kali-pentest-mcp-server

SalmanFaris7/kali-pentest-mcp-server

3.2

If you are the rightful owner of kali-pentest-mcp-server and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to dayong@mcphub.com.

The Kali Pentest MCP Server is a secure platform designed for educational purposes, allowing AI assistants to perform penetration testing and vulnerability scanning on authorized targets within a controlled environment.

Tools
8
Resources
0
Prompts
0

Kali Pentest MCP Server

A Model Context Protocol (MCP) server that provides secure access to web penetration testing tools from Kali Linux for educational purposes.

Purpose

This MCP server provides a secure interface for AI assistants to perform basic penetration testing and vulnerability scanning on whitelisted targets in a controlled Docker environment.

⚠️ IMPORTANT LEGAL NOTICE

This server is for EDUCATIONAL PURPOSES ONLY. You must:

  • Only test systems you own or have explicit written permission to test
  • Comply with all applicable laws and regulations
  • Never use these tools for unauthorized access or malicious purposes
  • Understand that unauthorized penetration testing is illegal

Features

Current Implementation

  • nmap_scan - Perform network port scanning with configurable scan types
  • nikto_scan - Run web vulnerability scanner to identify common issues
  • dirb_scan - Enumerate directories and files on web servers
  • wpscan_check - Scan WordPress sites for vulnerabilities
  • sqlmap_test - Test for SQL injection vulnerabilities
  • searchsploit - Search the Exploit Database for known exploits
  • check_target_whitelist - Display currently allowed testing targets
  • quick_recon - Run combined reconnaissance using multiple tools

Prerequisites

  • Docker Desktop with MCP Toolkit enabled
  • Docker MCP CLI plugin (docker mcp command)
  • Targets you own or have permission to test

Installation

See the step-by-step instructions provided with the files.

Usage Examples

In Claude Desktop, you can ask:

  • "Scan localhost port 80 with nmap"
  • "Check my local WordPress site at localhost:8080 for vulnerabilities"
  • "Search for Apache exploits in the database"
  • "Run a quick recon on my test server at 127.0.0.1"
  • "Show me the whitelisted targets"
  • "Test localhost/login.php for SQL injection"
  • "Enumerate directories on my local web server"
  • "Run nikto scan on my test application"

Architecture