tools_nmap
Execute an Nmap scan against a target.
LABSCO SUMMARY
Full session lifecycle, not just one-shot scans — SSH and reverse shells are first-class.
The split architecture is the design: the tools live on Kali, the MCP server can sit elsewhere and talk over HTTP. Beyond running nmap or sqlmap, it manages persistent SSH and reverse-shell sessions with status and cleanup, and file transfers are checksum-verified. This is offensive tooling — run it against systems you are authorized to test, in the Docker test mode while you learn it.
What it is
A two-part server — a Kali-side service holding the tools, and an MCP server that talks to it over HTTP — exposing 44 tools for scanning, exploitation and session management.
What you get
- Scanning and exploitation — tools_nmap, tools_gobuster, tools_dirb, tools_nikto, tools_sqlmap, tools_hydra, tools_wpscan, tools_enum4linux, tools_john and tools_metasploit, plus recon and web-probing tools tools_subfinder, tools_httpx, tools_nuclei, tools_arjun, tools_fierce, tools_byp4xx, tools_subzy, tools_assetfinder, tools_waybackurls and search_shodan
- SSH sessions — ssh_session_start, ssh_session_command, ssh_session_status, ssh_session_stop and ssh_sessions
- Reverse shells — reverse_shell_listener_start, reverse_shell_command, reverse_shell_status, reverse_shell_stop and reverse_shell_sessions, plus reverse_shell_send_payload and reverse_shell_generate_payload
- File transfer with SHA256 verification — kali_upload, kali_download, target_upload_file and target_download_file, plus ssh_session_upload_content, ssh_session_download_content, reverse_shell_upload_content, reverse_shell_download_content, and ssh_estimate_transfer for sizing large transfers
- command for arbitrary commands, health for status and system_network_info for the host network; a --test flag spins up a Docker environment
Requirements
The Kali-side service runs on Kali Linux and needs the penetration-testing tools installed; the MCP server can run on any system and reaches it over HTTP, so the two can be on different machines. Configure the MCP client to connect to the Kali server per install.md. The --test option manages Docker test containers with SSH on localhost:2222 and reverse-shell listeners on 4444 and 4445.
Setup effort
Build from source — git clone https://github.com/TriV3/MCP-Kali-Server.git
USE CASES
01
Enumerating a target
Run an nmap scan, then directory enumeration to map what is exposed.
02
Testing a web app for injection
Point sqlmap at the target and read the findings back.
03
Holding a shell open across steps
Start a reverse-shell listener, run commands in the session, and check its status.
04
Moving a file to or from the target with integrity
Transfer content with SHA256 verification and chunking chosen automatically by size.
05
Trying it out without a live target
Launch with --test to get a Docker environment with SSH and reverse-shell listeners.
44 tools
Listed in project code.
tools_gobuster
Execute Gobuster to find directories, DNS subdomains, or virtual hosts.
tools_dirb
Execute Dirb web content scanner.
tools_nikto
Execute Nikto web server scanner.
tools_sqlmap
Execute SQLmap SQL injection scanner.
tools_metasploit
Execute a Metasploit module.
tools_hydra
Execute Hydra password cracking tool.
tools_john
Execute John the Ripper password cracker.
tools_wpscan
Execute WPScan WordPress vulnerability scanner.
tools_enum4linux
Execute Enum4linux Windows/Samba enumeration tool.
tools_subfinder
Execute Subfinder for subdomain enumeration.
tools_httpx
Execute httpx for HTTP probing.
tools_nuclei
Execute Nuclei vulnerability scanner.
tools_arjun
Execute Arjun for parameter discovery.
tools_fierce
Execute Fierce for DNS reconnaissance.
tools_byp4xx
Execute byp4xx for 403 bypass testing.
tools_subzy
Execute Subzy for subdomain takeover detection.
tools_assetfinder
Execute Assetfinder for asset discovery.
tools_waybackurls
Execute waybackurls to fetch URLs from Wayback Machine.
search_shodan
Search Shodan's database for devices and services.
health
Check the health status of the Kali API server.
command
Execute an arbitrary command on the Kali server.
ssh_session_start
Start an interactive SSH session similar to reverse shell sessions.
ssh_session_command
Execute a command in an active SSH session.
ssh_session_status
Get the status of SSH sessions.
ssh_session_stop
Stop an SSH session.
ssh_sessions
List all active SSH sessions with their details.
ssh_session_upload_content
SSH session: upload content directly to the target with optimized handling for large files.
ssh_session_download_content
SSH session: download file content from target with optimized handling for large files.
ssh_estimate_transfer
Estimate SSH transfer time and get method recommendations for large files.
reverse_shell_listener_start
Start a reverse shell listener on the specified port.
reverse_shell_command
Execute a command in an active reverse shell session.
reverse_shell_status
Get the status of reverse shell sessions.
reverse_shell_stop
Stop a reverse shell session.
reverse_shell_sessions
List all active reverse shell sessions with their details.
reverse_shell_send_payload
Send a payload command to trigger a reverse shell connection in a non-blocking way.
kali_upload
Upload content directly to the Kali server filesystem using robust chunking.
kali_download
Download a file from the Kali server filesystem.
target_upload_file
Reverse shell: upload a file to the target using file path.
reverse_shell_upload_content
Reverse shell: upload content directly to the target.
target_download_file
Reverse shell: download a file from target to Kali server.
reverse_shell_download_content
Reverse shell: download file content from target and return as base64.
reverse_shell_generate_payload
Generate reverse shell payloads that can be manually executed on targets.
system_network_info
Get comprehensive network information for the Kali Linux system.
BEFORE YOU INSTALL
What to know first
Tools you get
44 tools registered in the project's code. The names come from the server's own source (mcp-server/mcp_server.py); the project's README lists a shorter, older set under different names, so trust what your client shows over that table.
Where it runs
All 3 documented setups run the server on your machine.
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
TERMINAL
# 1) Clone the repo (or copy the MCP server files)
git clone https://github.com/TriV3/MCP-Kali-Server.git
cd MCP-Kali-Server
# 2) Install dependencies (choose the right file for the MCP side)
pip install -r requirements.mcp.txt
# 3) (Optional) Quick manual run to verify it starts
# VS Code/Claude will usually spawn this for you based on the config block.
python <YOUR_PATH_TO_PROJECT>/mcp-server/mcp_server.py --server http://localhost:5000
# Stop with Ctrl+CMCP Clients
VS Code
VS CODE · JSON
{
"servers": {
"pentest-assistant": {
"command": "<YOUR_PATH_TO_PYTHON>",
"args": [
"<YOUR_PATH_TO_PROJECT>/mcp-server/mcp_server.py",
"--server",
"http://localhost:5000"
]
}
}
}Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"pentest-assistant": {
"command": "<YOUR_PATH_TO_PYTHON>",
"args": [
"<YOUR_PATH_TO_PROJECT>/mcp-server/mcp_server.py",
"--server",
"http://localhost:5000"
]
}
}
}VS Code — workspace
VS CODE — WORKSPACE · JSON
{
"servers": {
"pentest-assistant": {
"command": "<YOUR_PATH_TO_PYTHON>",
"args": [
"<YOUR_PATH_TO_MCP_SERVER>",
"--server",
"http://localhost:5000"
]
}
}
}
