest_list_domains` - list your verified domains

### Prompts

- `analyze_findings` - reason over the findings of a pentest
- `compare_pentests` - diff two pentests
- `run_pentest` - guided pentest launch
- `security_posture` - summarize overall security posture

### Compatible clients

The local server works with **Claude Code**, **Cursor**, **VS Code + Copilot**, and **Windsurf**.

### Configuration

Add the server to your client's MCP config. For Claude Code and other `.mcp.json` clients:

```json title=".mcp.json"
{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}
```

For Claude Desktop, use the same block in `claude_desktop_config.json`:

```json title="claude_desktop_config.json"
{
  "mcpServers": {
    "turbopentest": {
      "command": "npx",
      "args": ["-y", "@turbopentest/mcp-server"],
      "env": {
        "TURBOPENTEST_API_KEY": "tp_your_api_key_here"
      }
    }
  }
}
```

## Remote MCP server (HTTP)

As an alternative to the local stdio server, TurboPentest also offers a **remote HTTP MCP server**. It exposes the same `turbopentest_*` tools plus **MCP Resources**, and is a good fit for clients that connect to remote MCP endpoints rather than spawning a local process.

**Endpoint:** `https://mcp.turbopentest.com/mcp`

Authenticate with an `Authorization: Bearer tp_...` header (or complete the hosted OAuth authorize flow).

```json title=".mcp.json"
{
  "mcpServers": {
    "turbopentest": {
      "type": "url",
      "url": "https://mcp.turbopentest.com/mcp",
      "headers": {
        "Authorization": "Bearer tp_your_api_key_here"
      }
    }
  }
}
```

### Grok custom connector

Grok custom connectors **do not accept an API key field**, and many sessions **never open an OAuth browser**. The reliable path is a **personal connector URL**.

#### Recommended (works without OAuth)

1. Create an API key under **Dashboard → API Keys**.
2. Open **[https://mcp.turbopentest.com/connect](https://mcp.turbopentest.com/connect)**.
3. Paste the key → **Generate Grok connector URL**.
4. Copy the URL (shape: `https://mcp.turbopentest.com/c/{token}/mcp`).
5. [grok.com/connectors](https://grok.com/connectors) → **New Connector** → **Custom** → paste that full URL.
6. In chat: list domains, check credits, or start a pentest on a verified target.

Treat the personal URL like a password (1-year signed token). Rotate the API key to revoke it.

#### Optional OAuth path

If Grok does open a browser for `https://mcp.turbopentest.com/mcp`, you can authorize there instead. Many users never see that page — use the personal URL above.

OAuth discovery (for clients that support it):

- Protected resource: `https://mcp.turbopentest.com/.well-known/oauth-protected-resource`
- Authorization server: `https://mcp.turbopentest.com/.well-known/oauth-authorization-server`

Other MCP clients that support header config can still use:

`Authorization: Bearer tp_your_api_key_here`

### xAI API (Remote MCP tools)

Developers calling the xAI API can attach TurboPentest as a remote MCP tool:

```json
{
  "type": "mcp",
  "server_url": "https://mcp.turbopentest.com/mcp",
  "server_label": "turbopentest",
  "authorization": "tp_your_api_key_here"
}
```

## Burp Suite Professional extension

The TurboPentest extension for **Burp Suite Professional** is built on the Montoya API and brings agentic pentesting into Burp:

- **Launch pentests** directly from Burp
- **Live agent chat** with the Paladin agents as they work
- **Export Burp context** (in-scope targets, requests) to seed a pentest
- **Native findings** - TurboPentest findings are imported as native Burp Scanner `AuditIssue` entries so they appear alongside Burp's own results

The extension talks to the backend under `/api/v2/burp/*`. Source and releases: [integsec/turbopentest-burp-extension](https://github.com/integsec/turbopentest-burp-extension).

## VS Code extension

The TurboPentest VS Code extension (publisher **integsec**, id **turbopentest**) puts pentesting in your editor:

- **Launch, chat, activity, and findings** views
- **Focus presets** to scope what the agents concentrate on
- **Download report** directly from VS Code

Point it at your instance with the `turbopentest.baseUrl` setting:

```json title="settings.json"
{
  "turbopentest.baseUrl": "https://turbopentest.com"
}
```

Authenticate the extension with your `tp_...` API key.