Agentic AI is transforming security by automating many tasks being performed manually. While initial agentic approaches employed a monolithic architecture, the Model-Context-Protocol has now enabled a remote-procedure call (RPC) paradigm to agentic applications, allowing for the flexible construction and composition of multi-function agents. This paper describes PentestMCP, a library of MCP server implementations that support agentic penetration testing. By supporting common penetration testing tasks such as network scanning, resource enumeration, service fingerprinting, vulnerability scanning, exploitation, and post-exploitation, PentestMCP allows a developer to customize multi-agent workflows for performing penetration tests.
@article{arxiv.2510.03610,
title = {PentestMCP: A Toolkit for Agentic Penetration Testing},
author = {Zachary Ezetta and Wu-chang Feng},
journal= {arXiv preprint arXiv:2510.03610},
year = {2025}
}