Kali

You can run a production-ready MCP server inside a Kali Linux environment, exposed over SSE for secure, controlled interaction with AI assistants. This server gives access to a comprehensive security toolset, validates commands against an allowlist, and operates with non-root permissions to reduce risk. It is designed for local deployment and testing with MCP-enabled clients.

How to use

Connect with an MCP client that supports Server-Sent Events (SSE). Use the provided connections to run security tools, fetch web content, and generate structured reports. Commands are executed in a Kali Linux environment inside the container and results are surfaced back to your client.

You can perform common tasks such as performing a quick network scan, enumerating a web application, or saving scan results for later analysis. The server ensures security by validating each command against an allowlist and by running in a non-root context.

How to install

# Prerequisites
- Docker installed on your host
- Port 8000 available for binding

# Run the MCP server container
docker run -p 8000:8000 kali-mcp-server

Configuration and usage notes

To connect an MCP client to the server, you will typically configure the client with an SSE transport and the server URL where the SSE endpoint is exposed. The server operates on port 8000 by default.

Example client connection settings (SSE): use the URL http://localhost:8000/sse and start the session to begin issuing commands.

{
  "mcpServers": {
    "kali_mcp": {
      "transport": "sse",
      "url": "http://localhost:8000/sse",
      "command": "docker run -p 8000:8000 kali-mcp-server"
    }
  }
}

Security and runtime considerations

Run the container locally and avoid exposing the server directly to the internet. Commands go through an allowlist to minimize risk, and the server operates with a non-root user inside the container.

Examples of available actions

You can perform automated vulnerability assessments, web enumeration, file analysis, and session-based workflow management using the MCP command set.

Troubleshooting

If you run into connection issues, verify port 8000 is free on your host and the container is running. Use docker ps to check the container state and ensure the SSE URL matches your client configuration.

Notes on tooling and capabilities

The server exposes an extensive set of tools for security testing, information gathering, and reporting, including network scanning, web enumeration, vulnerability scanning, and session management. See the tool listing in the CONFIGURATION section for the complete set.

Examples of common commands

/run nmap -F localhost /fetch https://example.com /resources /session_create session_name=web_app_test target=example.com /session_status /save_output content="Scan results" category=scan /create_report title="Security Assessment" findings="Vulnerabilities found"

Developer notes

Optional helper scripts and development-related commands are provided to streamline local testing and iteration.

Available tools

run

Execute security tools and commands inside the Kali Linux environment. Each command is validated against an allowlist and long-running tasks run in the background with results saved to an output file.

fetch

Fetch and analyze web content from specified URLs.

resources

List available resources and command examples to guide usage.

vulnerability_scan

Automated vulnerability assessment using multiple security tools with different scan types.

web_enumeration

Web application discovery and enumeration, including enumeration_type options.

network_discovery

Multi-stage network reconnaissance and discovery with different discovery types.

exploit_search

Search for exploits across databases using terms like CVE identifiers and software names.

save_output

Save command output to a timestamped file for evidence collection.

create_report

Generate structured reports from findings in various formats.

file_analysis

Analyze files for type, strings, hashes, metadata, and content preview.

download_file

Download files from URLs with optional filename and metadata extraction.

session_create

Create a new pentest session with metadata, targets, and automatic activation.

session_list

List all pentest sessions with metadata and status.

session_switch

Switch the active pentest session and reveal session details.

session_status

Show the current session status and summary of activity.

session_delete

Delete a session and all associated evidence with safety checks.

session_history

Show chronological history of commands and evidence for the current session.

spider_website

Comprehensive web crawling and spidering to discover site structure.

form_analysis

Analyze web forms for security testing, supporting multiple scan types.

header_analysis

Analyze HTTP headers for security information and misconfigurations.

ssl_analysis

Perform SSL/TLS security assessment using specialized tools.

subdomain_enum

Enumerate subdomains using multiple tooling options.

web_audit

Perform a comprehensive web application security audit with multiple tools.