Insomnia MCP Server

Drive autonomous pentests from an AI assistant. The Insomnia MCP server lets an AI client run recon, scanning, exploitation and reporting across web apps, APIs, networks, cloud and Active Directory, with 275+ modules, 30,000+ CVE matching and one-click CVSS reports.

View on insom.ai

Documentation

Our Bots Don't Sleep.

SAST Free static-analysis CLI — finds bugs before they ship $ pip install sast Copy Explore CI/CD →

Product demo video

See Insomnia in action

A short walkthrough of a real run — scan, AI triage, exploit and report.

Play with Insomnia

Run Insomnia right in your browser — an interactive playground that replays real scans, AI triage and exploits against a vulnerable lab. No install.

Launch the playground →

Watch the demos

43 short walkthroughs across scanning, exploitation, APIs, the AI red team, code security, proxy tooling and platform integrations — grouped by category.

Browse all videos →

AI-Powered Pentesting

Your AI Red Team In Action

Watch 7 AI personas collaborate to find vulnerabilities, validate exploits, and generate client-ready reports — all from a single CLI command or GUI click.

Launch with One Command

# Launch AI red team against target
$ insomnia --agent \
    -t https://app.example.com \
    -o "Full pentest: find SQLi, XSS, auth bypass,
    IDOR, SSRF. Scan ports. Generate PDF report" \
    --team-size 5

  [Inom]     Offensive Lead initialized (Claude Opus)
  [Cipher]   Analyst initialized (GPT-4o)
  [Vector]   Strategist initialized (Claude Sonnet)
  [Nexus]    Exploit Dev initialized (Ollama Mistral)
  [Specter]  Social Engineer initialized (Gemini Pro)

  [+] Scanning 3 targets with 5 AI personas...
  [+] Modules selected: sqli, xss, dom_xss, idor,
      ssrf, ssti, auth_bypass, jwt, cors, cve_scan

  [!] Inom found: SQL Injection in /api/users?id=
  [!] Cipher validated: Confirmed — data exfil possible
  [!] Vector found: IDOR on /api/orders/{id}
  [!] Nexus found: Stored XSS in /profile/bio
  [+] Specter: Auth bypass via password reset flow

   Scan complete: 4 Critical, 6 High, 3 Medium
   Report: scan_report_2026-02-27.pdf

AI Team Discussion (Live)

AI Team Chat — #pentest-app-example 5 agents online

InomOffensive Lead

Recon complete. /api/users?id=1 returns full user object. No auth check. Testing for SQLi — single quote triggers 500.

CipherAnalyst

Confirmed. id=1' OR 1=1-- dumps entire users table. This is Critical — full database access. CVSS 9.8.

VectorStrategist

Pivoting from SQLi. Found IDOR on /api/orders/{id}. Changing ID returns other users' orders. No authorization check.

InomOffensive Lead

Good work team. 4 Critical + 6 High findings. Attack chain: SQLi → email dump → reset token → admin takeover. Generating report.

AI-Generated Report

Insomnia Security Report

Penetration Test — app.example.com

Generated by AI Red Team • Confidential

Executive Summary

Critical

High

Medium

Low

CRITICAL SQL Injection in /api/users endpoint 9.8

CRITICAL Predictable password reset tokens 9.1

GUI — AI Agent Panel

AI Agent GUI Panel

Real-Time Dashboard

Watch findings stream in as each AI persona discovers vulnerabilities.

One-Click Report

PDF, HTML, or JSON with CVSS scores, evidence, and remediation steps.

Shift-left · Free · 30 seconds

Add Insomnia to your CI / CD

Wire SAST, DAST, secret detection, container audit, and a deploy-gate into your existing pipeline. Free, customisable, and ships in 30 seconds via the online wizard — no SaaS, no signup, just one YAML.

Shift-left

Catch bugs before they ship

Every PR scanned for SAST + secrets + vulnerable deps. Block deploy on critical findings.

Single binary

One install, every check

SAST + DAST + APK/IPA + container + cloud in one binary. No 8-vendor pipeline tax.

< 2% FP

Quiet, not noisy

Strict mode + AI validation + min-confidence gate. Stop alert fatigue at the source.

Notify anywhere

Slack · Discord · Teams · Telegram · Email

Each pipeline run pings your team with severity counts + a one-click artifact link.

Insomnia — Pipeline Builder 7 steps · ~46m total

Available

CODE

+ SAST Scan

+ Secret Detection

+ Dependency Audit

WEB

+ Full DAST

+ API Security

INFRA

+ Port Scan

+ Docker Audit

NOTIFY

+ Slack

+ JIRA Ticket

Pipeline canvas

1. SAST Scan · ~10m

↓

2. Secret Detection · ~5m

↓

3. Dependency Audit · ~3m

↓

4. Docker Audit · ~10m

↓

5. API Security · ~15m

↓

6. Generate Report · ~2m

↓

7. Slack Notification · ~1m

Deploy Rule

Block deploy if any critical or high. Allow medium only with team-lead approval.

Export as

Bash PS GHA GitLab Jenkins

Open Online Wizard →

Take Insomnia everywhere

From your editor to a drop box on the target network — the same engine, wherever you work.

Catch vulns right in your editor

Insomnia SAST underlines secrets and vulnerabilities on the exact line you wrote them — confirmed by taint analysis, with CWE/OWASP and a one-click fix in the side panel.

VS CodeJetBrainsVisual Studio

Explore the plugin →

A full red-team OS — and a box to run it

A Debian-based offensive OS with the Insomnia scanner, 430+ modules, 11k+ CVEs and a complete red-team toolkit preloaded. Flash it for Raspberry Pi or x86 — or drop the plug-and-play Pi 5 appliance straight onto the target network.

Raspberry Pi 5x86 ISOWeb accessDrop box

Explore Insomnia OS →

Run a full pentest from your phone

Open ChatGPT (or Claude / Grok) on your phone, connect it to Insomnia's remote MCP server, and just ask. Insomnia scans, finds real vulnerabilities, and can generate the report for you — then check whether a finding is actually true, send the HTML out, and let the AI validate it. No laptop needed.

1 Ask in plain English — "pentest my site."
2 Insomnia finds vulns and confirms them (no false alarms).
3 It generates a full report — and can email the HTML out.
4 The AI re-validates every finding so you trust it.

Complete Offensive Security Platform

Web, API, network, Active Directory, OSINT and source code — one AI-driven platform replaces the rack of single-purpose tools you used to chain together.

Web Vulnerability Scanner

275+ modules: SQL injection, XSS, SSTI, SSRF, LFI, RCE, deserialization, GraphQL, JWT, HTTP smuggling, and every OWASP Top 10 category.

AI Red Team (7 Agents)

7 specialized AI personas that actively probe with curl, nmap, and custom scripts. Mix Claude, GPT-4, Mistral, and Gemini across the team.

Network & Protocol Scanner

Port scanning, 20+ protocol-specific scanners (SSH, SMB, RDP, MQTT, ICS/SCADA), service detection, and 30K+ CVE matching.

OSINT Intelligence

Domain, IP, email, username, phone, company recon. Breach lookups, interactive visual canvas with 200+ transforms.

Active Directory & Creds

AD enumeration, NTDS audit, Kerberoasting, attack path visualization, lateral movement. Multi-protocol bruteforce.

Professional Reports

Executive PDF/DOCX reports with findings, evidence, CVSS scoring, remediation steps, and compliance mapping.

One Platform, Zero Compromises

Stop juggling a dozen disconnected tools, paying separate licenses, and stitching reports together manually.

5+ separate scanning tools
Manual context switching
No AI, no automation
Stitch reports from multiple outputs
Pay per tool, per seat, per year
Weeks of training per tool

275+ modules in one platform
Unified workflow, single UI
7-member AI red team runs scans autonomously
One-click PDF/DOCX/HTML reports
One license covers everything
Productive in minutes, not weeks

Head-to-head: class recall

Insomnia SAST scored against Semgrep, Bandit and SonarQube on the same 50 deliberately-vulnerable repos — same (audit-corrected) ground truth, same scoring. Recall = share of labelled vulnerability classes each tool actually surfaced.

Insomnia SAST

84.9%

230/271

Semgrep

57.9%

157/271

SonarQube

33.2%

90/271

Bandit

14.8%

40/271

…and we win on precision too. Every finding was audited against its source: 75% of Insomnia's findings are real exploitable bugs, vs Semgrep 45.8%, Bandit 19.4%, SonarQube 7.8% — the rest is style/posture/vendored noise.

On the independent XBOW (XBEN) benchmark — 104 labelled-vulnerable challenge apps — Insomnia hits 98.9% recall on the statically-detectable subset, and 100% with the flow-sensitive --deep source→sink pass.

Download Sample Reports

Real reports from intentionally vulnerable targets. Interactive HTML with full findings, evidence, and remediation.

All App & Code Network Active Directory OSINT Forensics Audit CI/CD

HTML

App & Code

SAST — Source Code

Taint flow, 230+ secret regexes, 12-ecosystem dependency audit.

HTML

App & Code

DAST — Web App

Full crawl + 275 active modules: XSS, SQLi, SSRF, IDOR on a live target.

HTML

OSINT

OSINT — Passive Recon

Subdomains, breach data, leaked creds, GitHub leaks, social mapping.

HTML

Offensive

AI Pentest — Autonomous

AI-driven full pentest: 100+ findings, attack-path narrative, real PoCs.

HTML

Network

Service Enumeration

SMB/LDAP/Kerberos/SNMP/NFS deep enum, null-session, AS-REP candidates.

HTML

Forensics

Forensics & IR

Disk + memory triage, reconstructed timeline, evidence hashes, Volatility.

HTML

Network

Network & Ports

TCP/UDP scan, service detection, banner-grab, CVE mapping per host.

HTML

Active Directory

Active Directory Audit

Kerberoasting, DCSync, ADCS ESC1, delegation abuse, BloodHound paths.

HTML

Audit

Host Auditor

SUID/sudo rules, kernel-CVE advisor, patch matrix, privesc path suggestions.

HTML

Audit

CVE Scan

Per-CVE CVSS v3.1 breakdown, CWE + OWASP mapping, safe-check evidence.

HTML

App & Code

Mobile (APK / IPA)

Manifest perms, hardcoded secrets, SSL pinning, embedded native libs.

HTML

CI/CD

CI/CD Pipeline

7-step run: SAST + secrets + deps + DAST + container + deploy gate + Slack.

Operators on Insomnia

Anonymized quotes from active engagements. Roles preserved, employers redacted.

“

The agent replay log alone justified the license. I had to defend a finding to a client that didn’t believe it — I scrolled back through the agent’s reasoning, showed the exact request, response and tool call. Argument over.

Senior Red Teamer

Big-4 advisory practice

“

We replaced four separate tools and a custom wrapper script. The protocol enumeration panels sold it — consistent UI across SMB, LDAP, Kerberos, RPC. My juniors stopped asking which tool to run.

Practice Lead, Offensive Security

European MSSP

“

OSINT canvas is the only Maltego-style tool I’ve used where the email pipeline actually has zero false positives. 46 sites, parallel, clean output. The phone pipeline is the bonus.

Investigations Analyst

Threat-intel firm, North America

“

Send to Replacer is the feature I didn’t know I needed. Burp Repeater’s been my workflow for a decade — this is the same idea with first-class FFUF mutation. I haven’t opened Burp in three months.

Independent Bug Hunter

Top-tier HackerOne earner

“

The Smart Approval gate has saved me twice from running an exploit against the wrong host. The agent will plan and prep but it won’t pull the trigger without me.

Engagement Manager

Boutique pentest firm

“

14,905 cleaned exploits with one-click verify is a workflow I didn’t think existed. From CVE in the scan report to working PoC against the target in two clicks — the 30-minute gap is gone.

Penetration Tester

Financial sector, Asia-Pacific

Verified Public Benchmarks · 376 Live Targets

Why Insomnia Is Better: We Prove Our Numbers in Public

Other security vendors claim “industry-leading detection” on closed marketing datasheets without publishing a single raw scan report. We run Insomnia against 376 live containerized & source targets across 8 attack surfaces and publish every HTML & JSON scan report, every ground-truth proof, every missed case, and our exact ~6.0% false-positive rate.

[

Web (DAST)88.0%

Authenticated Web Trainers

117/133 cases · 9 FP (6.3%) · DVWA, Juice Shop, Mutillidae, XVWA

](https://insom.ai/benchmark/dast#cat-web)[

1-Day Exploits92.2%

267 Vulhub CVE Containers

247/268 CVEs · 8 FP (5.9%) · 120 real software products

](https://insom.ai/benchmark/dast#cat-1day)[

Network92.6%

24 Services + Metasploitable2

25/27 protocol + 34/37 M2 · SMB, LDAP, Redis, DBs, SNMP

](https://insom.ai/benchmark/dast#cat-network)[

Static (SAST)94.3%

51 Source Code Labs

264/280 classes · 7 FP (6.2%) · 18+ languages & IaC

](https://insom.ai/benchmark/dast#cat-static)[

REST API88.9%

OWASP API Top 10 Ranges

8/9 API classes · 4 FP (6.1%) · BOLA, BFLA, JWT, Mass Assign

](https://insom.ai/benchmark/dast#cat-api)[

Mobile93.0%

12 Android APK & iOS IPA Apps

53/57 MASVS classes · 5 FP (5.9%) · DEX, JNI & Mach-O

](https://insom.ai/benchmark/dast#cat-mobile)[

MCP Servers92.9%

14 AI Model Context Servers

13/14 servers · 6 FP (5.9%) · Tool poisoning & RCE

](https://insom.ai/benchmark/dast#cat-mcp)[

GraphQL91.7%

DVGA GraphQL Ground Truth

11/12 classes · 5 FP (5.8%) · Resolver SQLi/cmdi/DoS

](https://insom.ai/benchmark/dast#cat-graphql)

Head-to-Head: How Insomnia Compares to Other Scanners’ Benchmarks

Single-domain scanners only test a fraction of your attack surface and hide their raw outputs. Here is how Insomnia compares against industry scanners across published benchmarks and our 50-repo / 376-target live lab:

Scanner	Web / DAST	1-Day CVEs	Network	SAST (Source)	API / GraphQL / MCP / Mobile	Avg FP Rate	Public Raw Reports?
Insomnia (v3.4.7)	90.8%	92.2%	92.6%	94.3% (90.0% 50-repo)	88.9%–93.0% (All 4)	~6.0%	Yes — All 376 HTML & JSON ↗
Burp Suite Professional	~75.2%	~42.0%	— (None)	— (None)	Web/API only (No MCP/Mobile)	~13.8%	No public report corpus
ProjectDiscovery Nuclei	~24.5% (auth apps)	~74.0%	~51.0%	— (None)	Templates only (No Mobile/MCP)	~6.8%	No benchmark report corpus
OWASP ZAP	~58.4%	~28.0%	— (None)	— (None)	Basic API/GraphQL (No MCP/Mobile)	~21.5%	Synthetic WAVSEP table only
Tenable Nessus	~34.0%	~71.5%	~76.0%	— (None)	— (None)	~16.4%	Closed vendor claims
Semgrep (OSS / Free)	— (None)	— (None)	— (None)	57.9% (157/271)	SAST rules only	~15.2%	Published in our 50-repo test ↗
SonarQube Community	— (None)	— (None)	— (None)	33.2% (90/271)	SAST rules only	37,953 noisy issues	Published in our 50-repo test ↗

Feedback