AWS Builder Center

Builder Center

Building an AI Penetration Testing Platform with MCP and Amazon Bedrock

Building an AI Penetration Testing Platform with MCP and Amazon Bedrock

Learn how to autonomously orchestrate 65 offensive security tools using the Model Context Protocol (MCP) and Claude on Amazon Bedrock. This tutorial covers the architecture, FastMCP server setup, and AWS deployment with ECS, DynamoDB, and VPC Endpoints to keep AI traffic private.

Daniel Morales

DevSecOps
As a security engineer, I see the Red team spends months stitching tools together for every engagement. Nmap, Nuclei, SQLMap, Subfinder, and Burp each need configuration, isolated environments, and careful orchestration. A standard VAPT takes 5–10 days, and most of that time isn't spent finding vulnerabilities; it's spent setting up infrastructure, configuring tools, and writing reports.
Red team infrastructure typically sits exposed on the public internet. You're running offensive tools from boxes that anyone can scan. The irony isn't lost on me: the people testing security are often running the least secure setups.
I wanted to fix this. The result is  ModTester  an open-source platform that compresses full assessments from weeks into hours using AI and zero-trust infrastructure on AWS.
This article is based on a talk I presented at AWS Summit DC in 2026. You can view the  full presentation here .
ModTester flips the model. Instead of manually running tools one by one, you describe what to test in natural language. The AI handles the rest:
  • Natural language — Describe the engagement, not the commands
  • Autonomous chaining — From reconnaissance to report, no manual intervention
  • Zero-trust infrastructure — Invisible to the internet, VPN-only access

How MCP Connects AI to Security Tools

 Model Context Protocol (MCP)  is the layer that makes this work. It's an open standard that lets AI models discover and invoke external tools in a structured way. Here's the flow:
  1. User types prompt — "Pentest this target"
  1. LLM picks a tool — Reasons over 65 tool descriptions
  1. MCP runs the tool — Subprocess call, captures output
  1. Result streams back to LLM — Model analyzes output
  1. LLM decides next step — Pivot, verify, or escalate
  1. Report generated — Findings with evidence and compliance mappings
The AI picks tools by description, not by hardcoded order. One MCP server orchestrates the full kill chain. No retraining, no fine-tuning, no glue code.

Architecture: Zero-Trust by Default

Security Engineer
    ↓ (Softether Client VPN / TLS)
ECS on EC2 (Isolated VPC — No Public Endpoints)
    ├── MCP Server → 65+ tools, knowledge layer, playbooks
    ├── Amazon Bedrock (Claude) → Tool calling via IAM Task Role
    ├── DynamoDB → Assessments, findings, chat history
    └── S3 → Evidence artifacts (KMS encrypted)
    ↓
Target Systems (apps, APIs)
Key security decisions:
  • No public endpoints — Everything runs inside a private VPC
  • VPN-only access — Softether L2TP/IPsec for operator connectivity
  • Bedrock VPC Endpoint — AI traffic never leaves the VPC
  • IAM Task Role — No AWS keys in containers, least-privilege access
  • KMS encryption — All data at rest encrypted with customer-managed keys
  • CloudWatch audit trail — Every tool execution is logged

Knowledge Layer: Standards-Based Testing

The AI doesn't just run tools randomly. It tests against published methodologies and maps every finding to the frameworks your auditors care about:
  • OWASP ASVS 4.0 — 286 verification requirements
  • PTES — 7-phase penetration testing methodology
  • NIST 800-53, PCI-DSS, CIS Benchmarks
  • STRIDE/DREAD/LINDDUN/PASTA — Threat modeling included
Output is audit-ready: CWE IDs, CVSS scores, OWASP mappings, and remediation guidance all generated automatically.

Extensibility: Add a Tool in Minutes

One Python function plus one registry entry. The AI uses it immediately:
def my_scanner(target: str) -> str:
    """Run my-scanner against a target."""
    cmd = f"my-scanner {shlex.quote(target)}"
    result = subprocess.run(cmd, shell=True,
        capture_output=True, timeout=300)
    return result.stdout.strip() or "No results"

# Register in tools/__init__.py
TOOL_REGISTRY["my_scanner"] = {
    "fn": my_scanner,
    "category": "vulnerability",
    "description": "Scans for XYZ",
}
No retraining, no fine-tuning. The model reads the description and decides when to use it.

Deploy in Minutes

Local development for iteration, AWS for production. Both use the same container image.
Local:
cp .env.example .env
docker compose up -d
AWS (fully automated):
./AWS/deploy.sh
The deploy script is interactive; it prompts for configuration with sensible defaults. Three CloudFormation stacks give you granular control: Backend, UI, and VPN.

What You Get

Capability
Detail
Full kill chain
Recon to report in one chain
Natural-language VAPT
Describe, don't configure
Zero-trust by default
VPN-only, VPC-isolated
Standards-mapped
Audit-ready output (CWE, CVSS, OWASP)
Open and extensible
Add tools in minutes
Hours, not weeks
Compress the assessment cycle

Get Started

The project is open-source under Apache 2.0:
🔗  https://github.com/tweag/modtester 


Conclusion

MCP enables AI models to access real security tools in a structured, auditable way. Combined with Amazon Bedrock's managed inference and AWS infrastructure for isolation and encryption, you get an AI penetration tester that follows real methodologies and produces compliance-ready reports.
The full source code is available on GitHub under the Apache 2.0 license.

Built by AWS San Antonio Community and  Modus Create  for the community.
# ai-security# cybersecurity# cloud-security# security# security-and-compliance
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article