Ping scan to discover live hosts (-sn). Fast, no port scan. targets: IPs, ranges, or CIDR (e.g. '192.168.1.0/24', '10.0.0.1-10')

Port scan returning job_id (async by default) or blocking until complete. targets: IPs/ranges/hostnames (space-separated for multiple) ports: '1-65535', '22,80,443', or 'top100' scan_type: 'auto' (sS if root else sT), 'sS' (SYN/root only), 'sT' (TCP connect), 'sU' (UDP), 'sA' (ACK) timing: T0-T5 (T4=fast, T3=normal, T2=polite) wait: if True, blocks until scan completes and returns full output

Detect service versions on open ports (-sV). version_intensity: 0 (light) to 9 (try all probes)

OS detection scan (-O). Automatically uses sudo if not root. targets: IPs/ranges/hostnames

NSE vulnerability script scan. scripts: NSE script categories — 'vuln', 'safe', 'vuln and safe', 'exploit', or specific scripts like 'smb-vuln-ms17-010'

Aggressive scan (-A): OS + version + default scripts + traceroute. targets: IPs/ranges/hostnames

Port scan with XML output — returns fully structured host/port/service data. Unlike nmap_port_scan (raw text), this parses XML into structured dicts so findings, services, and OS guesses are immediately usable without regex. targets: IPs/ranges/hostnames (space-separated) ports: '1-65535', '22,80,443', or 'top100' scan_type: 'auto' (sS if root else sT), 'sS', 'sT' timing: T0-T5 service_detection: include -sV service version probing (default True) Returns: structured dict with hosts[], each containing ports[], services, os[]

WHOIS lookup for a domain or IP address. target: domain (e.g. 'example.com') or IP address

DNS lookup using dig. domain: target domain (e.g. 'example.com') record_type: A, AAAA, MX, NS, TXT, CNAME, SOA, ANY dns_server: optional DNS server to query (e.g. '8.8.8.8') short: return short output only

Attempt DNS zone transfer (AXFR). domain: target domain nameserver: nameserver to request transfer from

Passive subdomain enumeration using subfinder. domain: target domain (e.g. 'example.com') all_sources: use all available sources (slower but thorough) threads: concurrent goroutines for resolving (default 10) output_json: return JSONL output for structured parsing

OSINT gathering using theHarvester (emails, subdomains, IPs, URLs). domain: target domain or company name source: comma-separated data sources. Defaults to sources that work without API keys. Full list: google, bing, linkedin, github, dnsdumpster, crtsh, hackertarget, otx, rapiddns, shodan (needs key), sublist3r, threatminer, urlscan, duckduckgo Use 'all' only if you have API keys configured. limit: max search results (default 500) dns_resolve: perform DNS resolution on discovered subdomains

In-depth subdomain enumeration using OWASP Amass. domain: target domain (e.g. 'example.com') passive: passive-only mode (no active probing) — safer, faster brute_force: enable brute-force subdomain discovery (slow) timeout_mins: max runtime in minutes (default 5)

Web server vulnerability scan using Nikto. target: host or URL (e.g. 'example.com' or 'http://example.com') port: target port (default 80; use 443 with ssl=True) ssl: force SSL/HTTPS max_time: nikto's internal max scan time e.g. '10m', '20m', '1h' timeout: server-side timeout in seconds (default 600 = 10 min)

Directory and file brute-force using Gobuster. url: target URL (e.g. 'http://example.com') wordlist: path to wordlist (auto-selects common.txt from dirb/seclists if empty) extensions: file extensions to search e.g. 'php,html,txt' threads: concurrent threads (default 10) exclude_codes: HTTP codes to hide (default '404'), use '' to show all follow_redirect: follow 3xx redirects

DNS subdomain brute-force using Gobuster. domain: target domain (e.g. 'example.com') wordlist: path to wordlist (auto-selects subdomains list from seclists if empty) show_ips: show IP addresses of found subdomains

Virtual host discovery using Gobuster. url: base URL (e.g. 'http://example.com') wordlist: path to wordlist (auto-selects if empty) append_domain: append base domain to each vhost word

Full SMB/NetBIOS enumeration using enum4linux (-a covers all). Enumerates: users, shares, groups, password policy, OS info, printers. target: IP address of Windows/Samba host username: optional username for authenticated scan password: optional password for authenticated scan

List SMB shares on a target host using smbclient. target: IP or hostname username: SMB username (leave empty for anonymous) password: SMB password (leave empty for anonymous) port: SMB port (default 445)

Fast web fuzzer using ffuf. Place FUZZ keyword in URL, headers, or POST data. url: target URL with FUZZ keyword (e.g. 'http://example.com/FUZZ') wordlist: path to wordlist (auto-selects common.txt if empty) keyword: fuzzing placeholder (default FUZZ) match_codes: show responses matching these HTTP codes filter_codes: hide responses with these HTTP codes threads: concurrent threads (default 40) data: POST data — setting this switches to POST automatically method: HTTP method GET/POST/PUT/DELETE/PATCH headers: extra header e.g. 'Authorization: Bearer ' auto_calibrate: auto-filter similar responses to reduce noise (-ac)

Fast port scan using masscan (discovery) + nmap (service detection). Much faster than nmap alone for large ranges — masscan at 5000 pps finds all open ports, then nmap does targeted -sV only on those ports. target: IP, CIDR range (e.g. '192.168.1.0/24'), or hostname ports: port range (default all ports '0-65535') rate: masscan packets per second — higher = faster but more noisy (default 5000) Use 1000 for stealth, 10000+ for speed on local networks service_detection: run nmap -sV on discovered ports (default True) Returns: open ports with services, much faster than full nmap scan NOTE: masscan requires root/sudo for raw sockets

Search Exploit-DB local database using searchsploit. query: search terms (e.g. 'apache 2.4', 'wordpress 5.0', 'ssh') exact: exact & order match on title (stricter) title_only: search only exploit titles cve: search by CVE ID (e.g. '2021-44228') — overrides query exclude: exclude results matching this pattern (pipe-separated: 'dos|PoC') Returns results immediately (local DB search).

Get the full filesystem path to an exploit by its EDB-ID. edb_id: Exploit-DB ID number (e.g. '39446')

Vulnerability scanning using Nuclei templates. target: URL or IP to scan (e.g. 'http://example.com') templates: comma-separated template paths or categories e.g. 'cves/', 'vulnerabilities/', 'cves/2021/CVE-2021-44228.yaml' severity: filter by severity — info,low,medium,high,critical (comma-separated) tags: filter by tags e.g. 'cve,rce,sqli' rate_limit: max HTTP requests per second (default 150) concurrency: concurrent template execution (default 25) auto_scan: automatic scan using wappalyzer technology detection (-as)

Update Nuclei templates to the latest version.

WordPress vulnerability scanner using WPScan. url: WordPress site URL (e.g. 'http://example.com') enumerate: what to enumerate — comma-separated: vp=vulnerable plugins, vt=vulnerable themes, u=users, p=all plugins, t=all themes, tt=timthumbs, cb=config backups, dbe=db exports, m=media api_token: WPScan API token for vulnerability data (get free at wpscan.com) detection_mode: mixed (default), passive, aggressive random_user_agent: randomize user agent per request disable_tls_checks: disable SSL certificate verification throttle_ms: milliseconds between requests (0 = no throttle)

Given a service name/version, find matching exploits in searchsploit and Metasploit. Closes the gap between 'found a version' and 'here is the exploit to run'. service: service name e.g. 'Apache', 'OpenSSH', 'nginx', 'vsftpd', 'Samba' version: version string e.g. '2.4.49', '3.0.28', '1.24.0' banner: raw service banner (alternative to service+version — auto-parsed) os_type: 'linux' or 'windows' (filters exploits) Returns: matching searchsploit exploits + Metasploit modules + suggested commands

Full chain: port scan → service detection → CVE lookup for each service. One call that returns all exploits for all services on a target. target: IP or hostname ports: port range to scan Returns: for each open port, the service version + matching exploits

Automated SQL injection detection and exploitation using sqlmap. url: target URL with parameter (e.g. 'http://site.com/page.php?id=1') data: POST data string (e.g. 'user=foo&pass=bar') level: test level 1-5 (higher = more tests, slower) risk: risk level 1-3 (higher = more aggressive, may alter data) dbms: force DBMS type e.g. 'mysql', 'postgresql', 'mssql', 'oracle' technique: SQL injection techniques — B=Boolean, E=Error, U=Union, S=Stacked, T=Time, Q=Inline (default all: BEUSTQ) enumerate_dbs: enumerate databases (--dbs) enumerate_tables: enumerate tables (--tables) dump: dump table data — use with database and table params database: target database name (-D) table: target table name (-T) cookie: HTTP cookie header value random_agent: use random User-Agent NOTE: Always runs non-interactively (--batch).

Password brute-force attack using Hydra. target: IP or hostname to attack service: protocol — ssh, ftp, http-get, http-post-form, smb, mysql, mssql, rdp, telnet, pop3, imap, smtp, vnc username: single username to test userlist: path to username list file (overrides username) e.g. /usr/share/seclists/Usernames/top-usernames-shortlist.txt password: single password to test passlist: path to password list file (overrides password) e.g. /usr/share/wordlists/rockyou.txt port: target port (0 = use service default) tasks: parallel connections per target (default 16) stop_on_first: stop after first valid credential found (-f)

Search Metasploit modules by keyword using a resource file (faster than -x). query: search term e.g. 'ms17-010', 'eternalblue', 'type:exploit platform:windows' Returns immediately (non-interactive).

Run a Metasploit module non-interactively via resource file. module: full module path e.g. 'exploit/windows/smb/ms17_010_eternalblue' or 'auxiliary/scanner/smb/smb_ms17_010' options: dict of module options — RHOSTS is required and must be in scope. e.g. {"RHOSTS": "192.168.1.1", "LHOST": "192.168.1.10", "LPORT": "4444"} payload: payload e.g. 'windows/x64/meterpreter/reverse_tcp' NOTE: Non-interactive only — sessions are auto-killed after execution.

Generate a payload using msfvenom. Saved to ~/kali-mcp/artifacts/ (chmod 600). payload: e.g. 'linux/x64/meterpreter/reverse_tcp' lhost: listener IP address lport: listener port format: elf, exe, raw, php, py, rb, sh, dll, jar, war filename: output filename (auto-generated if empty)

Check if ports are open/closed on a host. Uses ncat (nmap-suite) if available, falls back to netcat. host: IP or hostname ports: comma/space-separated ports e.g. '80', '22,80,443' Returns immediately.

Grab a service banner from host:port using a raw async socket. Sends a newline (or custom data) to trigger a server response. host: IP or hostname port: target port timeout: seconds to wait for response (default 10) send_data: data to send to trigger banner (default newline). Supports escape sequences like '\n', '\r\n', '\t'.

Execute a single command via SSH (uses paramiko, no sshpass dependency). host: target IP or hostname username: SSH username password: SSH password (leave empty if using key) key_file: path to private key file (leave empty if using password) command: shell command to execute port: SSH port (default 22) timeout: command timeout in seconds (default 60) Returns: stdout, stderr, return_code (or error if connection/auth failed)

Enumerate privilege escalation vectors on a Linux host via SSH. Runs checks for: SUID binaries, capabilities, sudo permissions, cron jobs, world-writable files, kernel version, /etc/passwd readables, PATH/LD env vars. host: target IP or hostname username: SSH username password: SSH password key_file: SSH private key path port: SSH port (default 22) Returns: structured findings by category, OR a clear error if SSH failed.

Generate a structured report from completed job results. job_ids: list of job IDs to include (from list_jobs or get_job_status) title: report title format: 'markdown' or 'json'

List completed jobs, optionally filtered by tool name. tool_filter: partial tool name e.g. 'nmap', 'nikto', '' (all)

Parse nmap output from a completed job into structured data. Returns hosts, open ports, services, and OS guesses. job_id: completed nmap job ID

Parse a nuclei JSONL findings file into structured vulnerability data. findings_file: path returned by nuclei_scan as 'findings_file'

Generate a professional finding-based pentest report with attack chains and remediation.

title: report title min_severity: minimum severity to include — info, low, medium, high, critical min_confidence: minimum confidence to include — low, medium, high host: filter by specific host (empty = all hosts) save_to: optional file path to save the report (must be under artifacts/, /tmp, or /var/tmp) format: 'markdown' (default) or 'html' (self-contained HTML file, suitable for client delivery) confirmed_only: if True, only include findings marked 'confirmed' via update_finding_status. Use after running a validation agent for a zero-false-positive report.

Extract credentials and key data from a PCAP file. Extracts: HTTP requests (headers, POST data), FTP/Telnet/SMTP credentials, DNS queries, common protocol usernames/passwords. pcap_path: path to .pcap or .pcapng file Returns: structured findings by protocol

Get protocol hierarchy and conversation list for a PCAP — overview of what's actually in the capture (HTTP, DNS, SMB, FTP, Telnet, SMTP, ICMP, ARP, etc.). Use this BEFORE pcap_extract to know what protocols to look for. pcap_path: path to .pcap or .pcapng file Returns: protocol breakdown by packet count + endpoint conversations

Run an arbitrary tshark query on a PCAP file. pcap_path: path to PCAP file display_filter: Wireshark display filter e.g. 'http.request', 'tcp.port==21', 'smb', 'dns.qry.name', 'frame.number == 42' fields: comma-separated tshark fields to extract e.g. 'ip.src,ip.dst,tcp.port,http.request.uri' max_lines: max output lines (default 200)

Make an HTTP request and inspect the full response. url: target URL method: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS headers: dict of HTTP headers e.g. {"Authorization": "Bearer token"} cookies: dict of cookies e.g. {"session": "abc123"} data: request body for POST/PUT (string or JSON) follow_redirects: follow 3xx redirects (default True) timeout: request timeout in seconds save_to: if set, save response body to this file path (for binaries/large files) extract_text: if True and HTML, strip tags and return visible text only Returns: status, headers, body (or file path if save_to), redirect chain, timing

Strip HTML tags and extract visible text. Removes scripts, styles, tags. Returns clean readable text. html: HTML string

Extract all links (anchors, forms, scripts, images) from HTML. Useful for building a crawl tree without manually grep'ing the response body. html: HTML string base_url: optional base URL for resolving relative links only_same_origin: if True and base_url given, only return links to same host Returns: lists of links by category (anchors, forms, scripts, images, css)

Submit an HTML form (simulates browser form POST). url: form action URL form_data: dict of form fields e.g. {"username": "admin", "password": "test"} method: POST (default) or GET headers: additional HTTP headers cookies: session cookies to include follow_redirects: follow redirects after submit (default True) Returns: response status, headers, body, redirect chain

Crawl a web application by following links organically. Discovers endpoints, forms, and interesting paths that wordlist brute-force misses. url: starting URL (e.g. 'http://example.com/') max_depth: how many link levels deep to follow (default 2) max_pages: max pages to visit (default 50) include_external: also collect external links (not crawled, just listed) timeout: per-request timeout in seconds Returns: discovered URLs by category, forms, and interesting endpoints

Take a screenshot of a single web URL using gowitness. Useful for quick visual triage of login panels, admin interfaces, etc. url: target URL (e.g. 'http://example.com/admin') timeout: per-request timeout in seconds Returns: path to saved screenshot PNG file

Take screenshots of multiple URLs using gowitness. Use after gobuster/crawl to visually triage all discovered endpoints at once. urls: list of URLs to screenshot threads: concurrent screenshot workers (default 4) timeout: per-request timeout in seconds Returns: directory containing all PNG screenshots + JSONL results

Preflight check — verifies all tool binaries, Python deps, and wordlists. Run this at the start of an engagement to avoid surprises mid-workflow. Returns: status per category, missing tools with install hints, available wordlists.

Check if a specific binary is installed and where it is. name: binary name e.g. 'nmap', 'sshpass', 'msfconsole'

Read a file from disk (artifacts, /tmp, /var/tmp, wordlists). Auto-detects file type via magic bytes. path: absolute file path max_bytes: max bytes to read (default 50KB) offset: byte offset to start from as_hex: return content as hex dump as_base64: return content as base64 (for binaries) Returns: file metadata, type detection, content (text/hex/base64)

List all files in the artifacts directory (downloads, scan outputs, payloads). Returns: filename, size, modification time per file.

Store discovered credentials in the vault (passwords/hashes encrypted at rest). host: target host IP or hostname username: discovered username password: plaintext password (leave empty if only hash available) hash: password hash (e.g. NTLM, bcrypt) service: service type e.g. 'ssh', 'http', 'smb', 'ftp', 'mysql' port: service port source_tool: which tool found this (e.g. 'hydra', 'sqlmap', 'manual') notes: any additional context

List stored credentials, optionally filtered by host or service. host: filter by host IP/hostname (empty = all hosts) service: filter by service type e.g. 'ssh', 'http' (empty = all) Returns credentials with decrypted passwords/hashes for use in further attacks.

Get the most recently discovered credential for a host/service. Use this before attacking a service to check if we already have valid creds. host: target host service: optional service filter e.g. 'ssh' Returns: best credential to try (decrypted), or empty if none found.

Delete a credential from the vault by its ID.

Extract and return normalized findings from a completed job. job_id: job to extract findings from (leave empty to get all recent findings) host: filter findings by host min_severity: minimum severity to return — info, low, medium, high, critical min_confidence: minimum confidence to return — low, medium, high Returns: list of normalized Finding objects with host, title, severity, evidence, tool

Start a new engagement. Sets scope for all tools automatically. All subsequent findings, jobs, and credentials are tagged to this engagement. name: engagement name e.g. 'ClientName-WebApp-2026' scope: list of authorized targets e.g. ['192.168.1.0/24', 'example.com'] client: optional client name for reporting notes: engagement notes / rules of engagement

Show the current active engagement and its findings summary.

Get all findings for the current engagement. min_severity: info, low, medium, high, critical host: filter by specific host limit: max results

Close the current engagement and clear scope restrictions.

List all engagements (past and active).

List findings pending validation for the current engagement.

Returns unconfirmed findings ordered by severity so a validation agent can work through them one by one and call update_finding_status on each. host: filter by specific host (empty = all) min_severity: info, low, medium, high, critical

Update the validation status of a finding.

Called by a validation agent after manually verifying a finding. finding_id: the finding's id (from list_unconfirmed_findings) status: 'confirmed' — finding is real and exploitable 'false_positive' — finding is not real, exclude from report 'unconfirmed' — reset back to pending (if re-verification needed)

Full parallel host scan — fires multiple tools simultaneously and waits for all. Reduces total recon time by 70% vs running tools sequentially. target: IP or hostname intensity: 'light' (quick scan), 'normal' (default), 'deep' (thorough) Returns: consolidated results from all tools with findings and next steps.

Full parallel web application scan — nikto, gobuster, nuclei, and crawler simultaneously. depth: 'light' (quick), 'normal' (default), 'deep' (thorough with ffuf) Returns: consolidated web findings from all scanners.

Analyze and prioritize all findings from recent scans. Returns a structured triage report designed for LLM decision-making. Identifies: attack paths, quick wins, critical issues, credential reuse opportunities.

host: focus on specific host (empty = all hosts) min_severity: minimum severity to include — low, medium, high, critical min_confidence: minimum confidence to include — low, medium, high max_items: max findings to analyze (default 20)

Returns: prioritized attack paths, quick wins, and recommended next actions.

Correlate current findings into multi-stage attack chains.

Shows how individual low/medium findings combine into high-impact compound attack paths (e.g. SQL injection + exposed SSH = credential theft + system access). Call this at any point during an engagement to understand compound risk.

host: focus on a specific host (empty = all hosts) min_severity: minimum finding severity to consider — info, low, medium, high, critical min_confidence: minimum finding confidence to consider — low, medium, high Returns: list of chains with name, escalated severity, narrative, steps, affected hosts.

Start or update a named program scope.

name: program name e.g. 'ClientX-WebApp-2026' in_scope: list of allowed targets e.g. ['10.10.10.0/24', 'example.com'] out_of_scope: list of explicitly blocked targets (e.g. ['10.10.10.254']) client: optional client name rules: dict of rules of engagement: max_findings, duration_hours, reporting_format approvers: list of approved agents/humans who can modify/activate this program

Show the current active program scope.

List all programs (draft/active/ended).

Close the current program scope and clear scope restrictions.

Add targets to the current program's in-scope list.

Remove targets from the current program's in-scope list.

Add targets to the out-of-scope (deny) list.

Explicitly allow a target that is otherwise out of scope.

Explicitly deny a target, blocking it even if in in_scope.

List all known hosts. status: filter by status (new, scanned, confirmed, remediated, false_positive) min_scan_count: minimum number of scans limit: max results

Get full details for a specific host.

List services, optionally filtered by host or service name.

List vulnerabilities, optionally filtered by host or severity. min_severity: info, low, medium, high, critical status: unconfirmed, confirmed, false_positive, remediated

Search assets by IP, hostname, service, or CVE.

Mark a host with a status (new, scanned, confirmed, remediated, false_positive).

Mark a vulnerability with a status.

List recorded scan runs (recon cycles), newest first. program: filter by program name (empty = all) limit: max results

Compare two scan runs and report what changed between them. Reports new / disappeared / changed hosts, services, and vulnerabilities. prev_run_id: the earlier (baseline) run id curr_run_id: the later run id

Show what changed between the two most recent completed runs. This is the core continuous-recon view: 'what's new since last time?' program: focus on one program (empty = all runs across programs) Returns: change report + a 'new_assets' list flagged as high-priority (newly deployed assets are often less tested).

Passive recon sweep with change detection.

Runs passive-only recon (subfinder, amass -passive, theHarvester) against a domain, records everything under a scan run, then reports what changed since the previous sweep: new subdomains, new IPs/ports, new endpoints, new vulnerabilities, and assets that disappeared.

Safe to run repeatedly/unattended (passive only). Newly-appeared assets are surfaced under 'priority_new_assets' because fresh surface is often less tested.

domain: target domain (must be within the active program scope) program: program name to group runs under (defaults to the domain) tools: subset of ['subfinder','amass','theharvester'] (default: all) tool_budget: max number of tools to run this sweep (0 = no limit)

Get status and result of an async job by its ID.

Get partial output from a running or completed job. Useful for checking progress before a job finishes. job_id: job ID to read tail: number of lines from the end to return (default 100, 0 = all)

List recent jobs with their statuses.

Cancel a running job and kill its process group.

List all authorized targets in scope. Empty list means lab mode — all targets allowed.

Add a single target to the authorized scope. target: IP, CIDR (e.g. '192.168.1.0/24'), domain, or '*.example.com'

Replace the entire scope with a new list of targets. Use this at the start of an engagement to set all authorized targets at once. targets: list of IPs, CIDRs, domains e.g. ['192.168.1.0/24', 'example.com', '*.example.com']

Remove a specific target from scope.