pentester-mcp - Elevate your AI assistants (like Claude & Cursor)

项目说明

<h1 align="center">Pentester-MCP</h1>

<p align="center">
<strong>Empower your AI assistants with the ultimate open-source penetration testing arsenal.</strong>
</p>

<p align="center">
<img alt="Tools" src="
<img alt="Python" src="
<img alt="FastMCP" src="
<img alt="Docker" src="
</p>

---

O

Pentester-MCP provides Model Context Protocol (MCP) integration for over 200+ of the most popular open-source cybersecurity and penetration testing tools.

By adding Pentester-MCP to an AI assistant (like Claude Desktop, Cursor, or specialized agents), the AI gains the autonomous ability to act as a penetration tester:

All 235 Python *_mcp.py tools were generated intelligently from cheat sheets to ensure safe execution (e.g., pre shell injection, enforcing timeouts, and handling huge terminal outputs).

The Arsenal

The tools/ directory includes MCP servers for almost every category:
* Reconnaissance: nmap, masscan, recon-ng, amass, subfinder, nuclei
* Web Exploitation: sqlmap, commix, ffuf, gobuster, dirsearch, nikto
* Acti & Network: impacket (full suite), bloodhound, responder, e
* Brute-Forcing & Password: hydra, medusa, john, hashcat, nxc
* And 200+ more co WiFi, Cloud, Kubernetes, Android, and re.

---

Installation & Usage

Because of the massi of tools, installing e on your host machine can be messy. Therefore, Pentester-MCP offers two primary ways to run: Local Execution and Docker Sandbox (Recommended).

Method A: Docker Sandbox (Recommended & Secure)

Running tools isolates the execution from your host operating system and avoids polluting your system with hundreds of dependencies.

1. Clone the repository:

2. Select your Tools (configs/*.yaml):
Open your target configuration file in the configs/ directory (e.g., example-config.yaml) and set true for any tool you wish to enable. By default, the docker-compose.yml points to example-config.yaml.

3. Build and Run the Sandbox:

*Your container is now running silently in the background.*

4. Add to your AI Client:
Open your MCP client's configuration (e.g., claude_desktop_config.json) and route the commands directly to the server.py entrypoint. See mcp-config.json for a ready-to-use snippet.

---

Method B: Local Execution (Fastest Setup)

If you already have Kali Linux, Parrot OS, or you specifically only want to use the tools already installed on your host system:

1. Clone and Setup En:

2. Add to your AI Client:
Direct the AI client to execute the specific tool using your local python en. You will need to extract the tool definitions from the configs/ directory and replace the "docker exec -i pentester-mcp /app/.venv/bin/python" arguments with your host machine's python path.

*Note: If the tool binary (e.g., nmap or gobuster) is not installed on your host system, the AI will gracefully receive a FileNotFoundError and inform you.*

---

🔧 Configuring MCP Clients (Claude, Cursor, etc.)

Unlike legacy setups requiring you to register a server per tool out of 235 options, Pentester-MCP now uses a Unified Ser.

1. Define which tools you want a by editing a configuration file in configs/ (e.g., example-config.yaml).
2. Add the single Unified Server to your Claude/Cursor configuration.

Claude Desktop Example

> WARNING: The configs use docker exec -i pentester-mcp which targets the running Docker container named pentester-mcp. Ensure the container is running via docker compose up -d before using the AI assistant.

---

Contributing & Architecture

The Python scripts in the tools/ directory are auto-generated from YAML cheat sheets to guarantee consistent API design (proper timeouts, truncating outputs to >8000 chars, no shell=True ).

If you have a request for a new tool to be added, please feel free to open an issue.

---

Disclaimer

Legal Disclaimer: This project is created strictly for educational purposes, authorized auditing, and ethical hacking. The de of Pentester-MCP assume no liability and are not responsible for any misuse or damage caused by this software. Never use these tools against en you do not own or do not ha, written permission to test.

项目信息

开发语言：Python

Star 数：55

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via the Model Context Protocol (MCP) using a secure Docker sandbox.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。