Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@john-the-ripper-mcp crack these MD5 hashes using rockyou"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that provides AI assistants with access to John the Ripper, the legendary password security auditing and recovery tool. This server executes commands on a remote Kali Linux system via SSH, enabling secure password analysis workflows.
Password Cracking - Multiple attack modes: wordlist, incremental, single crack, and rules-based
Hash Management - Show cracked passwords, manage pot files, identify hash types
Session Control - Create, monitor, restore, and terminate cracking sessions
Hash Extraction - Extract hashes from encrypted files (ZIP, PDF, SSH keys, Office docs, etc.)
Benchmarking - Test cracking performance for different hash formats
Rules Engine - List and test password mangling rules
Related MCP server: K-MCP: Kali Model Context Protocol Server
# Clone the repository
git clone https://github.com/schwarztim/sec-john-the-ripper-mcp.git
cd sec-john-the-ripper-mcp
# Install dependencies
npm install
# Build
npm run buildThe server connects to a remote Kali Linux system via SSH. Configure via environment variables:
Variable | Description | Default |
| SSH hostname or IP of Kali system |
|
| SSH username (optional) | (none) |
| Path to john binary on remote system |
|
| Remote working directory for temp files |
|
SSH Access - Passwordless SSH key authentication to your Kali system
John the Ripper - Installed on the remote Kali system (apt install john)
Node.js - Version 18+ recommended
Add to your claude_desktop_config.json:
{
"mcpServers": {
"john-the-ripper": {
"command": "node",
"args": ["/path/to/sec-john-the-ripper-mcp/dist/index.js"],
"env": {
"JOHN_SSH_HOST": "your-kali-host",
"JOHN_SSH_USER": "kali"
}
}
}
}Tool | Description |
| Start password cracking with configurable modes and options |
| Display cracked passwords from hash files |
| Check the status of running sessions |
| Resume an interrupted cracking session |
| List all active and saved sessions |
| Terminate running John processes |
Tool | Description |
| Identify hash type(s) for given values |
| List supported hash formats with optional filtering |
| Extract hashes from encrypted files using *2john utilities |
Tool | Description |
| List available rules or test rules against sample words |
| Run performance benchmarks for hash formats |
| Manage the john.pot file (show, clear, export, search) |
Use john_crack with:
- hash_content: "5f4dcc3b5aa765d61d8327deb882cf99"
- format: "raw-md5"
- wordlist: "/usr/share/wordlists/rockyou.txt"Use john_identify with:
- hash: "$2a$10$N9qo8uLOickgx2ZMRZoMy..."Use john_hash_extract with:
- type: "zip"
- file_path: "/path/to/encrypted.zip"Use john_status with:
- session: "my-crack-session"zip - ZIP archives
rar - RAR archives
pdf - PDF documents
ssh - SSH private keys
gpg - GPG/PGP keys
office - Microsoft Office documents
keepass - KeePass databases
7z - 7-Zip archives
bitlocker - BitLocker volumes
luks - LUKS encrypted volumes
truecrypt / veracrypt - TrueCrypt/VeraCrypt volumes
ethereum / bitcoin - Cryptocurrency wallets
This tool is intended for authorized security testing only. Ensure you have proper authorization before:
Testing password strength on systems you own or administer
Conducting penetration tests with written permission
Recovering passwords for files you have legitimate access to
Unauthorized password cracking is illegal. Always follow your organization's security policies and applicable laws.
MIT License - See LICENSE for details.
Contributions welcome! Please open an issue or submit a pull request.
John the Ripper by Openwall
Built with the Model Context Protocol SDK
Run benchmarks to test cracking speed for different hash types
Inputs: format, duration.
Start password cracking with John the Ripper. Supports various modes including wordlist, incremental, and single crack.
Inputs: fork, rules, format, session, +5 more.
List all supported hash formats. Can filter by keyword.
Inputs: filter, details.
Extract hashes from various file types using John's *2john utilities
Inputs: type (required), file_path (required).
Identify the hash type(s) for given hash values
Inputs: hash, hash_file.
Kill a running John the Ripper process or session
Inputs: all, session.
Manage the john.pot file containing cracked passwords
Inputs: action (required), search.
Restore and continue an interrupted cracking session
Inputs: session.
List available mangling rules or test rules against words
Inputs: list, test_rules, test_words.
List all active and saved John the Ripper sessions
Inputs: no named parameters.
Show cracked passwords from a hash file or pot file
Inputs: format, hash_file, show_left, hash_content.
Check the status of a cracking session
Inputs: session.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 12 tools
Most tools have distinct purposes, but john_status and john_sessions could overlap since both deal with session information, and john_show and john_pot both relate to cracked passwords. However, descriptions clarify the specific roles, so confusion is minimal.
All tool names follow a consistent john_ prefix followed by a verb-noun combination (e.g., john_crack, john_show, john_hash_extract). The snake_case style is uniform, making the naming predictable and readable.
12 tools is well within the ideal range for a specialized utility. Each tool addresses a distinct aspect of John the Ripper's workflow, and there is no bloat or unnecessary duplication.
The tool set covers the full lifecycle of password cracking: hash extraction, identification, format listing, cracking, monitoring/restoring, showing results, pot management, benchmarking, rules, and session control. No obvious gaps for the domain.
Utility tools for AI agents: hashing, text stats, validation, DNS, currency, GEO audits.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
