connected-mcp-pentest
Installation
SKILL.md
Connected MCP Pentest (test-in-place)
For when your agent already has the target MCP connected as tools (it appears
as mcp__<server>__<tool> or similar). You test it through your own client
connection — the way a real user's agent reaches it. Read
../../SECURITY_RULES.md first.
READ THIS FIRST — pick the right mode (do not re-host)
Before doing anything, decide how you are testing. Getting this wrong produces a clean-looking report of the wrong surface.
| Situation | Mode | Skill |
|---|---|---|
| Target MCP is connected in your mcp.json (tools available now) | A: in-place (this skill) | test via your own tool calls |
| User gives a raw remote endpoint URL + token | B: HTTP battery | ../../autonomy/probe_runner.py |
| User points at source code / a repo | C: code audit | ../mcp-server-pentest |