Cobalt Strike MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Logging level (DEBUG, INFO, WARNING, ERROR) (default: INFO) | INFO |
| CS_WS_ENABLED | No | Enable WebSocket streams (default: true) | true |
| MCP_TRANSPORT | No | MCP transport protocol (http, streamable-http, sse, stdio) (default: http) | http |
| CS_API_BASE_URL | Yes | Base URL for the Cobalt Strike REST API (e.g., https://your-teamserver:50443) | |
| CS_API_PASSWORD | Yes | Cobalt Strike password (required) | |
| CS_API_USERNAME | Yes | Cobalt Strike username (required) | |
| MCP_LISTEN_HOST | No | Host interface to bind the server to (default: 127.0.0.1) | 127.0.0.1 |
| MCP_LISTEN_PORT | No | Port to bind the server to (default: 3000) | 3000 |
| MCP_OPERATOR_ID | No | Operator ID for audit logs (optional) | |
| MCP_SERVER_NAME | No | Name displayed to MCP clients (default: Cobalt Strike MCP) | Cobalt Strike MCP |
| CS_WS_AUTO_START | No | Auto-start beacons/eventlog stream subscriptions at server startup (default: true) | true |
| CS_API_VERIFY_TLS | No | Enable TLS certificate verification (default: false) | false |
| MCP_EXTERNAL_AUTH | No | Confirm non-loopback HTTP/SSE binds are protected by external auth (default: false) | false |
| MCP_AUDIT_LOG_FILE | No | Path to audit log file (default: logs/audit.log) | logs/audit.log |
| CS_API_HTTP_TIMEOUT | No | HTTP request timeout in seconds (default: 30.0) | 30.0 |
| MCP_ALLOW_REMOTE_BIND | No | Allow HTTP/SSE transports to bind non-loopback addresses (default: false) | false |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Cobalt-Strike/cobaltstrike-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server