goose-pentest-mcp

# goose-pentest-mcp A [Model Context Protocol](https://modelcontextprotocol.io) extension for self-pentest workflows. Exposes six tools to [Goose](https://block.github.io/goose/) (or any MCP-compatible client) so an LLM can list targets, trigger scans, read findings, and mark them resolved — all against **your** backend. The extension is a thin HTTP client. It does not shell out, write files, or scan anything itself. You supply the backend; it supplies the agent surface. ## What you need 1. A backend implementing the six endpoints in [`BACKEND_CONTRACT.md`](BACKEND_CONTRACT.md). 2. An API key your backend will accept in `X-Pentest-Key`. 3. Goose (or another MCP client) installed locally. If you have not built a backend yet, see the **Reference implementation** section below — there's a working FastAPI one (Apache-2.0) you can read or adapt. ## Install ```bash pip install goose-pentest-mcp # or, if you use uv: uvx goose-pentest-mcp ``` To install from source (or hack on it): ```bash git clone https://github.com/turer73/goose-pentest-mcp.git cd goose-pentest-mcp pip install -e . ``` ## Configure Goose Edit `~/.config/goose/config.yaml`: ```yaml extensions: pentest: type: stdio name: pentest display_name: "Self-Pentest" description: "List targets, trigger scans, manage findings" enabled: true bundled: false timeout: 600 cmd: python args: - -m - goose_pentest_mcp.server env_keys: - PENTEST_API_KEY envs: PENTEST_API_BASE: "https://your-backend.example.com/api/v1/security" ``` Then export the key from your shell rc: ```bash export PENTEST_API_KEY="$(cat ~/.secrets/pentest-key)" ``` `config.yaml` may end up holding (or revealing the path to) live secrets; `chmod 600 ~/.config/goose/config.yaml` is the minimum hygiene. If `restic` / `borg` / `rclone` covers `~/.config/`, those backups carry the key — rotate after first install if backups already ran. ## Tools | Tool …