One server, different clients
MCP lets an AI client call Pentest-AI tools. Your client supplies the model; Pentest-AI supplies engagements, investigation and verification tools. This path does not need a separate model API key for Pentest-AI.
Install your preferred client first, then install Pentest-AI and connect it:
pipx install ptai
ptai setup --mcp
The wizard shows detected clients and asks before writing settings. Codex and Claude Code detection requires their CLI commands on PATH. Existing Pentest-AI registrations are preserved. Restart the client after configuration.
What setup changes
Install pipx first and make sure its
application directory is on PATH. The first command installs Pentest-AI in an
isolated environment. For upgrades use pipx upgrade ptai. The
installation guide also covers pip in a virtual environment.
The second asks permission to configure all detected supported clients. If both
Codex and Claude Code are detected, it configures both; it does not choose one.
It does not install AI clients, sign you in, download models, or configure Ollama.
The wizard uses user-wide client settings, not the current repository. Run it
once for your user account; you do not need to repeat it in every folder. Use
ptai setup --mcp --dry-run to inspect the proposed changes. To connect only one
client, use its direct command below instead of the wizard.
Keep the Python environment containing ptai available: the client launches that
executable whenever it starts the MCP server. Deleting the environment breaks the
connection. Installing in a project virtual environment does not make the wizard's
client settings project-scoped.
For an older release, or to configure only one client, use the direct commands below. These do not depend on automatic detection.
Codex
codex mcp add pentest-ai -- ptai mcp
codex mcp get pentest-ai
The second command checks the registration. If your client cannot find ptai,
use its absolute executable path in the registration command.
Official Codex MCP documentation
Claude Code
claude mcp add --scope user --transport stdio pentest-ai -- ptai mcp
claude mcp get pentest-ai
User scope makes the server available across your projects. Inside Claude Code,
use /mcp to inspect connected servers.
Official Claude Code MCP documentation
Set up only one repository
The current ptai setup --mcp wizard has no project-scope option. Use the client’s
own project configuration instead. This controls where the tool is available;
it does not automatically select a testing target or isolate Pentest-AI data.
Codex project configuration
In your repository, merge this into .codex/config.toml without replacing
unrelated settings:
[mcp_servers.pentest-ai]
command = "ptai"
args = ["mcp"]
Codex loads project configuration for trusted projects. If ptai is not on the
client's PATH, use its absolute executable path. Each teammate must install
Pentest-AI locally; a shared configuration does not install the package.
Claude Code project configuration
Run this from the repository root:
claude mcp add --scope project --transport stdio pentest-ai -- ptai mcp
This writes .mcp.json for the project. Teammates install Pentest-AI and approve
that server in Claude Code. For a private configuration limited to this project,
use --scope local instead of --scope project.
If you already registered Pentest-AI user-wide, adding a project configuration does not remove that user-wide registration. Remove the old entry through your client's MCP settings if you want availability limited to this repository.
Other MCP clients
Choose a local stdio server. Set its command to ptai and its arguments to
["mcp"]. The configuration format depends on your client. An app that only
accepts remote connectors cannot directly launch this local command.
For executable paths containing spaces, keep the command and arguments in
separate fields. Use command -v ptai in Bash or (Get-Command ptai).Source in
PowerShell to find the installed executable.
Ollama and local models
Ollama is a model runtime, not the MCP client configured by the wizard. It can supply a local model to the standalone CLI.
Start Ollama and pull a model with tool-calling support. Use ollama list to find
the exact installed name, then replace the placeholder below.
PENTEST_AI_LLM_PROVIDER=ollama PENTEST_AI_MODEL="your-installed-model" ptai start https://your-authorized-target.example --no-sync
In PowerShell:
$env:PENTEST_AI_LLM_PROVIDER = "ollama"
$env:PENTEST_AI_MODEL = "your-installed-model"
ptai start https://your-authorized-target.example --no-sync
The default Ollama endpoint is http://localhost:11434. Set OLLAMA_HOST for
another address. Small models can struggle with tool selection and longer
investigations; tool-calling support alone is not a quality guarantee.
Ollama tool-calling documentation
Cloud model APIs
The standalone CLI also supports Anthropic and OpenAI. Set the corresponding
ANTHROPIC_API_KEY or OPENAI_API_KEY in your environment. To choose explicitly,
set PENTEST_AI_LLM_PROVIDER to anthropic or openai and PENTEST_AI_MODEL to
a compatible model name.
Keep API keys out of commands saved to shared files and out of source control. Cloud provider calls can incur charges from the provider; the open-source CLI does not include a hosted model subscription.