Siemba ships MCP so teams can pentest from their AI assistant

Siemba announced general availability of Siemba MCP, a Model Context Protocol server that connects its offensive-security platform to AI assistants so teams can start scans, pull findings, and run packaged analysis skills without opening a separate console.

SOFTWARE desk — MCP is becoming the pipe that puts real security platforms inside the chat window. Pentest-from-assistant is the offensive-security version of that shift.

What the release says the product is. Siemba MCP is a Model Context Protocol server. MCP is the plug that lets an AI assistant call another system. The server ships as one plugin that contains the connector and six named skills. It connects Siemba’s security data and testing tools directly to AI assistants. Security and engineering teams can ask a plain-English question inside the AI client they already use and get finished security analysis back, without opening a separate console. A plugin, here, is that one package. A console is the separate screen they would otherwise log into. The page does not name the AI clients. Do not add one. File the connection as the company’s. This desk did not install the plugin.

How a skill is supposed to run, and the quote that goes with it. Each of the six skills is started with a simple command and runs a packaged workflow built on the platform’s test orchestration and analysis tools. Orchestration, here, means the platform lines up the checks and runs them. Kannan Udayarajan, chief executive, said you can now run pentests by chatting with your LLM. An LLM is a large language model, the software inside the assistant that reads a question and writes a reply. He said the MCP server gives the assistant the platform itself, not a summary of it. He said you name a target, and Siemba lists what is there, creates the right test suite, and starts running, all automatically. A test suite is the set of checks for that target. He said you can then use the skills for the next level of expert analysis and reporting, and that this is a different way of working than logging into a dashboard to find the same answer and then doing the analysis on spreadsheets. File the name, the title, and those sentences as the release’s. A quote is not a count of tests this desk watched start.

The first three skills, in the page’s order. Test Analysis explains a running, failed, or completed penetration test in plain language. The skill reads login screenshots to diagnose what the page calls the most common cause of a failed authenticated run: a bad credential or an unexpected multi-factor prompt. A credential is a username and password. Multi-factor means a second proof, such as a code, besides that password. Authenticated means the test was supposed to log in. Kill Chain maps individual findings into the attack paths they form. An attack path is the sequence of steps that would get an attacker from one hole to a worse one. Siemba MCP rates each chain by its weakest link rather than by raw severity, then names the single fix that breaks the most chains at once. Severity is how bad one finding looks on its own. The page says this reasoning across separate, individually low-severity findings is the skill that best shows what an assistant adds. That judgment is the company’s. Critical Briefing pulls every Critical and High finding across the estate into one executive briefing, ranked by Siemba’s risk score, with regressed findings called out separately from new ones. Critical and High are the page’s severity labels. An estate, here, is the set of systems the customer has on the platform. The page does not define regressed. Do not add a definition. The risk score is Siemba’s. This desk did not rescore a finding.

The other three skills. Remediation Plan groups findings that share a root cause into a single fix, then sequences the work list by leverage. The page defines leverage as risk removed per unit of effort. A root cause is the shared reason several findings exist. Attack Surface reviews everything an organization exposes to the internet, including domains, subdomains, certificates, TLS configuration, registrars, geographies, and monitoring coverage, and names the gaps between what is live and what is actually being watched. A domain is a web name. A subdomain is a name under it. A certificate is the document that proves a site’s identity to a browser. TLS is the lock on that connection. A registrar is the company that records who owns the name. Monitoring coverage is what the platform says it is watching. A gap, on this skill, is something live that is not being watched. CISO Report generates a board-ready posture report that leads with direction of travel, which the page lists as improving, stable, or worsening, and maps every finding to a specific control across seven compliance frameworks: ISO 27001, HIPAA, OWASP, GDPR, CMMC, NIST SP 800-53 Rev. 5, and PCI DSS v4.0. A control is one required safeguard in those rulebooks. File the six skills as the release’s. This desk did not generate a report.

How the page says each call is locked down. Every call through Siemba MCP is secured by OAuth 2.1 with PKCE, requires multi-factor authentication, uses rotating tokens, is rate-limited, and is scoped to the requesting account only. OAuth 2.1 is a login standard. PKCE, Proof Key for Code Exchange, is a check that the app that started the login is the same app that finishes it. Multi-factor authentication, shortened to MFA, is a second proof besides the password. A rotating token is a login pass that expires and is replaced. Rate-limited means too many calls are slowed or stopped. Scoped to the requesting account means the call can see only that customer’s data. If a session is compromised, the page says access is contained to one user’s permissions, on that customer’s assets only, with non-destructive actions only, for a maximum of one hour, and fully logged. A session is one signed-in stretch. Non-destructive is the page’s limit. It does not list which actions that includes. One hour is the page’s maximum. Fully logged means the page says those calls are recorded. These limits are the company’s. This desk did not inspect a log.

Who can turn it on, and what the page leaves blank. Siemba MCP is available today to customers on the Siemba platform, bundled at no additional cost. Today, on this page, is 22 Sep 2026. It is compatible with MCP-enabled AI clients. The page does not name those clients. Setup instructions and the server endpoint are at mcp.app.siemba.com/#connect. An endpoint is the address the assistant calls. No additional cost means platform customers are not charged a separate fee for this plugin, on the company’s account. It is not a price for someone who is not already a customer. The page does not print a dollar figure. Do not add one.

The about box, and where the boast stops. Siemba says it combines attack surface mapping, autonomous dynamic testing, AI-driven vulnerability assessment, and expert-led penetration testing into one continuous program. The opening line shortens the testing phrase to autonomous testing. Attack surface mapping is the list of what is exposed. Autonomous means the software runs tests without a person clicking each one. A vulnerability assessment is a review of those holes. The box says its certified in-house pentesters are trusted by the Big 4, and that every fix is revalidated automatically on the platform and expert-signed on engagements. The page says the Big 4. It does not name the firms. Do not add them. Revalidated means the platform checks the fix again. Expert-signed means a person on the engagement signs that check. An engagement is one paid test. The box says Siemba covers web, mobile, cloud, and AI systems, including large language models and AI agents. Headquarters are in Alpharetta, Georgia. The wire’s dateline is Atlanta. Alpharetta is the about-box city. Do not treat them as two headquarters. The box also says Siemba has been named a Sample Vendor in the Gartner Hype Cycle for Application Security, the Gartner Hype Cycle for Security Operations, and the Gartner Hype Cycle for XaaS, which the page spells out as Everything as a Service, in 2024, 2025, and 2026. Sample Vendor is the category name on the page. It is not a ranking this desk made. Trusted by the Big 4 is the company’s line. This desk did not confirm those firms bought Siemba MCP on 22 Sep.

Plain English for the rest of the card: MCP = Model Context Protocol, the plug that lets an assistant call Siemba. plugin = the one package with the connector and six skills. pentest = a paid break-in test. LLM = the large language model inside the assistant. skill = a packaged analysis the assistant can run with a command. Kill Chain = findings grouped into attack paths, rated by the weakest link. Critical Briefing = Critical and High findings in one briefing, ranked by Siemba’s risk score. Remediation Plan = shared root causes turned into one fix list, ordered by risk removed per unit of effort. Attack Surface = what is exposed on the internet, and what of that is not being watched. CISO Report = a board report with a direction of travel and a map onto seven rulebooks. ISO 27001 = a security-management standard. HIPAA = the U.S. health-privacy law. OWASP = the Open Worldwide Application Security Project. GDPR = the European privacy law. CMMC = a U.S. defense-contractor cybersecurity rule. NIST SP 800-53 Rev. 5 = a U.S. catalog of security controls. PCI DSS v4.0 = the card-payment security standard. OAuth 2.1 = the login standard. PKCE = the check that the same app finishes the login it started. MFA = a second proof besides the password. one hour = the page’s maximum for a compromised session. Alpharetta = the headquarters in the about box. Atlanta = the wire dateline. This filing is the 22 Sep general availability.

PRIMARY here: Siemba’s 22 Sep 2026 PR Newswire release, “Siemba Launches Siemba MCP, Connecting Its Offensive Security Platform Directly to AI Assistants,” stamped 08:00 ET and datelined Atlanta — Tier A PRIMARY, the company’s own record. The general availability, the single plugin with a connector and six named skills, the plain-English question inside an existing AI client, the no-dashboard subhead, the simple command and packaged workflow, the Udayarajan title and quote, the six skill names and what each one does, the seven frameworks, the OAuth 2.1 with PKCE line, the MFA, rotating tokens, rate limit, and account scope, the compromised-session limits of one user, that customer’s assets, non-destructive actions, one hour, and a full log, the no-additional-cost line for platform customers, the MCP-enabled clients line, the setup address, the Alpharetta headquarters, the Big 4 line, the revalidation line, the coverage of web, mobile, cloud, and AI systems, and the Sample Vendor sentences are the release’s. NOT claimed: that this desk installed the plugin, started a scan, read a login screenshot, scored a kill chain, generated a CISO report, inspected a log, named an AI client, named a Big 4 firm, treated Sample Vendor as a ranking, found a dollar price, a stock tip, or investment advice. Distinct from the already-filed lumos-mcp-governance, salt-security-aidr, and outerlimit-16m.