{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_vutzfqq7ep73","handle":"goose-pentest-mcp","url":"https://wellknown.network/agents/goose-pentest-mcp","links":{"self":"https://wellknown.network/agents/goose-pentest-mcp/record.json","html":"https://wellknown.network/agents/goose-pentest-mcp","markdown":"https://wellknown.network/agents/goose-pentest-mcp/record.md","api":"https://wellknown.network/api/v1/agents/goose-pentest-mcp","status":"https://wellknown.network/api/v1/agents/goose-pentest-mcp/status","claim":"https://wellknown.network/agents/goose-pentest-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/goose-pentest-mcp/claim.json","badge":"https://wellknown.network/agents/goose-pentest-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:goose-pentest-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"goose-pentest-mcp","summary":"MCP extension for self-pentest workflows (Goose-compatible stdio server)","description":"# goose-pentest-mcp\n\nA [Model Context Protocol](https://modelcontextprotocol.io) extension for\nself-pentest workflows. Exposes six tools to [Goose](https://block.github.io/goose/)\n(or any MCP-compatible client) so an LLM can list targets, trigger scans,\nread findings, and mark them resolved — all against **your** backend.\n\nThe extension is a thin HTTP client. It does not shell out, write files,\nor scan anything itself. You supply the backend; it supplies the agent\nsurface.\n\n## What you need\n\n1. A backend implementing the six endpoints in [`BACKEND_CONTRACT.md`](BACKEND_CONTRACT.md).\n2. An API key your backend will accept in `X-Pentest-Key`.\n3. Goose (or another MCP client) installed locally.\n\nIf you have not built a backend yet, see the **Reference implementation**\nsection below — there's a working FastAPI one (Apache-2.0) you can read\nor adapt.\n\n## Install\n\n```bash\npip install goose-pentest-mcp\n# or, if you use uv:\nuvx goose-pentest-mcp\n```\n\nTo install from source (or hack on it):\n\n```bash\ngit clone https://github.com/turer73/goose-pentest-mcp.git\ncd goose-pentest-mcp\npip install -e .\n```\n\n## Configure Goose\n\nEdit `~/.config/goose/config.yaml`:\n\n```yaml\nextensions:\n  pentest:\n    type: stdio\n    name: pentest\n    display_name: \"Self-Pentest\"\n    description: \"List targets, trigger scans, manage findings\"\n    enabled: true\n    bundled: false\n    timeout: 600\n    cmd: python\n    args:\n      - -m\n      - goose_pentest_mcp.server\n    env_keys:\n      - PENTEST_API_KEY\n    envs:\n      PENTEST_API_BASE: \"https://your-backend.example.com/api/v1/security\"\n```\n\nThen export the key from your shell rc:\n\n```bash\nexport PENTEST_API_KEY=\"$(cat ~/.secrets/pentest-key)\"\n```\n\n`config.yaml` may end up holding (or revealing the path to) live secrets;\n`chmod 600 ~/.config/goose/config.yaml` is the minimum hygiene. If\n`restic` / `borg` / `rclone` covers `~/.config/`, those backups carry the\nkey — rotate after first install if backups already ran.\n\n## Tools\n\n| Tool                      …","publisher":{"name":"KlipperOS","url":null},"homepage":"https://github.com/turer73/goose-pentest-mcp/blob/main/README.md","repository":"https://github.com/turer73/goose-pentest-mcp/blob/main/README.md","version":"0.1.0","license":null,"protocols":["mcp"],"tags":["agent","goose","llm","mcp","pentest","security"],"pricing":null,"endpoints":[{"url":"pypi:goose-pentest-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"declared"},{"slug":"dev.filesystem","name":"Filesystem","confidence":0.814,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":0.745,"provenance":"derived"},{"slug":"dev.terminal","name":"Terminal & Shell","confidence":0.745,"provenance":"derived"}],"categories":["dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"goose-pentest-mcp","registry":"pypi","observedAt":"2026-09-09T16:25:40.714Z","publishedAt":"2026-05-28T05:57:12.948543Z","latestVersion":"0.1.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"goose-pentest-mcp","url":"https://pypi.org/project/goose-pentest-mcp/","firstSeenAt":"2026-09-09T16:24:36.988Z","fetchedAt":"2026-09-09T16:24:36.988Z","normalizedAt":"2026-09-09T16:24:36.988Z"}]},"firstSeenAt":"2026-09-09T16:24:36.988Z","updatedAt":"2026-09-09T16:25:40.714Z"}