Skip to main content
Glama
bsahane

kali-mcp-server

by bsahane
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
DATA_DIRNoDirectory for scope, audit log, outputs, wordlists.~/.kali-mcp
REQUIRE_SCOPENoRefuse out-of-scope targets.True
EXECUTION_MODENoExecution mode: auto, host, or docker.auto
KALI_DOCKER_IMAGENoThe Kali Docker image to use as fallback.kalilinux/kali-rolling
ALLOW_EXPLOITATIONNoEnable active exploitation/brute-force tools.False
TOOL_TIMEOUT_SECONDSNoPer-run timeout in seconds.300
MCP_TRANSPORT_PROTOCOLNoTransport protocol: stdio, http, streamable-http, sse.stdio

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{
  "tasks": {
    "list": {},
    "cancel": {},
    "requests": {
      "tools": {
        "call": {}
      },
      "prompts": {
        "get": {}
      },
      "resources": {
        "read": {}
      }
    }
  }
}

Tools

Functions exposed to the LLM to take actions

NameDescription
nmap_scanA

Run an nmap scan against an authorized target.

TOOL_NAME=nmap_scan DISPLAY_NAME=Nmap Network Scanner USECASE=Discover open ports, services, versions, OS and run NSE vuln scripts on an in-scope host INSTRUCTIONS=1. Ensure the target is in the engagement scope (scope_manage), 2. Pick a profile, 3. Optionally set ports/extra_args, 4. Call INPUT_DESCRIPTION=target (host/IP/CIDR); profile (quick|full|service|os|aggressive|vuln|top-ports); ports (e.g. "22,80,443" or "1-1000"); extra_args (list of raw nmap flags) OUTPUT_DESCRIPTION=Dict with status, parsed open_ports list, raw stdout/stderr, command and execution mode EXAMPLES=nmap_scan("scanme.nmap.org", "quick"), nmap_scan("10.0.0.5", "service", ports="1-1024") PREREQUISITES=Target authorized and added to scope; nmap available on host or via Kali container RELATED_TOOLS=host_discovery, masscan_scan, nikto_scan

Args: target: Host, IP or CIDR to scan (must be in the authorized scope). profile: One of the predefined nmap profiles. ports: Optional explicit port specification (overrides profile ports). extra_args: Optional list of additional raw nmap arguments.

Returns: Structured result dict including parsed open_ports.

masscan_scanA

Run a fast masscan port sweep against an authorized target.

TOOL_NAME=masscan_scan DISPLAY_NAME=Masscan Port Sweeper USECASE=Rapidly identify open TCP ports across an in-scope host or range INSTRUCTIONS=1. Ensure target/range is in scope, 2. Set ports and a sane rate, 3. Call INPUT_DESCRIPTION=target (host/IP/CIDR); ports (e.g. "1-65535" or "80,443"); rate (packets/sec, capped at 5000) OUTPUT_DESCRIPTION=Dict with status, raw stdout/stderr, command and execution mode EXAMPLES=masscan_scan("10.0.0.0/24", ports="1-1000", rate=1000) PREREQUISITES=Target authorized and in scope; masscan needs root (runs as root in Kali container) RELATED_TOOLS=nmap_scan, host_discovery

Args: target: Host, IP or CIDR to scan (must be in scope). ports: Port specification. rate: Packets per second; capped at 5000 to avoid flooding.

Returns: Structured result dict.

host_discoveryA

Ping-sweep a host or range to find live hosts (nmap -sn).

TOOL_NAME=host_discovery DISPLAY_NAME=Live Host Discovery USECASE=Enumerate which hosts in an in-scope range are up, without port scanning INSTRUCTIONS=1. Ensure target/range is in scope, 2. Call with a host or CIDR INPUT_DESCRIPTION=target (host/IP/CIDR) OUTPUT_DESCRIPTION=Dict with status, raw output listing live hosts, command and mode EXAMPLES=host_discovery("10.0.0.0/24") PREREQUISITES=Target authorized and in scope RELATED_TOOLS=nmap_scan, masscan_scan

Args: target: Host, IP or CIDR to sweep (must be in scope).

Returns: Structured result dict.

dns_reconA

Enumerate DNS records for an in-scope domain (dnsrecon).

TOOL_NAME=dns_recon DISPLAY_NAME=DNS Reconnaissance USECASE=Enumerate DNS records (A, MX, NS, SOA, SRV, zone transfer attempts) for a domain INSTRUCTIONS=1. Ensure domain is in scope, 2. Choose scan_type, 3. Call INPUT_DESCRIPTION=domain (e.g. example.com); scan_type (std|axfr|brt|srv) OUTPUT_DESCRIPTION=Dict with status, raw dnsrecon output, command and mode EXAMPLES=dns_recon("example.com", "std") PREREQUISITES=Domain authorized and in scope RELATED_TOOLS=subdomain_enum, whois_lookup

Args: domain: Domain to enumerate (must be in scope). scan_type: dnsrecon scan type (std, axfr, brt, srv).

Returns: Structured result dict.

subdomain_enumA

Discover subdomains of an in-scope domain (subfinder, passive).

TOOL_NAME=subdomain_enum DISPLAY_NAME=Subdomain Enumeration USECASE=Passively discover subdomains of an authorized domain from public sources INSTRUCTIONS=1. Ensure domain is in scope, 2. Call with the apex domain INPUT_DESCRIPTION=domain (e.g. example.com) OUTPUT_DESCRIPTION=Dict with status, discovered subdomains list, raw output, command and mode EXAMPLES=subdomain_enum("example.com") PREREQUISITES=Domain authorized and in scope RELATED_TOOLS=dns_recon, whatweb_fingerprint

Args: domain: Apex domain to enumerate (must be in scope).

Returns: Structured result dict including a subdomains list.

whois_lookupA

Look up WHOIS registration data for a domain or IP.

TOOL_NAME=whois_lookup DISPLAY_NAME=WHOIS Lookup USECASE=Retrieve registrar/ownership/allocation data for a domain or IP (public registry data) INSTRUCTIONS=1. Provide a domain or IP, 2. Call INPUT_DESCRIPTION=target (domain or IP) OUTPUT_DESCRIPTION=Dict with status, raw WHOIS output, command and mode EXAMPLES=whois_lookup("example.com") PREREQUISITES=None — queries public WHOIS servers, not the target host RELATED_TOOLS=dns_recon, subdomain_enum

Args: target: Domain or IP to look up.

Returns: Structured result dict.

Note: WHOIS contacts registry servers, not the target itself, so it is not scope-gated.

username_osintA

Enumerate which public platforms a username exists on (Sherlock).

TOOL_NAME=username_osint DISPLAY_NAME=Username Footprint (Sherlock) USECASE=Discover which websites/social platforms a username is registered on, from public profile pages INSTRUCTIONS=1. Provide the username/handle (e.g. your own for a footprint check), 2. Call INPUT_DESCRIPTION=username (the handle to search); timeout (optional seconds override) OUTPUT_DESCRIPTION=Dict with status, a 'found' list of {site, url}, a count, raw output, command and mode EXAMPLES=username_osint("sudesh.khandekar") PREREQUISITES=None — passive queries to public profile URLs; run on handles you are authorized to profile (e.g. your own) RELATED_TOOLS=email_harvest, whois_lookup, subdomain_enum

Args: username: The handle to search across platforms. timeout: Optional override for the run timeout (Sherlock checks many sites and can take a few minutes).

Returns: Structured result dict including a found list of {site, url}.

Note: Passive OSINT against public profile pages; not network-scope-gated, but the subject is recorded in the audit log for accountability.

email_harvestA

Harvest emails, subdomains and hosts for a domain (theHarvester, passive).

TOOL_NAME=email_harvest DISPLAY_NAME=Email/Host Harvester (theHarvester) USECASE=Collect public emails, subdomains and hosts for an in-scope domain from search engines and CT logs INSTRUCTIONS=1. Ensure the domain is in the engagement scope, 2. Optionally pick sources/limit, 3. Call INPUT_DESCRIPTION=domain (apex domain); sources (comma-separated theHarvester -b sources); limit (max results) OUTPUT_DESCRIPTION=Dict with status, parsed 'emails' list, raw output, command and mode EXAMPLES=email_harvest("example.com") PREREQUISITES=Domain authorized and in scope RELATED_TOOLS=subdomain_enum, dns_recon, username_osint

Args: domain: Apex domain to harvest (must be in scope). sources: Comma-separated theHarvester data sources (free/no-key sources by default). limit: Maximum number of results to request.

Returns: Structured result dict including a parsed emails list.

nikto_scanA

Scan a web server for known vulnerabilities and misconfigurations (nikto).

TOOL_NAME=nikto_scan DISPLAY_NAME=Nikto Web Server Scanner USECASE=Identify dangerous files, outdated servers, and misconfigurations on an in-scope web host INSTRUCTIONS=1. Ensure host is in scope, 2. Provide target (host or URL) and optional port, 3. Call INPUT_DESCRIPTION=target (host or URL); port (optional int, default 80/from URL) OUTPUT_DESCRIPTION=Dict with status, raw nikto findings, command and mode EXAMPLES=nikto_scan("http://testphp.vulnweb.com"), nikto_scan("10.0.0.5", port=8080) PREREQUISITES=Host authorized and in scope RELATED_TOOLS=whatweb_fingerprint, nuclei_scan, dir_bruteforce

Args: target: Web host or URL (must be in scope). port: Optional explicit port.

Returns: Structured result dict.

dir_bruteforceA

Brute-force web content paths/directories (gobuster dir mode).

TOOL_NAME=dir_bruteforce DISPLAY_NAME=Directory/Content Brute-Force USECASE=Discover hidden directories and files on an in-scope web app using a wordlist INSTRUCTIONS=1. Ensure host is in scope, 2. Provide the base URL, 3. Optionally set wordlist/extensions, 4. Call INPUT_DESCRIPTION=target (base URL, e.g. http://host); wordlist (path, default common.txt); extensions (e.g. "php,txt,html") OUTPUT_DESCRIPTION=Dict with status, discovered paths in output, command and mode EXAMPLES=dir_bruteforce("http://10.0.0.5", extensions="php,html") PREREQUISITES=Host authorized and in scope; wordlist available (mount into /wordlists for the container) RELATED_TOOLS=vhost_enum, nikto_scan

Args: target: Base URL to enumerate (must be in scope). wordlist: Path to a wordlist (defaults to a common list). extensions: Comma-separated file extensions to append.

Returns: Structured result dict.

vhost_enumA

Brute-force virtual hosts on a web server (gobuster vhost mode).

TOOL_NAME=vhost_enum DISPLAY_NAME=Virtual Host Enumeration USECASE=Discover name-based virtual hosts served by an in-scope web server INSTRUCTIONS=1. Ensure host/domain is in scope, 2. Provide base URL and apex domain, 3. Call INPUT_DESCRIPTION=target (base URL); domain (apex domain for candidate vhosts); wordlist (optional) OUTPUT_DESCRIPTION=Dict with status, discovered vhosts in output, command and mode EXAMPLES=vhost_enum("http://10.0.0.5", "example.com") PREREQUISITES=Host/domain authorized and in scope RELATED_TOOLS=dir_bruteforce, subdomain_enum

Args: target: Base URL of the server (must be in scope). domain: Apex domain used to build candidate vhost names. wordlist: Path to a wordlist (defaults to a common list).

Returns: Structured result dict.

whatweb_fingerprintA

Fingerprint web technologies used by an in-scope site (whatweb).

TOOL_NAME=whatweb_fingerprint DISPLAY_NAME=Web Technology Fingerprinter USECASE=Identify CMS, frameworks, servers, and libraries used by a target web app INSTRUCTIONS=1. Ensure host is in scope, 2. Provide URL and optional aggression level, 3. Call INPUT_DESCRIPTION=target (URL); aggression (1=stealthy .. 3=aggressive, default 1) OUTPUT_DESCRIPTION=Dict with status, fingerprint output, command and mode EXAMPLES=whatweb_fingerprint("https://example.com") PREREQUISITES=Host authorized and in scope RELATED_TOOLS=nikto_scan, nuclei_scan

Args: target: URL to fingerprint (must be in scope). aggression: whatweb aggression level (1-4).

Returns: Structured result dict.

nuclei_scanA

Run template-based vulnerability checks against an in-scope target (nuclei).

TOOL_NAME=nuclei_scan DISPLAY_NAME=Nuclei Vulnerability Scanner USECASE=Detect known CVEs, misconfigurations and exposures using nuclei templates INSTRUCTIONS=1. Ensure host is in scope, 2. Provide URL, 3. Optionally filter by severity/tags, 4. Call INPUT_DESCRIPTION=target (URL); severity (e.g. "critical,high"); tags (e.g. "cve,exposure") OUTPUT_DESCRIPTION=Dict with status, matched findings in output, command and mode EXAMPLES=nuclei_scan("https://example.com", severity="critical,high") PREREQUISITES=Host authorized and in scope; nuclei templates present (auto-updated in container) RELATED_TOOLS=nikto_scan, whatweb_fingerprint

Args: target: URL to scan (must be in scope). severity: Optional comma-separated severity filter. tags: Optional comma-separated template tag filter.

Returns: Structured result dict.

sqlmap_testA

Test a URL/parameter for SQL injection (sqlmap). GATED — exploitation.

TOOL_NAME=sqlmap_test DISPLAY_NAME=SQLMap Injection Tester USECASE=Detect and exploit SQL injection in an authorized web app parameter INSTRUCTIONS=1. Enable ALLOW_EXPLOITATION, 2. Ensure host in scope, 3. Provide the URL (with parameter) and optional POST data, 4. Call INPUT_DESCRIPTION=target (URL incl. query param); data (POST body, optional); level (1-5); risk (1-3) OUTPUT_DESCRIPTION=Dict with status, sqlmap output, command and mode; blocked if exploitation disabled EXAMPLES=sqlmap_test("http://host/item.php?id=1", level=1, risk=1) PREREQUISITES=ALLOW_EXPLOITATION=true AND target authorized and in scope RELATED_TOOLS=nuclei_scan, searchsploit_lookup

Args: target: URL including the parameter to test (must be in scope). data: Optional POST data string. level: sqlmap test level (1-5). risk: sqlmap risk level (1-3).

Returns: Structured result dict (blocked if exploitation is disabled).

wpscan_scanA

Scan a WordPress site for vulnerabilities (wpscan).

TOOL_NAME=wpscan_scan DISPLAY_NAME=WordPress Security Scanner USECASE=Enumerate vulnerable plugins/themes/users on an in-scope WordPress site INSTRUCTIONS=1. Ensure host is in scope, 2. Provide the site URL, 3. Optionally set enumerate options/API token, 4. Call INPUT_DESCRIPTION=target (WordPress URL); enumerate (wpscan --enumerate arg, e.g. "vp,vt,u"); api_token (optional WPScan API token) OUTPUT_DESCRIPTION=Dict with status, wpscan output, command and mode EXAMPLES=wpscan_scan("https://blog.example.com", enumerate="vp,vt,u") PREREQUISITES=Host authorized and in scope RELATED_TOOLS=nuclei_scan, dir_bruteforce

Args: target: WordPress site URL (must be in scope). enumerate: wpscan enumerate specification. api_token: Optional WPScan API token for vulnerability data.

Returns: Structured result dict.

searchsploit_lookupA

Search the offline Exploit-DB for known exploits (searchsploit).

TOOL_NAME=searchsploit_lookup DISPLAY_NAME=Exploit-DB Search USECASE=Find public exploits/PoCs matching a product, version or CVE, fully offline INSTRUCTIONS=1. Provide search terms (product/version/CVE), 2. Call INPUT_DESCRIPTION=query (e.g. "apache 2.4.49" or "CVE-2021-41773") OUTPUT_DESCRIPTION=Dict with status, matching exploit titles/paths, command and mode EXAMPLES=searchsploit_lookup("vsftpd 2.3.4"), searchsploit_lookup("CVE-2021-41773") PREREQUISITES=None — offline database lookup, no target contact RELATED_TOOLS=nuclei_scan, sqlmap_test

Args: query: Free-text search terms.

Returns: Structured result dict. Not scope-gated (offline, no target contact).

hash_identifyA

Identify the likely algorithm(s) of a hash string (hashid).

TOOL_NAME=hash_identify DISPLAY_NAME=Hash Type Identifier USECASE=Determine which hashing algorithm produced a given hash before cracking INSTRUCTIONS=1. Provide the hash string, 2. Call INPUT_DESCRIPTION=hash_value (the hash to identify) OUTPUT_DESCRIPTION=Dict with status, candidate hash types, command and mode EXAMPLES=hash_identify("5f4dcc3b5aa765d61d8327deb882cf99") PREREQUISITES=None — offline, no target contact RELATED_TOOLS=hash_crack

Args: hash_value: The hash string to identify.

Returns: Structured result dict. Not scope-gated (offline).

hash_crackA

Crack supplied hashes offline with a wordlist (John the Ripper).

TOOL_NAME=hash_crack DISPLAY_NAME=Offline Hash Cracker USECASE=Recover plaintext for hashes you already possess, using a wordlist, fully offline INSTRUCTIONS=1. Paste one or more hashes (one per line), 2. Optionally set wordlist and john format, 3. Call INPUT_DESCRIPTION=hashes (newline-separated hash strings); wordlist (path, default rockyou); hash_format (john --format value, e.g. "raw-md5"); name (label for the temp file) OUTPUT_DESCRIPTION=Dict with status, cracked credentials (john --show), command and mode EXAMPLES=hash_crack("5f4dcc3b5aa765d61d8327deb882cf99", hash_format="raw-md5") PREREQUISITES=None — operates only on hashes you supply; no target contact RELATED_TOOLS=hash_identify

Args: hashes: Newline-separated hash strings to crack. wordlist: Wordlist path (defaults to rockyou in the container). hash_format: Optional john --format value. name: Base label for the temporary hash file written under output_dir.

Returns: Structured result dict. Not network-gated (offline), but writes the hashes to a file under the engagement output directory.

hydra_bruteforceA

Brute-force a network login service (hydra). GATED — active exploitation.

TOOL_NAME=hydra_bruteforce DISPLAY_NAME=Hydra Login Brute-Forcer USECASE=Test credential strength against an in-scope network service (ssh, ftp, http-*, etc.) INSTRUCTIONS=1. Enable ALLOW_EXPLOITATION, 2. Ensure target in scope, 3. Provide service + username(s) + password(s)/list, 4. Call INPUT_DESCRIPTION=target (host/IP); service (e.g. ssh, ftp, http-post-form); username OR userlist path; password OR passwordlist path; port (optional) OUTPUT_DESCRIPTION=Dict with status, any valid credentials found, command and mode; blocked if exploitation disabled EXAMPLES=hydra_bruteforce("10.0.0.5", "ssh", username="admin", passwordlist="/wordlists/pw.txt") PREREQUISITES=ALLOW_EXPLOITATION=true AND target authorized and in scope RELATED_TOOLS=nmap_scan, hash_crack

Args: target: Host/IP running the service (must be in scope). service: hydra service module name. username: Single username to try. userlist: Path to a username wordlist (alternative to username). password: Single password to try. passwordlist: Path to a password wordlist (alternative to password). port: Optional service port.

Returns: Structured result dict (blocked if exploitation is disabled).

scope_manageA

Manage the authorized engagement scope (the master authorization gate).

TOOL_NAME=scope_manage DISPLAY_NAME=Engagement Scope Manager USECASE=Declare which targets are authorized, set engagement metadata, and review current scope INSTRUCTIONS=1. Use action=set_engagement with client/authorized_by/ticket, 2. action=add with targets you are permitted to test, 3. action=show to review INPUT_DESCRIPTION=action (show|add|remove|set_engagement|clear); targets (list of IP/CIDR/host/domain for add/remove); client/authorized_by/ticket/start_date/end_date/notes for set_engagement OUTPUT_DESCRIPTION=Dict with status and the resulting scope snapshot EXAMPLES=scope_manage("set_engagement", client="Acme", authorized_by="J. Smith", ticket="PT-42"), scope_manage("add", targets=["10.0.0.0/24","app.acme.com"]) PREREQUISITES=Only add targets you have written authorization to test RELATED_TOOLS=nmap_scan, generate_report, session_summary

Args: action: One of show, add, remove, set_engagement, clear. targets: Targets to add/remove (IPs, CIDRs, hostnames, domains). client: Client/organization name (set_engagement). authorized_by: Person who authorized the test (set_engagement). ticket: Engagement/authorization reference (set_engagement). start_date: Engagement window start (set_engagement). end_date: Engagement window end (set_engagement). notes: Free-text notes (set_engagement).

Returns: Structured result dict with the resulting scope snapshot.

list_tools_statusA

Report which security tools are available on the host and via Kali/Docker.

TOOL_NAME=list_tools_status DISPLAY_NAME=Tool Availability Status USECASE=See, per tool, whether it is installed on the host and whether the Kali container backend is available INSTRUCTIONS=1. Call with no arguments INPUT_DESCRIPTION=None OUTPUT_DESCRIPTION=Dict with per-tool availability grouped by category, plus backend status and current execution mode EXAMPLES=list_tools_status() PREREQUISITES=None RELATED_TOOLS=scope_manage

Returns: Structured result dict describing tool and backend availability.

record_findingA

Record a security finding in the engagement session.

TOOL_NAME=record_finding DISPLAY_NAME=Record Finding USECASE=Capture a vulnerability/observation with severity and evidence for the final report INSTRUCTIONS=1. Provide title, severity, target, 2. Add description/evidence/recommendation, 3. Call INPUT_DESCRIPTION=title; severity (info|low|medium|high|critical); target; description; evidence; recommendation; references (list of URLs/CVEs) OUTPUT_DESCRIPTION=Dict with status and the stored finding EXAMPLES=record_finding("Anonymous FTP enabled","medium","10.0.0.5",evidence="230 Login successful") PREREQUISITES=None RELATED_TOOLS=generate_report, session_summary

Args: title: Short finding title. severity: One of info, low, medium, high, critical. target: Affected target. description: Detailed description. evidence: Supporting evidence/output. recommendation: Remediation guidance. references: List of references (CVEs, URLs).

Returns: Structured result dict with the stored finding.

session_summaryA

Summarize the current engagement: scope, scans, findings, recent audit.

TOOL_NAME=session_summary DISPLAY_NAME=Engagement Summary USECASE=Get a quick status view of the engagement (scope, counts, recent activity) INSTRUCTIONS=1. Call with no arguments INPUT_DESCRIPTION=None OUTPUT_DESCRIPTION=Dict with scope snapshot, session summary counts, and recent audit events EXAMPLES=session_summary() PREREQUISITES=None RELATED_TOOLS=generate_report, scope_manage

Returns: Structured result dict summarizing the engagement.

generate_reportA

Generate an engagement report from recorded scans and findings.

TOOL_NAME=generate_report DISPLAY_NAME=Engagement Report Generator USECASE=Produce a shareable markdown or JSON report of scope, activity and findings INSTRUCTIONS=1. Record findings during testing, 2. Call with report_format markdown|json INPUT_DESCRIPTION=report_format (markdown|json) OUTPUT_DESCRIPTION=Dict with status, the report content, and the path it was written to under the output directory EXAMPLES=generate_report("markdown") PREREQUISITES=None (more useful after findings are recorded) RELATED_TOOLS=record_finding, session_summary

Args: report_format: markdown or json.

Returns: Structured result dict with the report content and file path.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/bsahane/kali-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server