Xploit47

Systematic, AI-powered penetration testing reasoning engine (MCP server) for attack path planning, CTF/HTB solving, and authorized pentest workflows.

Features Beam Search, Monte Carlo Tree Search (MCTS), attack step scoring, tool recommendations, and critical-path highlighting.

What is Xploit47?

Xploit47 is a Model Context Protocol (MCP) server that turns an LLM into a structured, methodical pentest planner and advisor. It does not run exploits against targets — it reasons about attack chains, scores steps, and recommends next actions and tools.

Related MCP server: PentestThinkingMCP

How it works

1. Input — You (or your AI) provide the current attack step/state
   e.g. "Enumerate SMB on 10.10.10.10"

2. Reasoning — Xploit47 uses Beam Search or MCTS to score and track the path

3. Output — Returns step metadata, score, strategy used, and tree statistics

Example HTB-style workflow

Installation

git clone https://github.com/aloc999/Xploit47.git
cd Xploit47
npm install
npm run build

Requirements: Node.js ≥ 18

Usage (MCP client config)

Add to your MCP client (Claude Desktop, Cursor, Grok, etc.):

{
  "mcpServers": {
    "Xploit47": {
      "command": "node",
      "args": ["/absolute/path/to/Xploit47/dist/index.js"]
    }
  }
}

Or run directly:

npm start
# equivalent: node dist/index.js

Tool: xploit47

Search strategies

Beam Search (beam_search)

• Keeps a fixed-width set of the best attack paths

• Best for methodical exploit chaining and known patterns

• Use for: enumeration sequences, CVE chaining, linear CTF paths

Monte Carlo Tree Search (mcts)

• Simulation-based exploration with UCB1 selection

• Balances exploring new vectors vs exploiting known weaknesses

• Use for: complex networks, uncertain outcomes, multi-stage APT-style planning

Ethics & legal

Xploit47 is a reasoning / planning tool only. Use it only on systems you are authorized to test (your own labs, CTF platforms, or programs with written permission / safe harbor). Unauthorized access is illegal.

Development

npm run dev      # tsx src/index.ts
npm run build    # tsc → dist/
npm start        # node dist/index.js

Project layout

Xploit47/
├── src/
│   ├── index.ts              # MCP server entry (stdio)
│   ├── reasoner.ts           # Strategy orchestration + auto parent links
│   ├── scoring.ts            # Deterministic score + kill-chain phase
│   ├── recommend.ts          # Tool / asset inference + next-step hints
│   ├── engine.ts             # Lightweight beam engine
│   ├── state.ts              # Node cache / path state
│   ├── types.ts              # Shared types & config
│   └── strategies/
│       ├── base.ts           # Shared evaluation + response builder
│       ├── beam-search.ts    # Beam Search
│       ├── mcts.ts           # Monte Carlo Tree Search
│       └── factory.ts        # Strategy factory
├── scripts/smoke-test.mjs    # Accuracy + MCP integration tests
├── tot-engine.js             # Standalone Tree-of-Thought helper
├── state-manager.js          # Standalone session helper
├── package.json
└── README.md

License

MIT — see LICENSE.