Happy slice of mcp pizzaMCP.pizza

MCP-Kali-Server

MCP.Pizza Chef: Wh0am123

Security testers point this at a Kali machine so an assistant can run the usual toolkit — Nmap, sqlmap, Nikto, Hydra, John the Ripper, WPScan and plain terminal commands — and read the results back. It is built for capture-the-flag practice and authorised penetration testing, and the authors are explicit that misuse is on you. Running it means installing a small program on the Kali box and, ideally, tunnelling to it over SSH rather than exposing it to the network.

Coding
Other

Use This MCP server To

Scan a machine I own and explain what is open Work through a capture-the-flag challenge step by step Run a website check and summarize the findings Look for weak passwords on my own test server Let the assistant pick the right tool for a scan

README

MCP Kali Server

MCP Kali Server (MKS) is a lightweight API bridge that connects MCP clients (e.g: Claude Desktop or 5ire) to the API server which allows executing commands on a Linux terminal.

This MCP is able to run terminal commands as well as interacting with web applications using:

  • Dirb
  • enum4linux
  • gobuster
  • Hydra
  • John the Ripper
  • Metasploit-Framework
  • Nikto
  • Nmap
  • sqlmap
  • WPScan
  • As well as being able to execute raw commands.

As a result, this is able to perform AI-assisted penetration testing and solving CTF challenges in real time.

Articles Using This Tool

How MCP is Revolutionizing Offensive Security

👉 How MCP is Revolutionizing Offensive Security

🔍 Use Case

The goal is to enable AI-driven offensive security testing by:

  • Letting the MCP interact with AI endpoints like OpenAI, Claude, DeepSeek, Ollama or any other models.
  • Exposing an API to execute commands on a Kali machine.
  • Using AI to suggest and run terminal commands to solve CTF challenges or automate recon/exploitation tasks.
  • Allowing MCP apps to send custom requests (e.g. curl, nmap, ffuf, etc.) and receive structured outputs.

Here are some example (using Google's AI gemini 2.0 flash):

Example solving a web CTF challenge from RamadanCTF

MCP-Kali-Server FAQ

Which apps does it work in?
Claude Desktop is documented, and the 5ire desktop app is supported too. Any MCP-capable client should be able to connect.
Do I need a Kali Linux machine?
Yes. The tools it drives live on Kali, though another Linux box with the same tools installed will also work.
Is a paid key needed?
No key. You do have to start the small server program on the Kali machine and point your client at it.
Can I use this to test my own website for weaknesses?
Yes, that is the intended use, provided you own the site or hold written permission to test it.
Is it safe to leave running?
Treat it carefully. It can run any terminal command, so bind it to your own machine and reach it through an SSH tunnel.
How hard is setup?
Expect command line work: a package install or a code checkout, a Python environment, and an edit to your client's settings file.