@pentatrail/mcp-server

@pentatrail/mcp-server

PentaTrail MCP Server for accessing CTEM (Continuous Threat Exposure Management) data via Model Context Protocol.

This package is a thin stdio wrapper over the PentaTrail Customer API. It works with Claude Code, Claude Desktop, and any MCP-compatible client.

The published server exposes the public CTEM tools registered by registerPublicCtemTools, and that surface is read-only — every tool needs only the ctem:read scope. Internal MCP-only tools are not registered.

Setup

Run

The simplest way to use the server is with npx:

npx @pentatrail/mcp-server

Configure

Add to your MCP client config (e.g. ~/.claude/settings.json or claude_desktop_config.json):

{
  "mcpServers": {
    "pentatrail": {
      "command": "npx",
      "args": ["@pentatrail/mcp-server"],
      "env": {
        "PENTATRAIL_API_KEY": "ptk_your_api_key_here",
        "PENTATRAIL_API_URL": "https://api.pentatrail.co"
      }
    }
  }
}

Environment Variables

Variable	Required	Description
PENTATRAIL_API_KEY	Yes	Your API key (ptk_...). Generate from PentaTrail Dashboard > Settings.
PENTATRAIL_API_URL	Yes	https://api.pentatrail.co (production)

Available Tools

CTEM Read

Tool	Description
ctem_list_domains	List your monitored domains. Start here — by default it returns active domains only, and every domain in that default result can be passed straight to the other tools as domain_id. include_archived: true drops the status filter, so the result then also contains non-active domains (archived, and legacy paused) whose ids the other tools reject with PT_API_NOT_FOUND
ctem_list_hosts	List hosts with enrichment (port/tech/finding counts, sortable)
ctem_list_findings	List vulnerabilities sorted by Threat Discovery Level (TDL)
ctem_get_asset_counts	Get asset type counts (hosts, IPs, ports, tech, buckets, URLs)
ctem_get_tdl_counts	Get open finding counts grouped by TDL (tdl5=most critical)
ctem_get_scores	Get live domain scores (asset counts + findings breakdown)
ctem_get_score_trend	Get security score trend over time (7-365 days)
ctem_list_ports	List open ports grouped by port/protocol, filterable by source type
ctem_list_tech	List detected technologies grouped by category and name
ctem_list_port_groups	Host counts per (port, protocol, service)
ctem_list_tech_groups	Tech hierarchy: category → name → host count
ctem_list_ips	Paginated list of discovered IP addresses
ctem_list_urls	Paginated list of discovered URLs
ctem_list_buckets_paginated	Paginated cloud storage buckets, one row per bucket
ctem_list_buckets_merged	Cloud buckets de-duplicated by (cloud_type, bucket_name)
ctem_summarize_findings	Rollup per vuln_id with max CVSS/EPSS, KEV count, affected hosts

Usage Examples

Once configured, ask your AI assistant:

• "Show me all monitored domains"
• "List critical findings for domain X"
• "What's the security score trend for the last 30 days?"
• "How many assets do we have?"
• "Show my threat exposure risk level for this domain"

Requirements

• Node.js >= 20
• PentaTrail account with an active contract
• API key with the ctem:read scope — that is the only scope this server needs, because every tool it registers reads

License

UNLICENSED - Proprietary software. All rights reserved.