Penthera — Claude Code MCP server: security checks
Penthera checks project code, dependencies, and AI coding tool configuration against local rules. Use it to inspect known security issues from your coding agent.
claude mcp add penthera -- npx -y pentheraWhat Penthera does
Penthera runs local checks on an app, its dependencies, and AI coding tool configuration. Its findings come from readable rules, with evidence pointing to a file and line. The MCP server provides six read-only tools and works offline.
An agent can suggest a fix, but Penthera applies it only after you approve. It detects known types of issues, not novel ones, and does not replace a human penetration test. Keep that limit in mind when interpreting a clean scan. The Claude Code setup launches the server with npx.
What it helps with
- scan application code for known security issues
- inspect project dependencies for suspicious packages
- check AI coding tool configuration
- trace a finding to its file and line
- review a suggested fix before approving it
Example prompts for the agent
- Scan this project and its dependencies for known security issues.
- Check my AI coding tool configuration and show the evidence for each finding.
- Suggest a fix for this issue, but wait for my approval before applying it.
How to install Penthera
Platform CLI
claude mcp add penthera -- npx -y pentheraPlatform CLI
codex mcp add penthera -- npx -y pentheraConfig file
{
"mcpServers": {
"penthera": {
"command": "npx",
"args": [
"-y",
"penthera"
]
}
}
}Config file
{
"servers": {
"penthera": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"penthera"
]
}
}
}Platform CLI
gemini mcp add penthera npx -y pentheraStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Penthera
How do I install Penthera in Claude Code?
Run claude mcp add penthera -- npx -y penthera. This registers the Penthera MCP server.
What does Penthera do?
It checks an app, its dependencies, and AI coding tool configuration locally using readable rules. Findings include file and line evidence.
Does Penthera replace a human penetration test?
No. It detects known classes of issues and does not replace a human penetration test.
