pentest-mcp/docker-compose.yml

NOT for educational use: An MCP server for Nmap and John the Ripper, for professional penetration testers. Supports stdio, HTTP, and SSE transports with OAuth 2.1 authentication.

version: '3.8'

services:
  # Default stdio service (for MCP clients that spawn subprocesses)
  pentest-mcp-stdio:
    build: 
      context: .
      dockerfile: Dockerfile
    image: pentest-mcp:latest
    container_name: pentest-mcp-stdio
    stdin_open: true
    tty: true
    volumes:
      - ./scan_logs:/app/scan_logs
      - ./temp_wordlists:/app/temp_wordlists
      - ./custom-wordlists:/app/custom-wordlists:ro
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - DEBUG=${DEBUG:-}
      - MCP_TRANSPORT=stdio
      # OAuth not typically used with stdio transport
    privileged: true
    network_mode: host
    restart: unless-stopped
    profiles:
      - stdio

  # HTTP/Streamable service (modern network transport)
  pentest-mcp-http:
    build: 
      context: .
      dockerfile: Dockerfile
    image: pentest-mcp:latest
    container_name: pentest-mcp-http
    ports:
      - "${MCP_SERVER_PORT:-8000}:8000"
    volumes:
      - ./scan_logs:/app/scan_logs
      - ./temp_wordlists:/app/temp_wordlists
      - ./custom-wordlists:/app/custom-wordlists:ro
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - DEBUG=${DEBUG:-}
      - MCP_TRANSPORT=http
      - MCP_SERVER_HOST=0.0.0.0
      - MCP_SERVER_PORT=${MCP_SERVER_PORT:-8000}
      # OAuth configuration
      - MCP_OAUTH_ENABLED=${MCP_OAUTH_ENABLED:-false}
      - MCP_OAUTH_PROVIDER_URL=${MCP_OAUTH_PROVIDER_URL:-}
      - MCP_OAUTH_CLIENT_ID=${MCP_OAUTH_CLIENT_ID:-}
      - MCP_OAUTH_CLIENT_SECRET=${MCP_OAUTH_CLIENT_SECRET:-}
      - MCP_OAUTH_SCOPES=${MCP_OAUTH_SCOPES:-read,write}
    privileged: true
    restart: unless-stopped
    profiles:
      - http

  # SSE service (legacy/backward compatibility)
  pentest-mcp-sse:
    build: 
      context: .
      dockerfile: Dockerfile
    image: pentest-mcp:latest
    container_name: pentest-mcp-sse
    ports:
      - "${MCP_SSE_PORT:-8001}:8001"
    volumes:
      - ./scan_logs:/app/scan_logs
      - ./temp_wordlists:/app/temp_wordlists
      - ./custom-wordlists:/app/custom-wordlists:ro
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - DEBUG=${DEBUG:-}
      - MCP_TRANSPORT=sse
      - MCP_SERVER_HOST=0.0.0.0
      - MCP_SERVER_PORT=${MCP_SSE_PORT:-8001}
      # OAuth configuration
      - MCP_OAUTH_ENABLED=${MCP_OAUTH_ENABLED:-false}
      - MCP_OAUTH_PROVIDER_URL=${MCP_OAUTH_PROVIDER_URL:-}
      - MCP_OAUTH_CLIENT_ID=${MCP_OAUTH_CLIENT_ID:-}
      - MCP_OAUTH_CLIENT_SECRET=${MCP_OAUTH_CLIENT_SECRET:-}
      - MCP_OAUTH_SCOPES=${MCP_OAUTH_SCOPES:-read,write}
    privileged: true
    restart: unless-stopped
    profiles:
      - sse

  # All-in-one service (can be used with any transport via env var)
  pentest-mcp:
    build: 
      context: .
      dockerfile: Dockerfile
    image: pentest-mcp:latest
    container_name: pentest-mcp
    stdin_open: true
    tty: true
    ports:
      - "${MCP_SERVER_PORT:-8000}:${MCP_SERVER_PORT:-8000}"
    volumes:
      - ./scan_logs:/app/scan_logs
      - ./temp_wordlists:/app/temp_wordlists
      - ./custom-wordlists:/app/custom-wordlists:ro
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - DEBUG=${DEBUG:-}
      - MCP_TRANSPORT=${MCP_TRANSPORT:-stdio}
      - MCP_SERVER_HOST=${MCP_SERVER_HOST:-0.0.0.0}
      - MCP_SERVER_PORT=${MCP_SERVER_PORT:-8000}
      # OAuth configuration (for HTTP/SSE transports)
      - MCP_OAUTH_ENABLED=${MCP_OAUTH_ENABLED:-false}
      - MCP_OAUTH_PROVIDER_URL=${MCP_OAUTH_PROVIDER_URL:-}
      - MCP_OAUTH_CLIENT_ID=${MCP_OAUTH_CLIENT_ID:-}
      - MCP_OAUTH_CLIENT_SECRET=${MCP_OAUTH_CLIENT_SECRET:-}
      - MCP_OAUTH_SCOPES=${MCP_OAUTH_SCOPES:-read,write}
    privileged: true
    network_mode: ${NETWORK_MODE:-bridge}
    restart: unless-stopped
    profiles:
      - default