@pentatrail/mcp-server

@pentatrail/mcp-server

PentaTrail MCP Server for accessing CTEM (Continuous Threat Exposure Management) data via Model Context Protocol.

This package is a thin stdio wrapper over the PentaTrail Customer API. It works with Claude Code, Claude Desktop, and any MCP-compatible client.

The published server exposes the 17 public CTEM tools registered by registerPublicCtemTools — 16 read tools plus one write tool (ctem_exclude_bulk, which needs the ctem:exclusions:write scope). Internal MCP-only tools are not registered.

Setup

Run

The simplest way to use the server is with npx:

npx @pentatrail/mcp-server

Configure

Add to your MCP client config (e.g. ~/.claude/settings.json or claude_desktop_config.json):

{
  "mcpServers": {
    "pentatrail": {
      "command": "npx",
      "args": ["@pentatrail/mcp-server"],
      "env": {
        "PENTATRAIL_API_KEY": "ptk_your_api_key_here",
        "PENTATRAIL_API_URL": "https://api.pentatrail.co"
      }
    }
  }
}

Environment Variables

Variable	Required	Description
PENTATRAIL_API_KEY	Yes	Your API key (ptk_...). Generate from PentaTrail Dashboard > Settings.
PENTATRAIL_API_URL	Yes	https://api.pentatrail.co (production)

Available Tools

CTEM Read (16)

Tool	Description
ctem_list_domains	List all monitored domains for your contract
ctem_list_hosts	List hosts with enrichment (port/tech/finding counts, sortable)
ctem_list_findings	List vulnerabilities sorted by Threat Discovery Level (TDL)
ctem_get_asset_counts	Get asset type counts (hosts, IPs, ports, tech, buckets, URLs)
ctem_get_tdl_counts	Get open finding counts grouped by TDL (tdl5=most critical)
ctem_get_scores	Get live domain scores (asset counts + findings breakdown)
ctem_get_score_trend	Get security score trend over time (7-365 days)
ctem_list_ports	List open ports grouped by port/protocol, filterable by source type
ctem_list_tech	List detected technologies grouped by category and name
ctem_list_port_groups	Host counts per (port, protocol, service)
ctem_list_tech_groups	Tech hierarchy: category → name → host count
ctem_list_ips	Paginated list of discovered IP addresses
ctem_list_urls	Paginated list of discovered URLs
ctem_list_buckets_paginated	Paginated cloud storage buckets, one row per bucket
ctem_list_buckets_merged	Cloud buckets de-duplicated by (cloud_type, bucket_name)
ctem_summarize_findings	Rollup per vuln_id with max CVSS/EPSS, KEV count, affected hosts

CTEM Write (1)

Tool	Description
ctem_exclude_bulk	Exclude multiple assets in one call. Requires the ctem:exclusions:write scope; audit-logged.

Usage Examples

Once configured, ask your AI assistant:

• "Show me all monitored domains"
• "List critical findings for domain X"
• "What's the security score trend for the last 30 days?"
• "How many assets do we have?"
• "Show my threat exposure risk level for this domain"

Requirements

• Node.js >= 20
• PentaTrail account with an active contract
• API key with ctem:read scope (add ctem:exclusions:write only if you want ctem_exclude_bulk to work; without it that one tool returns a scope error and the 16 read tools are unaffected)

License

UNLICENSED - Proprietary software. All rights reserved.