# Penthera

Penthera checks project code, dependencies, and AI coding tool configuration against local rules. Use it to inspect known security issues from your coding agent.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 55
- Author: danoszz
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/danoszz/penthera
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/penthera

## What it does

Penthera runs local checks on an app, its dependencies, and AI coding tool configuration. Its findings come from readable rules, with evidence pointing to a file and line. The MCP server provides six read-only tools and works offline.

An agent can suggest a fix, but Penthera applies it only after you approve. It detects known types of issues, not novel ones, and does not replace a human penetration test. Keep that limit in mind when interpreting a clean scan. The Claude Code setup launches the server with `npx`.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add penthera -- npx -y penthera
```

### Codex

**Platform CLI**
```bash
codex mcp add penthera -- npx -y penthera
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "penthera": {
            "command": "npx",
            "args": [
                "-y",
                "penthera"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "penthera": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "penthera"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add penthera npx -y penthera
```

## When to use it
- scan application code for known security issues
- inspect project dependencies for suspicious packages
- check AI coding tool configuration
- trace a finding to its file and line
- review a suggested fix before approving it

## Example prompts
- Scan this project and its dependencies for known security issues.
- Check my AI coding tool configuration and show the evidence for each finding.
- Suggest a fix for this issue, but wait for my approval before applying it.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md