PwnBridge
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SSH_HOST | Yes | Required. Kali machine IP or hostname. | |
| SSH_PORT | No | SSH port, default 22. | 22 |
| SSH_USER | Yes | Required. SSH username. | |
| HTTP_HOST | No | HTTP bind address, default 0.0.0.0. | 0.0.0.0 |
| HTTP_PORT | No | HTTP server port, default 3000. | 3000 |
| HTTP_API_KEY | No | API key to protect the HTTP endpoint. | |
| SSH_PASSWORD | No | SSH password (prefer key auth). | |
| AUDIT_LOG_PATH | No | Local audit log file, default ./logs/audit.log. | ./logs/audit.log |
| SSH_PASSPHRASE | No | Passphrase for encrypted private key. | |
| DAST_TIMEOUT_MS | No | DAST scan timeout (30 min), default 1800000. | 1800000 |
| KALI_REPORT_DIR | No | Report directory on Kali, default ~/kali-mcp-reports. | ~/kali-mcp-reports |
| NMAP_TIMEOUT_MS | No | nmap timeout (10 min), default 600000. | 600000 |
| SAST_TIMEOUT_MS | No | SAST scan timeout (15 min), default 900000. | 900000 |
| SQLMAP_TIMEOUT_MS | No | sqlmap timeout (15 min), default 900000. | 900000 |
| DEFAULT_TIMEOUT_MS | No | Default command timeout (5 min), default 300000. | 300000 |
| SSH_PRIVATE_KEY_PATH | No | Path to private key — ~ is expanded (Recommended over password). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| shell_execA | Execute an arbitrary shell command on the remote Kali Linux machine. WARNING: This is an escape hatch for advanced scenarios — prefer specific tools. Only use for commands not covered by dedicated tools. |
| nmap_scanB | Run an nmap port scan against a target host or network on the remote Kali machine. Use for reconnaissance: discovering open ports, running services, and OS detection. |
| nikto_scanA | Run a Nikto web server vulnerability scan against a target URL on the remote Kali machine. Detects dangerous files, outdated software, and common web server misconfigurations. |
| sqlmap_scanC | Run sqlmap SQL injection testing against a target URL on the remote Kali machine. Detects and exploits SQL injection vulnerabilities in web applications. |
| gobuster_scanB | Run Gobuster directory/file/subdomain enumeration against a target on the remote Kali machine. Discovers hidden paths, files, and virtual hosts through brute-force enumeration. |
| ffuf_fuzzB | Run ffuf web fuzzer against a target URL on the remote Kali machine. Place the keyword FUZZ anywhere in the URL, headers, or body to mark the injection point. Useful for directory discovery, parameter fuzzing, and virtual host enumeration. |
| whatweb_fingerprintB | Run WhatWeb web technology fingerprinting against a target URL on the remote Kali machine. Identifies web technologies, CMS, frameworks, server software, and plugin versions. |
| hydra_attackC | Run Hydra password brute-force/dictionary attack against a target service on the remote Kali machine. Supports SSH, FTP, HTTP, SMB, and many other protocols. |
| metasploit_execB | Execute a Metasploit Framework module non-interactively on the remote Kali machine via msfconsole. Runs a single module with provided options and exits cleanly. Only for authorized penetration testing engagements. |
| sast_scanA | Perform Static Application Security Testing (SAST) on a local code directory. Syncs code to Kali Linux via SFTP, runs Semgrep (multi-language), Bandit (Python), Gitleaks (secrets), and Graudit (language-targeted pattern matching) in parallel, then generates a versioned consolidated security report saved to the Kali machine. Uploaded source code is deleted after scanning. |
| dast_scanA | Perform Dynamic Application Security Testing (DAST) against a running web application. Runs OWASP ZAP (spider + passive/active scan) and Nuclei (CVE/template detection) in parallel on the Kali machine. Supports unauthenticated and authenticated scans (HTTP Basic, Bearer token, Cookie injection, Form-based login). Generates a versioned consolidated report saved on Kali. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Most tools have clearly distinct purposes tied to specific security tools or scan types. However, gobuster_scan and ffuf_fuzz overlap in web content/vhost enumeration, and dast_scan partially overlaps with nikto_scan and sqlmap_scan for web vulnerability detection. shell_exec is generic but explicitly framed as an escape hatch.
All tool names use consistent snake_case and follow a predictable tool/object + action pattern (e.g., nmap_scan, sqlmap_scan, hydra_attack, metasploit_exec). The differing action suffixes reflect actual function without breaking the naming convention.
Eleven tools is well-scoped for a remote Kali penetration-testing bridge. Each tool covers a meaningful stage or capability, and the set avoids being either thin or bloated.
The set covers reconnaissance, scanning, enumeration, fingerprinting, brute force, exploitation, SAST, DAST, and a generic shell escape. Minor gaps remain for dedicated post-exploitation, pivoting, credential cracking, or report retrieval, though metasploit_exec and shell_exec allow workarounds.