home / mcp / kali mcp pentest server

Kali MCP Pentest Server

An MCP server to allow your AI of choice to use recon tools in Kali Linux. For White Hat purposes.

Installation

Add the following to your MCP client configuration file.

Configuration

{
  "mcpServers": {
    "andrew-stclair-kali-mcp-server": {
      "url": "http://localhost:8080/mcp"
    }
  }
}

Kali MCP Pentest Server provides a unified MCP interface to access a broad suite of penetration testing tools running in a Kali Linux environment. It exposes standardized MCP endpoints so you can orchestrate discovery, analysis, and reporting tasks from an automated assistant, IDE, or other automation platforms.

How to use

Connect your MCP client to the server using the primary MCP endpoint to request tool actions. Your client can sequence tool calls to perform discovery, web application analysis, content extraction, and intelligence gathering. Use the predefined workflow guidance to chain tools in an order that builds context and improves results. The server enforces input validation, timeouts, and a whitelist of tools to ensure safe execution.

To begin, establish a session with the MCP server at the configured endpoint, then target a host, domain, or URL with the appropriate tool names and parameters. Review tool outputs for IPs, ports, service versions, and identified assets to decide subsequent actions. For best results, follow the recommended sequencing: discovery, web analysis, content extraction, and intelligence gathering.

How to install

Prerequisites You need a system with Python 3.11+ or Docker available, plus basic networking capabilities. If you prefer containerized deployment, you can run the server with Docker Compose. If you want to run directly, you can use a Python virtual environment.

version: '3.9'
services:
  kali-mcp:
    image: kali-mcp-server:latest
    ports:
      - "8080:8080"
    cap_add:
      - NET_RAW
      - NET_ADMIN
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp
      - /var/tmp

Start the server with Docker Compose, view logs to confirm it is running, then stop the services when finished.

# Start the server (recommended)
docker compose up -d

# View logs
docker compose logs -f

# Stop the server
docker compose down

If you prefer running directly, create and activate a Python virtual environment, install dependencies, and start the server with the main entry point.

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

# Run the server
python main.py

Security features

Input is sanitized to prevent command injection and dangerous characters are blocked. The server runs as a non-root user and uses a Python virtual environment for dependency isolation. It requires specific Linux capabilities for network operations and enforces tool whitelisting with timeouts and proper error handling.

MCP integration

The server is designed to be connected to MCP clients via a StreamableHTTP transport with endpoints for the MCP protocol, server-sent events, and health status. Use the designated MCP path to issue tool calls and receive streaming results suitable for large outputs.

Available tools

nmap_scan

Network port scanning and host discovery. Scans a hostname/IP range and reports open ports, service versions, and OS details.

ping_scan

ICMP connectivity test to assess reachability, latency, and overall availability for follow-up actions.

traceroute_scan

Trace the network path to a target to reveal routing hops and topology.

arping_scan

Layer 2 host discovery using ARP to reveal MAC addresses and vendor information on the local network.

hping3_ping_scan

TCP connectivity testing through firewalls to assess reachability and firewall behavior.

hping3_port_scan

Stealthy TCP port scanning to detect open ports while minimizing visibility.

hping3_traceroute_scan

TCP-based traceroute to map network paths with firewall considerations.

dns_lookup

Comprehensive DNS record enumeration including A/AAAA/MX/NS/TXT/SRV records.

gobuster_dns_scan

High-speed subdomain enumeration to uncover additional attack surfaces.

geoip_lookup

Geolocation and ISP analysis for an IP address to map ownership and location.

nikto_scan

Web server vulnerability scanning for misconfigurations and common weaknesses.

sqlmap_scan

Automated SQL injection testing to identify vulnerable points and data exposure.

wpscan_scan

WordPress security assessment covering plugin/theme weaknesses and user enumeration.

dirb_scan

Directory and file brute-forcing to discover hidden paths and sensitive resources.

gobuster_dir_scan

Fast directory enumeration to reveal structure and backup files.

gobuster_vhost_scan

Virtual host discovery to identify hidden hosts on shared hosting.

whatweb_scan

Web technology fingerprinting to identify CMS, frameworks, and versions.

photon_scan

Intelligent web crawling and OSINT to collect URLs, emails, endpoints, and social links.

lynx_extract_links

Comprehensive link extraction to gather all hyperlinks and forms for testing.

lynx_get_content

Extracted page content suitable for analysis, including forms and messages.

searchsploit_query

Exploit database search for available exploits, PoCs, and advisories.

sherlock_scan

Username reconnaissance across social platforms and digital footprints.