Pentest on Every Deploy.
Works with Cursor, Vercel, and GitHub Actions.
Drop TurboPentest into your CI/CD pipeline and run an agentic pentest with 14 tools on every push, PR, or schedule. External network and web application coverage, results in a few hours - not weeks.
Works with Your AI IDE
Launch pentests and review findings from the tools you already use.
Cursor & Windsurf
Our VS Code extension works in Cursor and Windsurf too. Launch pentests, view findings as inline diagnostics, and fix issues without leaving your editor.
Get started →
Claude Code & MCP
Chat with your pentest results directly from Claude Code via our MCP server. Ask questions about findings, get remediation advice, and trigger new pentests.
Get started →
Replit & Others
Deploy on Replit, Railway, or any platform with a public URL. Pentest it with one API call. No special setup required.
Get started →
Three Steps to Automated Pentest
Get an API key
Generate a key from your account settings. Takes 10 seconds.
Add to your pipeline
Paste a few lines of YAML into your CI config. That's the whole setup.
Get pentest results
14 tools run against your target. Report with validated findings lands in a few hours.
Built for Your Workflow
Whether you live in VS Code or Burp Suite, TurboPentest meets you where you work. AI agents and humans, working together.
Burp Suite Professional
Extension for PortSwigger Burp Suite
Run agentic pentests directly from Burp Suite. Launch pentests, chat with AI agents in real-time, and get findings imported as native Burp Scanner issues.
Paladin supports authenticated testing - drop in session cookies, API keys, OAuth tokens, or any custom auth in any format. The AI handles bespoke schemes, including custom session managers, JWT flows, and multi-step login sequences.
- Launch agentic pentests from Burp's target scope
- Live chat with AI agent team during pentests
- OWASP WSTG, API Top 10, LLM Top 10 & MITRE ATLAS guides
- Right-click context menus to direct agent focus
- Findings appear in Burp Scanner results
- Send sitemap, proxy history & auth tokens as context
- 1.Install from GitHub Releases
- 2.Open TurboPentest tab
- 3.Enter your API key
- 4.Select target → Launch
VS Code Extension
Security testing in your editor
Launch pentests, chat with AI agents, and view findings without leaving your editor. Findings appear as native VS Code diagnostics with inline code annotations.
- Launch pentests on localhost or deployed URLs
- Live chat sidebar with AI agent team
- Findings tree view with severity filtering
- Native diagnostics - squiggly lines on findings
- Download PDF reports from the command palette
- Credit balance & pentest status in the status bar
- 1.Install from Marketplace
- 2.Open TurboPentest sidebar
- 3.Enter your API key
- 4.Enter target → Launch
MCP Servers for AI Coding Assistants
Launch pentests, review findings, and analyze results from Grok, Claude, Cursor, Windsurf, or any MCP-compatible assistant. Local npx, hosted remote MCP, and a Grok custom connector.
Grok connector
Custom MCP · grok.com/connectors
Grok has no API-key field and often never opens OAuth for custom MCPs. Mint a personal connector URL (embeds auth in the path), paste it into Grok, run pentests from chat.
- Step 1: https://mcp.turbopentest.com/connect
- Paste tp_ key → get personal /c/.../mcp URL
- Paste that URL into grok.com/connectors
- Same 8 tools as Claude / Cursor MCP
Grok setup (personal URL — works without OAuth)
- 1.Create a
tp_...key - 2.Open
mcp.turbopentest.com/connect - 3.Generate personal URL → paste into Grok Custom connector
- 4.Chat: "List my verified domains"
https://mcp.turbopentest.com/connect
MCP Server (Local)
@turbopentest/mcp-server via npx
Run pentests and review findings directly from your coding assistant. Installs locally via npx with stdio transport. Works with Claude Desktop, Claude Code, Cursor, and any MCP client that supports local servers.
- 8 tools: launch, monitor, analyze, download, and more
- 4 built-in prompts: analyze findings, compare pentests, run pentest, security posture
- Get findings with severity, CVSS, CWE, and PoC
- Download reports as markdown, JSON, or PDF
- Verify attestation letters
- Zero config beyond your API key
{
"mcpServers": {
"turbopentest": {
"command": "npx",
"args": ["@turbopentest/mcp-server"],
"env": {
"TURBOPENTEST_API_KEY": "tp_live_..."
}
}
}
}MCP Server (Remote)
HTTP streaming, zero install
No local install needed. Connect to our hosted MCP server over HTTP streaming. Same tools as the local server, plus built-in prompts for common workflows like analyzing findings, comparing pentests, and assessing security posture.
- Same 8 tools and 4 prompts as the local server
- HTTP streaming transport, works from anywhere
- No npx, no Node.js, no local install
- Works with any MCP client that supports remote servers
- Hosted on edge infrastructure for low latency
- Dynamic resources for pentest data
{
"mcpServers": {
"turbopentest": {
"type": "url",
"url": "https://mcp.turbopentest.com/mcp",
"headers": {
"Authorization": "Bearer tp_live_..."
}
}
}
}Example conversation
Automate & Get Notified
Trigger pentests on every deploy and get results where your team already works.
GitHub Actions
Official action for CI/CD pipelines
The fastest way to add external network and web app pentesting to your workflow. Drop our official action into any repo and get security results in your PR checks.
- Runs on every push, PR, or schedule
- Results posted as PR check annotations
- Optional white box mode with repo access
- Zero dependencies - just add the action
Pipeline gate behavior. By default the action returns exit code 0 - findings are reported but the build continues. Set wait-for-results: true and fail-on: high to block deploys on High+ severity findings (Critical and High). Available values: critical, high, medium. fail-on requires wait-for-results. The action posts finding annotations to the PR regardless of the fail-on setting, so reviewers always see what was found.
White-box: Connect your repo for SAST, SCA, and secret detection alongside the standard external pentest.
# .github/workflows/pentest.yml
name: Agentic Pentest
on:
schedule:
- cron: '0 3 * * 1' # Weekly Monday 3am
workflow_dispatch: # Manual trigger
jobs:
pentest:
runs-on: ubuntu-latest
steps:
- uses: integsec/turbopentest-action@v1
with:
target-url: https://your-app.com
api-key: ${{ secrets.TURBOPENTEST_API_KEY }}
wait-for-results: true
fail-on: high # Block deploy on High+ severity findings
# Optional: connect repo for white box analysis
# repo-url: ${{ github.server_url }}/${{ github.repository }}Slack Notifications
Real-time alerts to your channels
Get real-time alerts in your Slack channels when pentests complete. Receive a summary of findings with severity breakdown so your team can triage immediately.
- Instant notifications when results are ready
- Severity summary with critical finding counts
- Direct links to full pentest reports
- Configure via incoming webhook URL
Pentest Complete: example.com
2 Critical · 3 High · 5 Medium · 1 Low
View full report →
Send Findings Straight to Your Tracker
Connect Jira or GitHub Issues and TurboPentest files a ticket for every finding the moment a pentest completes - no copy-paste, no manual triage.
Jira
One issue per finding, auto-filed
When a pentest completes, TurboPentest opens a Jira issue for each finding - with severity, proof of exploit, remediation, and a link back to the full report - so your team triages in the board they already use.
- One issue per finding, or a single summary issue
- Severity mapped to Jira priority (Critical to Highest)
- Minimum-severity threshold to skip the noise
- Connects to Jira Cloud via API token
GitHub Issues
Reuses your existing GitHub connection
Push findings to the same repo Paladin reads for white-box analysis. No second credential - TurboPentest reuses your existing GitHub connection to open a labeled issue per finding when a pentest completes.
- One issue per finding, or a single summary issue
- Labeled turbopentest + severity for easy filtering
- No extra token - reuses your GitHub connection
- Files to the pentest's connected repo, or any owner/repo
Heads up: Issue creation needs your GitHub connection to carry issues: write - the same connection used for white-box source analysis.
One API. Every Platform.
Every integration is a single POST request. If your platform can run curl, you can pentest.
# Start a pentest from anywhere curl -X POST https://turbopentest.com/api/pentests \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"targetUrl":"https://your-app.com"}'
That's it. 14 tools run automatically. Report delivered to your pentests page.
Works With Your Stack
Copy-paste into your CI config file. Each example is a complete, working integration.
pentest:
stage: test
image: curlimages/curl:latest
script:
- |
curl -sf -X POST https://turbopentest.com/api/pentests \
-H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"targetUrl":"$TARGET_URL"}'Just Deployed? Test It Now.
TurboPentest works with any platform that gives your app a public URL.
Integration FAQ
Everything you need to wire TurboPentest into the tools you already use.
How do I run a pentest from my CI/CD pipeline?
Add the official GitHub Action to your workflow, or make a single authenticated POST request to our REST API from GitLab CI, Jenkins, CircleCI, Azure DevOps, or anything that can run curl. Generate an API key in your account settings, paste a few lines into your config, and every push, PR, or schedule can trigger a pentest.
Can a pentest block my deploy if it finds something serious?
Yes. The GitHub Action returns exit code 0 by default, so findings are reported but the build continues. Set wait-for-results: true and fail-on to critical, high, or medium to fail the build on findings at or above that severity. fail-on requires wait-for-results so the action can inspect findings. Finding annotations are posted to the PR regardless of the setting, so reviewers always see what was found.
Which AI coding tools and IDEs does TurboPentest work with?
Our MCP server connects TurboPentest to Grok (custom connector at grok.com/connectors), Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible assistant, with local (npx) and remote (HTTP streaming) options. The VS Code extension also runs in Cursor and Windsurf, and a Burp Suite Professional extension launches pentests straight from Burp's target scope.
How do I connect TurboPentest to Grok?
Open grok.com/connectors, add a Custom connector, and set the server URL to https://mcp.turbopentest.com/mcp. When prompted, paste a TurboPentest API key from Dashboard → API Keys. You can then launch pentests and review findings inside Grok chat. Full steps are on the integrations page and in the MCP docs.
What can the MCP server do?
The MCP server exposes 8 tools and 4 built-in prompts to launch pentests, monitor progress, get findings with severity, CVSS, CWE, and proof-of-concept, download reports as Markdown, JSON, or PDF, and verify attestation letters, all from a chat with your coding assistant. Every call requires your API key.
Do I need to install an agent or special infrastructure?
No. Every integration is a single API call, so if your platform can run curl, you can pentest. TurboPentest works with any target that has a public URL, including apps on Vercel, Netlify, Railway, Render, and Replit. There are no agents to install and no config files to wrangle.
How do I get notified when a pentest finishes?
Configure a Slack incoming webhook in your settings to get real-time alerts when results are ready, with a severity summary and a direct link to the full report. You can also poll the REST API or read results from the VS Code and Burp Suite extensions.
Can findings become Jira issues or GitHub issues automatically?
Yes. Connect Jira or GitHub Issues under Account > Notifications and TurboPentest files a ticket for each finding the moment a pentest completes - with severity, proof of exploit, and remediation. Choose one ticket per finding or a single summary, and set a minimum-severity threshold so only findings that matter get filed. GitHub Issues reuses the same GitHub connection you use for white-box analysis, so there is no second credential to store.
From Zero to Pentested in a Few Hours
Generate an API key, paste a few lines into your pipeline, and get your first pentest report. No agents to install. No config files to wrangle.