PentestCompare
Read-only remote MCP server. Search pentestcompare.com guides and query sourced data on 66 penetration testing providers. Excession Labs publishes it and is one of the rows.
Hosted MCP Server
npx add-mcp 'https://pentestcompare.com/mcp'Installs into Claude Code, Codex, Cursor and more
Documentation
Developers and AI agents
Source: https://pentestcompare.com/developers/ Publisher: Excession Labs (pentestcompare.com) Last updated: 2026-11-09
Machine-readable access to pentestcompare.com: OpenAPI description, API catalog, Markdown versions of every page, llms.txt and the rules for AI agents.
Everything on pentestcompare.com is public and readable by software. Reading needs no account and no key.
| What | Where |
|---|---|
| API description (OpenAPI 3.1) | /openapi.json |
| API catalog (RFC 9727) | /.well-known/api-catalog |
| Rules for AI agents | /auth.md |
| Site index for language models | /llms.txt, full text in /llms-full.txt |
| Markdown version of any page | add index.md to the page URL, or send Accept: text/markdown |
| Sitemap and feed | /sitemap.xml, /feed.xml |
| Service status | /api/health |
Provider dataset
GET /data/providers.json returns every provider in the comparison with its scope, delivery model, published prices and their units, turnaround and retest claims, sample report status, credentials with evidence links, sources and the date each provider was checked. GET /data/providers.csv returns the main fields as CSV. Both are free to use under MIT: credit PentestCompare and link to the provider's profile. Unknown values are Not published, never zero or an estimate. How we collect and check the data.
The dataset is also published as a versioned repository with a data dictionary and CSV files for providers, prices and sources: github.com/Excession-Labs/pentest-provider-dataset.
curl -s https://pentestcompare.com/data/providers.json | jq '.providers[] | {name, delivery, pricing_model}'
Sending an enquiry
POST /api/enquiry stores an enquiry and notifies Excession Labs. It needs a Cloudflare Turnstile token, which only a person completing the form on the site can produce. An agent helping someone get in touch should give them the form or the address support@excessionlabs.ai. The field list for each form is in the OpenAPI description.
Fair use
Read and cite freely. Keep request rates reasonable; the enquiry endpoint is rate limited. Do not try to bypass the human verification. Questions: support@excessionlabs.ai.