Metasploit MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| execute-commandC | Execute a raw Metasploit command |
| search-exploitB | Search for exploits by name or CVE |
| module-infoC | Get information about a specific Metasploit module |
| list-modulesB | List available modules by type |
| get-versionA | Get Metasploit version information |
| run-nmap-scanC | Run a nmap scan using Metasploit |
| run-vuln-scanC | Run a vulnerability scan on a target |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Most tools have clearly distinct purposes: versioning, raw command execution, module discovery, and scanning are separate concerns. Some overlap exists between search-exploit and list-modules, and between run-nmap-scan and run-vuln-scan, but the descriptions are clear enough to avoid major misselection.
Tool names mostly follow a hyphenated verb_noun pattern like get-version, search-exploit, and list-modules. The name module-info deviates by leading with a noun instead of a verb, and run- is repeated twice, but the overall convention is consistent and readable.
Seven tools is a well-scoped size for a Metasploit-oriented server. Each tool represents a meaningful capability without unnecessary duplication or bloat, and the count fits comfortably within the ideal range.
The tool surface covers discovery, information gathering, scanning, and raw command execution, which are core Metasploit workflows. However, there are notable gaps in high-level exploit execution, session management, and workspace/database controls, leaving agents reliant on the generic execute-command for these important actions.