Pentest on Every Deploy.
Works with Cursor, Vercel, and GitHub Actions.
Drop TurboPentest into your CI/CD pipeline and run an agentic pentest with 14 tools on every push, PR, or schedule. External network and web application coverage, results in a few hours - not weeks.
Works with Your AI IDE
Launch pentests and review findings from the tools you already use.
Cursor & Windsurf
Our VS Code extension works in Cursor and Windsurf too. Launch pentests, view findings as inline diagnostics, and fix issues without leaving your editor.
Claude Code & MCP
Chat with your pentest results directly from Claude Code via our MCP server. Ask questions about findings, get remediation advice, and trigger new pentests.
Replit & Others
Deploy on Replit, Railway, or any platform with a public URL. Pentest it with one API call. No special setup required.
Three Steps to Automated Pentest
Get an API key
Generate a key from your account settings. Takes 10 seconds.
Add to your pipeline
Paste a few lines of YAML into your CI config. That's the whole setup.
Get pentest results
14 tools run against your target. Report with validated findings lands in a few hours.
Built for Your Workflow
Whether you live in VS Code or Burp Suite, TurboPentest meets you where you work. AI agents and humans, working together.
Burp Suite Professional
Extension for PortSwigger Burp Suite
Run agentic pentests directly from Burp Suite. Launch pentests, chat with AI agents in real-time, and get findings imported as native Burp Scanner issues.
Paladin supports authenticated testing - drop in session cookies, API keys, OAuth tokens, or any custom auth in any format. The AI handles bespoke schemes, including custom session managers, JWT flows, and multi-step login sequences.
- Launch agentic pentests from Burp's target scope
- Live chat with AI agent team during pentests
- OWASP WSTG, API Top 10, LLM Top 10 & MITRE ATLAS guides
- Right-click context menus to direct agent focus
- Findings appear in Burp Scanner results
- Send sitemap, proxy history & auth tokens as context
- 1.Install from BApp Store
- 2.Open TurboPentest tab
- 3.Enter your API key
- 4.Select target → Launch
VS Code Extension
Security testing in your editor
Launch pentests, chat with AI agents, and view findings without leaving your editor. Findings appear as native VS Code diagnostics with inline code annotations.
- Launch pentests on localhost or deployed URLs
- Live chat sidebar with AI agent team
- Findings tree view with severity filtering
- Native diagnostics - squiggly lines on findings
- Download PDF reports from the command palette
- Credit balance & pentest status in the status bar
- 1.Install from Marketplace
- 2.Open TurboPentest sidebar
- 3.Enter your API key
- 4.Enter target → Launch
MCP Servers for AI Coding Assistants
Launch pentests, review findings, and analyze results from Claude, Cursor, Windsurf, or any MCP-compatible coding assistant. Two options: install locally or connect remotely.
MCP Server (Local)
@turbopentest/mcp-server via npx
Run pentests and review findings directly from your coding assistant. Installs locally via npx with stdio transport. Works with Claude Desktop, Claude Code, Cursor, and any MCP client that supports local servers.
- 8 tools: launch, monitor, analyze, download, and more
- 4 built-in prompts: analyze findings, compare pentests, run pentest, security posture
- Get findings with severity, CVSS, CWE, and PoC
- Download reports as markdown, JSON, or PDF
- Verify attestation letters
- Zero config beyond your API key
{
"mcpServers": {
"turbopentest": {
"command": "npx",
"args": ["@turbopentest/mcp-server"],
"env": {
"TURBOPENTEST_API_KEY": "tp_live_..."
}
}
}
}MCP Server (Remote)
HTTP streaming, zero install
No local install needed. Connect to our hosted MCP server over HTTP streaming. Same tools as the local server, plus built-in prompts for common workflows like analyzing findings, comparing pentests, and assessing security posture.
- Same 8 tools and 4 prompts as the local server
- HTTP streaming transport, works from anywhere
- No npx, no Node.js, no local install
- Works with any MCP client that supports remote servers
- Hosted on edge infrastructure for low latency
- Dynamic resources for pentest data
{
"mcpServers": {
"turbopentest": {
"type": "url",
"url": "https://mcp.turbopentest.com/mcp",
"headers": {
"Authorization": "Bearer tp_live_..."
}
}
}
}Why our MCP servers are not in the wide-open RCE wave
Both local and remote servers are designed against the common MCP attack patterns reported across 200,000+ public servers.
- API key required on every call. No anonymous access on either local stdio or remote HTTP.
- No shell execution from input. Tools call our typed REST API. No exec, no spawn, no template strings into a shell.
- Domain verification required before any pentest launches. Targets must be on your verified-domain list.
- Findings framed as untrusted data with explicit delimiters so a hostile pentest target cannot prompt-inject your AI agent through a finding title or report body.
- Per-key rate limiting on the remote endpoint, plus strict input validation (UUIDs, URLs, SHA-256 hashes).
Example conversation
Automate & Get Notified
Trigger pentests on every deploy and get results where your team already works.
GitHub Actions
Official action for CI/CD pipelines
The fastest way to add external network and web app pentesting to your workflow. Drop our official action into any repo and get security results in your PR checks.
- Runs on every push, PR, or schedule
- Results posted as PR check annotations
- Optional white box mode with repo access
- Zero dependencies - just add the action
Pipeline gate behavior. By default the action returns exit code 0 - findings are reported but the build continues. Set fail-on: high to block deploys on High+ severity findings (Critical and High). Available values: critical, high, medium. The action posts finding annotations to the PR regardless of the fail-on setting, so reviewers always see what was found.
White-box: Connect your repo for SAST, SCA, and secret detection alongside the standard external pentest.
# .github/workflows/pentest.yml
name: Agentic Pentest
on:
schedule:
- cron: '0 3 * * 1' # Weekly Monday 3am
workflow_dispatch: # Manual trigger
jobs:
pentest:
runs-on: ubuntu-latest
steps:
- uses: integsec/turbopentest-action@v1
with:
target-url: https://your-app.com
api-key: ${{ secrets.TURBOPENTEST_API_KEY }}
fail-on: high # Block deploy on High+ severity findings
# Optional: connect repo for white box analysis
# repo-url: ${{ github.server_url }}/${{ github.repository }}Slack Notifications
Real-time alerts to your channels
Get real-time alerts in your Slack channels when pentests complete. Receive a summary of findings with severity breakdown so your team can triage immediately.
- Instant notifications when results are ready
- Severity summary with critical finding counts
- Direct links to full pentest reports
- Configure via incoming webhook URL
Pentest Complete: example.com
2 Critical · 3 High · 5 Medium · 1 Low
View full report →
One API. Every Platform.
Every integration is a single POST request. If your platform can run curl, you can pentest.
# Start a pentest from anywhere curl -X POST https://turbopentest.com/api/pentests \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"targetUrl":"https://your-app.com"}'
That's it. 14 tools run automatically. Report delivered to your pentests page.
Works With Your Stack
Copy-paste into your CI config file. Each example is a complete, working integration.
pentest:
stage: test
image: curlimages/curl:latest
script:
- |
curl -sf -X POST https://turbopentest.com/api/pentests \
-H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"targetUrl":"$TARGET_URL"}'Just Deployed? Test It Now.
TurboPentest works with any platform that gives your app a public URL.
Vercel
Supported
Netlify
Supported
Railway
Supported
Render
Supported
Replit
Supported
From Zero to Pentested in a Few Hours
Generate an API key, paste a few lines into your pipeline, and get your first pentest report. No agents to install. No config files to wrangle.