The author's own first line is that you should not use it unless you accept the exposure that comes from prompt injection, and that the project is not maintained — which is exactly the right framing for a tool that hands network scanning to a model reading untrusted text. If you do run it, scope it: name the target explicitly, keep the timing template modest, and treat every scan as something you authorised rather than something the model decided to do.
A Node MCP server that wraps NMAP's own command-line interface, so scans behave exactly as they would from a terminal, and exposes them to an AI client as a single parameterised function.
- `run_nmap_scan` — takes a target host or network and returns NMAP's output
- Three scan types: quick, full port scan, and version detection
- Port specification, either as a list or a range
- NMAP timing templates 0 through 5, defaulting to 3
- A pass-through for any additional NMAP flags you need
Windows, with NMAP installed and callable from the command line, and Node.js v18 or higher. Install `mcp-nmap-server` globally or locally, then point your client's config at the built entry point. The repository states plainly that it is not being actively worked on, and that exposing a scanner to a model carries prompt-injection risk.
One command — npm install -g mcp-nmap-server