kali-mcp by k3nn3dy-ai - MCP Server

🛡️ Kali MCP Server

A production-ready MCP (Model Context Protocol) server running in a Kali Linux Docker container, providing AI assistants with access to a comprehensive security toolset.

📋 Overview

This project provides a Docker containerized MCP server that runs on Kali Linux, giving AI assistants (like Claude) access to a full suite of security and penetration testing tools. The server communicates via Server-Sent Events (SSE) and allows AI to execute commands in a controlled environment with appropriate security measures.

✨ Features

🔒 Security Tools Access: Full access to Kali Linux security toolset through a controlled interface
🛡️ Command Validation: Commands are validated against an allowlist for security
🌐 Web Content Fetching: Retrieve and analyze web content
📊 Resource Information: Comprehensive system resource details and command examples
👤 Security Focus: Running as non-root user with appropriate permissions

🔧 Pre-installed Security Tools

🔍 Network Scanning: nmap, netcat
🕸️ Web Application Testing: nikto, gobuster, dirb
🧪 Penetration Testing: metasploit-framework
🔑 Credential Testing: hydra
💉 Data Extraction: sqlmap
ℹ️ Information Gathering: whois, dig, host

🚀 Quick Start

🐳 Building and Running the Container

# Quick start with the helper script
./run_docker.sh

# Or manually:
# Build the Docker image
docker build -t kali-mcp-server .

# Run with default settings (SSE mode on port 8000)
docker run -p 8000:8000 kali-mcp-server

🔌 Connecting to Claude Desktop

Edit your Claude Desktop config file:

Location: ~/Library/Application Support/Claude/claude_desktop_config.json

Add this configuration:

{
  "mcpServers": {
    "kali-mcp-server": {
      "transport": "sse",
      "url": "http://localhost:8000/sse",
      "command": "docker run -p 8000:8000 kali-mcp-server"
    }
  }
}

Restart Claude Desktop
Test the connection with a simple command:
```
/run nmap -F localhost
```

🛠️ Available MCP Tools

The server provides several tools through the MCP protocol:

💻 `run` - Execute Commands

Run security tools and commands in the Kali Linux environment.

/run nmap -F localhost

Commands are validated against an allowlist for security. Long-running commands will be executed in the background with results saved to an output file.

🌐 `fetch` - Retrieve Web Content

Fetch and analyze web content from specified URLs.

/fetch https://example.com

📈 `resources` - List Available Resources

Get information about the system and available commands. (The AI can use these resources to run the commands on you behalf using Natural Language.)

/resources

🚀 `vulnerability_scan` - Automated Vulnerability Assessment

Perform automated vulnerability assessment with multiple tools.

/vulnerability_scan target=127.0.0.1 scan_type=quick
/vulnerability_scan target=example.com scan_type=comprehensive

Scan Types:

quick: Fast scan with nmap and nikto
comprehensive: Full scan with multiple tools
web: Web-focused vulnerability assessment
network: Network-focused vulnerability assessment

🌐 `web_enumeration` - Web Application Discovery

Perform comprehensive web application discovery and enumeration.

/web_enumeration target=http://example.com enumeration_type=full
/web_enumeration target=example.com enumeration_type=aggressive

Enumeration Types:

basic: Basic web enumeration with nikto and gobuster
full: Comprehensive enumeration including vhost discovery
aggressive: Aggressive enumeration with SQL injection testing

🔍 `network_discovery` - Network Reconnaissance

Perform multi-stage network reconnaissance and discovery.

/network_discovery target=192.168.1.0/24 discovery_type=comprehensive
/network_discovery target=example.com discovery_type=stealth

Discovery Types:

quick: Quick network discovery
comprehensive: Comprehensive network mapping
stealth: Stealthy network reconnaissance

🔍 `exploit_search` - Exploit Database Search

Search for exploits using searchsploit and other exploit databases.

/exploit_search search_term=apache search_type=web
/exploit_search search_term=CVE-2021-44228 search_type=all

Search Types:

all: Search all exploit types
web: Web application exploits
remote: Remote exploits
local: Local exploits
dos: Denial of service exploits

💾 `save_output` - Save Content to File

Save content to a timestamped file for evidence collection.

/save_output content="Scan results here" filename=my_scan category=scan
/save_output content="Enumeration data" category=enum

Categories:

general: General content (default)
scan: Vulnerability scan results
enum: Enumeration results
evidence: Evidence collection

📋 `create_report` - Generate Structured Reports

Generate a structured report from findings.

/create_report title="Security Assessment Report" findings="Vulnerabilities found..." report_type=markdown
/create_report title="Network Scan Results" findings="Open ports..." report_type=json

Report Types:

markdown: Markdown format (default)
text: Plain text format
json: JSON format

🔍 `file_analysis` - Analyze Files

Analyze a file using various tools (file type, strings, hash).

/file_analysis filepath=./suspicious_file
/file_analysis filepath=/path/to/downloaded/file

Analysis includes:

File type detection
String extraction
SHA256 hash
File metadata
Content preview

📥 `download_file` - Download Files

Download a file from a URL and save it locally.

/download_file url=https://example.com/file.txt filename=downloaded_file
/download_file url=https://example.com/script.sh

Features:

Automatic filename extraction from URL
SHA256 hash generation
Content-type detection
Safe filename sanitization

🗂️ `session_create` - Create New Session

Create a new pentest session with name, description, and target.

/session_create session_name="web_app_test" description="Web application security assessment" target="example.com"
/session_create session_name="network_scan" target="192.168.1.0/24"

Features:

Session metadata storage
Automatic session activation
Organized file structure

📋 `session_list` - List Sessions

List all pentest sessions with metadata and status.

/session_list

Shows:

All available sessions
Active session indicator
Session descriptions and targets
Creation dates and history counts

🔄 `session_switch` - Switch Sessions

Switch to a different pentest session.

/session_switch session_name="web_app_test"

Features:

Validates session existence
Updates active session
Shows session details after switch

📊 `session_status` - Session Status

Show current session status and summary.

/session_status

Shows:

Active session details
Session metadata
File count and history
Recent activity

🗑️ `session_delete` - Delete Session

Delete a pentest session and all its evidence.

/session_delete session_name="old_session"

Safety Features:

Cannot delete active session
Confirms deletion with session details
Removes all session files and evidence

📜 `session_history` - Session History

Show command/evidence history for the current session.

/session_history

Shows:

Chronological history of activities
Action types and timestamps
Session-specific evidence tracking

Enhanced Web Application Testing Tools

🕷️ Spider Website

Comprehensive web crawling and spidering using gospider.

/spider_website url=https://example.com depth=2 threads=10

Parameters:

url (required): Target URL to spider
depth (optional): Crawling depth (default: 2)
threads (optional): Number of concurrent threads (default: 10)

📝 Form Analysis

Discover and analyze web forms for security testing.

/form_analysis url=https://example.com scan_type=comprehensive

Parameters:

url (required): Target URL to analyze
scan_type (optional): Type of analysis - "basic", "comprehensive", "aggressive" (default: "comprehensive")

📋 Header Analysis

Analyze HTTP headers for security information and misconfigurations.

/header_analysis url=https://example.com include_security=true

Parameters:

url (required): Target URL to analyze
include_security (optional): Include security header analysis (default: true)

🔐 SSL Analysis

Perform SSL/TLS security assessment using testssl.sh.

/ssl_analysis url=example.com port=443

Parameters:

url (required): Target URL to analyze
port (optional): SSL port (default: 443)

🔍 Subdomain Enumeration

Perform subdomain enumeration using multiple tools (subfinder, amass, waybackurls).

/subdomain_enum url=example.com enum_type=comprehensive

Parameters:

url (required): Target domain to enumerate
enum_type (optional): Type of enumeration - "basic", "comprehensive", "aggressive" (default: "comprehensive")

🔍 Web Audit

Perform comprehensive web application security audit.

/web_audit url=https://example.com audit_type=comprehensive

Parameters:

url (required): Target URL to audit
audit_type (optional): Type of audit - "basic", "comprehensive", "aggressive" (default: "comprehensive")

Tools Used in Web Audit:

Nikto (web vulnerability scanner)
Gobuster (directory/vhost enumeration)
SQLMap (SQL injection testing)
Dirb (directory enumeration)
TestSSL.sh (SSL/TLS analysis)
Curl (header analysis)

Session Management Tools

⚠️ Troubleshooting

🔌 Connection Issues

Ensure port 8000 is available on your machine
Check that the Docker container is running: docker ps
Verify the URL in Claude Desktop configuration matches the container's port

⚙️ Command Execution Problems

If commands timeout, try running them in the background: command > output.txt &
Use /resources to see examples of properly formatted commands
For permission errors, ensure you're not trying to access protected system areas

🔒 Security Considerations

This container provides access to powerful security tools. Please observe the following:

Use responsibly and only in controlled environments
The container is designed to be run locally and should not be exposed to the internet
Commands are validated against an allowlist for security
The server runs as a non-root user inside the container
Only use this tool for legitimate security testing with proper authorization

📋 Requirements

Docker
Claude Desktop or other SSE enabled MCP clients
Port 8000 available on your host machine

👨‍💻 Development

🛠️ Setting Up a Development Environment

# Clone the repository
git clone https://github.com/yourusername/kali-mcp-server.git
cd kali-mcp-server

# Create a virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Install development dependencies
pip install -e ".[dev]"

🧪 Running Tests

# Run tests with the helper script
./run_tests.sh

# Or manually:
# Run all tests
pytest

# Run with coverage
pytest --cov=kali_mcp_server

🙏 Acknowledgements

Kali Linux for their security-focused distribution
Anthropic for Claude and the MCP protocol
The open-source security tools community

_{Built for security professionals and AI assistants}

k3nn3dy-ai/kali-mcp

🛡️ Kali MCP Server

📋 Overview

✨ Features

🔧 Pre-installed Security Tools

🚀 Quick Start

🐳 Building and Running the Container

🔌 Connecting to Claude Desktop

🛠️ Available MCP Tools

💻 run - Execute Commands

🌐 fetch - Retrieve Web Content

📈 resources - List Available Resources

🚀 vulnerability_scan - Automated Vulnerability Assessment

🌐 web_enumeration - Web Application Discovery

🔍 network_discovery - Network Reconnaissance

🔍 exploit_search - Exploit Database Search

💾 save_output - Save Content to File

📋 create_report - Generate Structured Reports

🔍 file_analysis - Analyze Files

📥 download_file - Download Files

🗂️ session_create - Create New Session

📋 session_list - List Sessions

🔄 session_switch - Switch Sessions

📊 session_status - Session Status

🗑️ session_delete - Delete Session

📜 session_history - Session History

Enhanced Web Application Testing Tools

🕷️ Spider Website

📝 Form Analysis

📋 Header Analysis

🔐 SSL Analysis

🔍 Subdomain Enumeration

🔍 Web Audit

Session Management Tools

⚠️ Troubleshooting

🔌 Connection Issues

⚙️ Command Execution Problems

🔒 Security Considerations

📋 Requirements

👨‍💻 Development

🛠️ Setting Up a Development Environment

🧪 Running Tests

🙏 Acknowledgements

💻 `run` - Execute Commands

🌐 `fetch` - Retrieve Web Content

📈 `resources` - List Available Resources

🚀 `vulnerability_scan` - Automated Vulnerability Assessment

🌐 `web_enumeration` - Web Application Discovery

🔍 `network_discovery` - Network Reconnaissance

🔍 `exploit_search` - Exploit Database Search

💾 `save_output` - Save Content to File

📋 `create_report` - Generate Structured Reports

🔍 `file_analysis` - Analyze Files

📥 `download_file` - Download Files

🗂️ `session_create` - Create New Session

📋 `session_list` - List Sessions

🔄 `session_switch` - Switch Sessions

📊 `session_status` - Session Status

🗑️ `session_delete` - Delete Session

📜 `session_history` - Session History