Home / MCP / Awsome Kali MCP Server
Provides MCP servers for Kali Linux to streamline reverse engineering, security testing, and automation workflows.
Configuration
View docs{
"mcpServers": {
"kali_docker": {
"command": "docker",
"args": [
"run",
"-i",
"kali-mcps:latest"
]
}
}
}Awsome Kali MCP Server provides a set of Model Context Protocol (MCP) endpoints and tooling designed to run inside a Kali Linux workflow. It enables you to launch and orchestrate security-focused analysis tools in containers, perform network and binary analysis, and automate repetitive security tasks from a local MCP client.
You connect to the Kali MCP Server from your MCP client and run the provided tools to perform security analysis and automation tasks. The setup centers on a local Docker-based server you run in a Kali context. After you start the server, you can execute tools such as basic network scans, disassembly, string extraction, and live network capture through the MCP client interface. Typical usage patterns include starting the Kali MCP container, selecting the kali-docker server, and invoking the available endpoints like basic_scan, disassemble, and capture_live.
Prerequisites: ensure you have Docker installed on your system. You will build and run a Docker image that hosts the MCP servers.
Step 1: Build the Docker image for the MCP server.
Step 2: Configure your MCP client with the following server entry to run the container interactively.
{
"mcpServers": {
"kali-docker": {
"command": "docker",
"args": ["run", "-i", "kali-mcps:latest"]
}
}
}The server exposes a collection of tools organized by function, including network scanning, symbol analysis, binary analysis, string extraction, and network traffic analysis. A sandbox feature is available to run commands in isolated containers with configurable resource limits and automatic cleanup.
Network Scanning (Nmap): basic_scan, intense_scan, stealth_scan, quick_scan, vulnerability_scan.
Symbol Analysis (nm): basic_symbols, dynamic_symbols, demangle_symbols, numeric_sort, size_sort, undefined_symbols.
Binary Analysis (objdump): file_headers, disassemble, symbol_table, section_headers, full_contents.
String Extraction (strings): basic_strings, min_length_strings, offset_strings, encoding_strings.
Network Traffic Analysis (Wireshark/tshark): capture_live, analyze_pcap, extract_http, protocol_hierarchy, conversation_statistics, expert_info.
Sandbox Support (Docker): runs commands in isolated containers with a default ubuntu-systemd:22.04 image, configurable memory and CPU limits, network mode, timeout, bidirectional file copying, and automatic cleanup.
The project is in an early stage. You’ll find baseline server configurations and tool integrations expanding over time. When you start exploring, verify container resources and access controls to avoid unintended effects in your environment.
If a container fails to start, check Docker daemon status and ensure the kali-mcps:latest image builds successfully. Verify that your MCP client is correctly configured to point at the kali-docker server name and that the CLI tools are available within the container.
Isolated sandbox execution is available to reduce risk when running potentially harmful analyses. Use the sandbox feature to confine commands within a dedicated container with controlled resources and automatic cleanup after execution.
Performs a basic network scan to identify live hosts and open ports.
Conducts a more comprehensive network scan with deeper probing of hosts and services.
Scans while attempting to minimize noise and avoid detection.
Provides a fast overview of the network with a lightweight probe set.
Checks for common vulnerabilities across scanned hosts.
Lists basic symbols present in a binary.
Lists dynamic symbols loaded by the binary at runtime.
Converts mangled symbol names into human-readable form.
Sorts symbols by numeric value.
Sorts symbols by size.
Lists symbols that are undefined by the linker.
Displays the headers of the target binary.
Disassembles the target binary to show machine instructions.
Shows the symbol table within the binary.
Displays section headers of the binary.
Prints the full contents of the binary.
Extracts basic ASCII/Unicode strings from a binary.
Extracts strings that meet a minimum length requirement.
Extracts strings with address offsets.
Extracts strings based on specific encodings.
Captures real-time network traffic for analysis.
Analyzes pcap files to extract meaningful statistics.
Extracts HTTP data from captured traffic.
Shows the protocol hierarchy in captured traffic.
Provides statistics about conversations in captured traffic.
Analyzes expert information from network captures.