list_exploitsLABSCO SUMMARY
A natural-language interface to a full Metasploit workflow, for authorized security testing.
The tools cover the arc of an engagement — search, exploit, session, post-exploitation, handler — so an agent can look up a module, run it against a target, and work the resulting session, with the standing caution that this is live exploitation tooling meant only for authorized environments.
What it is
A server that bridges an assistant to the Metasploit Framework, exposing its penetration-testing workflow as tools: find modules, run exploits and auxiliary and post modules, generate payloads, and manage sessions and listeners.
What you get
- list_exploits and list_payloads search exploit and payload modules, with platform and architecture filters
- run_exploit configures and runs an exploit with an optional check first; run_auxiliary_module and run_post_module run auxiliary and post-exploitation modules; generate_payload writes payload files
- Session management: list_active_sessions, send_session_command, and terminate_session
- Handler management: list_listeners, start_listener, and stop_job
Requirements
Metasploit Framework installed with its RPC service running, and Python. It exposes powerful exploitation features — use only where you have explicit authorization to test.
Setup effort
Build from source
USE CASES
01
Finding and running an exploit
list_exploits searches for a module and run_exploit configures and launches it against a target, optionally checking first.
02
Working an active session
list_active_sessions shows current sessions and send_session_command runs a command in one.
03
Setting up to receive a connection
start_listener creates a handler and list_listeners shows active handlers and jobs.
04
Running post-exploitation
run_post_module runs a post module against an existing session, for example enumerating logged-on users.
12 tools
Listed in project docs. Your client may show a different list.
list_payloadsrun_exploitrun_auxiliary_modulerun_post_modulegenerate_payloadlist_active_sessionssend_session_commandterminate_sessionlist_listenersstart_listenerstop_jobBEFORE YOU INSTALL
What to know first
Tools you get
12 tools named in the project's documentation.
Requires
- Python 3.10 or later
- MSF_PASSWORD in your environment
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
TERMINAL
git clone https://github.com/GH05TCREW/MetasploitMCP
cd MetasploitMCP
pip install -r requirements.txt
msfrpcd -P yourpassword -S -a 127.0.0.1 -p 55553MCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"metasploit": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_METASPLOIT_MCP>",
"run",
"MetasploitMCP.py",
"--transport",
"stdio"
],
"env": {
"MSF_PASSWORD": "<YOUR_MSF_PASSWORD>"
}
}
}
}Start the Metasploit RPC service first (msfrpcd -P <YOUR_MSF_PASSWORD> -S -a 127.0.0.1 -p 55553). MSF_PASSWORD must be the same password you gave msfrpcd with -P. <YOUR_PATH_TO_METASPLOIT_MCP> is the full path of your clone (a normal /path on macOS or Linux).
Run as HTTP server
RUN AS HTTP SERVER · TERMINAL
python MetasploitMCP.py --transport http --host 0.0.0.0 --port 8085
