Provides tools for GraphQL API security testing, including scanning for vulnerabilities and testing authentication and authorization.
Grants AI agents direct access to a Kali Linux penetration testing toolkit, enabling execution of a wide range of security tools such as nmap, sqlmap, and netexec.
Enables persistent interaction with Metasploit Framework sessions, allowing exploitation, post-exploitation, and payload generation.
Allows connecting to and managing OpenVPN connections for lab environments.
Allows connecting to and managing WireGuard connections for lab environments.
Provides WordPress vulnerability scanning via wpscan.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@chungus-kali-mcp Scan target.htb with nmap and show open ports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that gives AI agents (Cursor, Claude, Copilot, etc.) direct access to a Kali Linux penetration testing toolkit. The MCP server runs natively on your Kali VM as a single Node.js process — tool calls spawn CLI commands directly on the host. No Docker, no Flask, no HTTP middle layer.
Inspired by zebbern-kali-mcp. See ATTRIBUTION.md.
Related MCP server: Kali-Mcp-Toolkit
Unlike the upstream Docker design (MCP client on host → HTTP → Flask in container), chungus-kali-mcp is a single-process server:
┌─────────────────────────────────────────────────────────────┐
│ Kali Linux VM │
│ │
│ AI Agent (Cursor / Claude / Copilot) │
│ │ │
│ ▼ MCP (stdio) │
│ chungus-kali-mcp (Node.js) │
│ │ │
│ ├── src/tools/ 155 MCP tool handlers │
│ ├── src/managers/ SSH, MSF, pivot, VPN, … │
│ ├── src/runners/ kali-tools, forensics, js │
│ ├── src/parsers/ output-parser │
│ └── child_process / node-pty │
│ │ │
│ ▼ │
│ Kali CLI tools (nmap, sqlmap, impacket-*, netexec, …) │
└─────────────────────────────────────────────────────────────┘Component | Location | Role |
MCP server |
| Registers 155 tools, speaks MCP over stdio |
Tool handlers |
| Zod-validated inputs → manager/runner calls |
Managers |
| Stateful sessions (SSH, reverse shells, Metasploit, pivot, VPN, callback catcher, CTF) |
Runners |
| Stateless CLI wrappers (kali-tools, forensics, js-analysis) |
Parsers |
| Structured output parsing (nmap XML, nuclei JSONL, gobuster text) |
Network init |
| HTB routes, |
Request flow: AI Agent → MCP tool → Node handler → spawn / node-pty → Kali CLI → JSON result back.
git clone <your-repo-url>
cd chungus-kali-mcp
npm install
npm run buildVerify the server starts (it will wait on stdio for an MCP client):
node dist/index.js
# Ctrl+C to exit — normally Cursor/VS Code launches this for youOptional: link the binary globally:
npm link
# then use command "chungus-kali-mcp" in MCP configProject config (.cursor/mcp.json or .vscode/mcp.json):
{
"mcpServers": {
"chungus-kali-mcp": {
"command": "node",
"args": ["/path/to/chungus-kali-mcp/dist/index.js"]
}
}
}Or with npm link:
{
"mcpServers": {
"chungus-kali-mcp": {
"command": "chungus-kali-mcp"
}
}
}Restart the editor — the agent can now call all 155 tools.
Stock Kali packages cover most APT tools. To match the parent Docker image extras (Go tools, pip tools, /opt clones):
sudo ./scripts/kali-docker-parity.sh # essentials
sudo ./scripts/kali-docker-parity.sh --full # + PEAS, PetitPotam, krbrelayx, etc.export HTB_ROUTES=10.129.0.0/16,10.10.0.0/16
export EXTRA_HOSTS=target.htb:10.10.10.5
./scripts/kali-init.shNetwork init also runs automatically when the MCP server starts.
19 modules, 155 tools total. Full spec in TOOL_CATALOG.json.
# | Module | Tools | Description |
1 |
| 35 | Nmap, Nikto, Gobuster, Dirb, SQLMap, Hydra, John, Nuclei, FFuf, Hashcat, Commix, Dalfox, WhatWeb, masscan, katana, amass, and more |
2 |
| 15 | Active Directory — netexec, BloodHound, impacket, Responder, evil-winrm, certipy, bloodyAD, coercion |
3 |
| 6 | binwalk, steghide, exiftool, foremost, strings, Volatility3 |
4 |
| 6 | getJS, jsluice, xnLinkFinder, ParamSpider, TruffleHog, js-beautify |
5 |
| 6 |
|
6 |
| 8 | SSH session lifecycle — connect, execute, upload/download, transfer estimates |
7 |
| 8 | Reverse shell listeners, commands, payload generation, file transfer |
8 |
| 5 | Persistent |
9 |
| 13 | Chisel, Ligolo-ng, SSH tunnels, socat, ProxyChains config |
10 |
| 3 | WireGuard & OpenVPN connect/disconnect/status |
11 |
| 11 | GraphQL, JWT, FFUF, Nuclei, rate-limit and auth-bypass tests |
12 |
| 3 | URL (whatweb + fetch fallback), WAF, security headers |
13 |
| 5 | searchsploit search, nmap-based suggestions, exploit copy |
14 |
| 6 | msfvenom generation, HTTP hosting, one-liners |
15 |
| 4 | Upload/download on Kali and target sessions (chunked + SHA256) |
16 |
| 9 | Built-in HTTP + DNS callback listener for isolated networks |
17 |
| 7 | CTFd API — challenges, flags, scoreboard |
18 |
| 4 |
|
19 |
| 1 | Structured parsing of nmap XML, nuclei JSONL, gobuster text |
Upstream | chungus-kali-mcp |
|
|
| (removed — direct execution) |
|
|
chungus-kali-mcp does not bundle tools — it expects a standard Kali install (or equivalent). Run sudo ./scripts/kali-docker-parity.sh for Docker-image parity. The health tool reports availability by category (network, web, dns, brute, ad, forensics, js, pivot, exploit).
Tool | Description |
nmap | Port scanning, service/version detection, NSE scripts |
masscan | High-speed port scanner |
sslscan | SSL/TLS configuration analysis |
Tool | Description |
nikto | Web server vulnerability scanner |
gobuster | Directory/file/DNS brute-forcing |
dirb | Web content scanner |
wpscan | WordPress vulnerability scanner |
sqlmap | Automated SQL injection |
ffuf | Fast web fuzzer |
nuclei | Template-based vulnerability scanner |
katana | Web crawler |
amass | Attack surface mapping |
commix | Command injection exploitation |
ghauri | Advanced SQL injection detection |
dalfox | XSS scanning and exploitation |
byp4xx | 403 Forbidden bypass |
whatweb | Technology detection |
Tool | Description |
subfinder | Passive subdomain discovery |
httpx | HTTP probing and technology detection |
assetfinder | Subdomain discovery via various sources |
waybackurls | URLs from the Wayback Machine |
fierce | DNS reconnaissance |
subzy | Subdomain takeover checking |
massdns | High-performance DNS resolver |
mapcidr | CIDR range manipulation |
Tool | Description |
hydra | Network login brute-forcer |
john | John the Ripper password cracker |
hashcat | GPU-accelerated hash cracking |
Tool | Description |
netexec | SMB/LDAP/WinRM (replaces crackmapexec) |
impacket-* | AD attack scripts (secretsdump, GetNPUsers, psexec, wmiexec, …) |
bloodhound-python | AD relationship graphing |
certipy-ad | ADCS exploitation |
bloodyAD | AD privilege escalation |
responder | LLMNR/NBT-NS poisoner |
evil-winrm | WinRM shell with upload/download |
coercer / petitpotam | Authentication coercion |
ldapdomaindump | LDAP domain information |
Tool | Description |
getJS | Extract JavaScript files from pages |
jsluice | Extract URLs, paths, and secrets from JS |
xnLinkFinder | Link and parameter discovery from JS |
ParamSpider | Parameter discovery from web archives |
TruffleHog | Secret scanning across repos and files |
js-beautify | JavaScript deobfuscation/beautification |
Tool | Description |
binwalk | Firmware analysis and file extraction |
steghide / stegseek | Steganography tools |
exiftool | Metadata reader/writer |
foremost | File carving/recovery |
volatility3 | Memory forensics framework |
radare2 | Reverse engineering (quick triage via strings tool) |
sleuthkit | Disk forensics utilities |
Tool | Description |
metasploit-framework |
|
searchsploit | Exploit-DB search |
Tool | Description |
jwt_tool | JWT analysis and exploitation |
clairvoyance | GraphQL schema introspection |
Tool | Description |
chisel | TCP/UDP tunnel over HTTP |
ligolo-proxy | Ligolo-ng tunneling |
socat | Port forwarding and relay |
openvpn, wg-quick | VPN clients |
proxychains4 | Proxy routing |
--full setup)Tool | Location |
LinPEAS |
|
WinPEAS |
|
Default paths reference Kali standard locations: rockyou.txt, SecLists, /usr/share/wordlists/dirb/.
Variable | Default | Description |
|
| Working directory for scans, payloads, CTF files |
|
| Directory for VPN config files ( |
| — | Comma-separated CIDRs to route (e.g. |
| — | Comma-separated |
|
| Streaming startup detection timeout (seconds) |
Place OpenVPN or WireGuard configs in VPN_DIR (default ~/.chungus-kali-mcp/vpn/), then use the vpn_connect MCP tool.
Package | Purpose |
| MCP server protocol |
| Tool input validation |
| Metasploit PTY sessions |
Decision | Rationale |
Native VM, no Docker | Direct access to host network, VPN interfaces ( |
Single Node process | Eliminates HTTP client/server split; lower latency, simpler deployment |
CLI spawning | Reuses Kali's installed tools ( |
Custom callback catcher | HTTP + DNS listener for isolated CTF/pentest networks where webhook.site can't reach targets |
Heavy-task semaphore | Max 5 concurrent long scans (nmap, nuclei, gobuster) to avoid overwhelming the VM |
TOOL_CATALOG.json | Machine-readable contract for all 155 tools; parity-tested in CI |
chungus-kali-mcp/
├── src/
│ ├── index.ts # MCP server entry (stdio)
│ ├── config.ts # paths, env vars
│ ├── lib/ # command-executor, tool-config, session-registry, health
│ ├── tools/ # MCP tool registration (155 tools)
│ ├── managers/ # SSH, reverse shell, MSF, pivot, VPN, callback, CTF, AD, …
│ ├── runners/ # Stateless CLI wrappers (kali-tools, forensics, js)
│ └── parsers/ # output-parser (nmap XML, nuclei JSONL, gobuster text)
├── scripts/
│ ├── kali-init.sh # HTB routes, hosts, TUN setup
│ ├── kali-docker-parity.sh # Install Docker-image tool parity on Kali VM
│ └── extract-catalog.py # (upstream only) regenerate from parent Python reference
├── test/ # Catalog + registration parity tests
├── .github/workflows/ci.yml # GitHub CI (build, lint, test)
├── .gitignore
├── CHEATSHEET.md # Quick reference for all 155 MCP tools
├── TOOL_CATALOG.json # All 155 tools — source of truth
├── COMMAND_PATTERNS.md # Handler types and command patterns
├── ATTRIBUTION.md # Credit to original zebbern-kali-mcp author
├── package.json
└── README.mdOnce connected, ask your AI assistant to use the Kali tools:
"Scan 10.10.10.5 with nmap" "Run nuclei against example.com" "Connect to the HTB VPN and start recon" "Enumerate AD with bloodhound against dc01.corp.local" "Start a callback listener on port 8080"
The assistant calls MCP tools directly on the Kali VM — no manual commands needed.
npm run dev # tsx src/index.ts (stdio MCP server)
npm run build # compile to dist/
npm run lint # tsc --noEmit
npm test # verify 155 tools registered vs TOOL_CATALOG.json
npm run extract-catalog # (upstream only) regenerate from parent Python referenceSee AGENTS.md for contributor/agent guidance.
This server provides unrestricted access to powerful penetration testing tools.
Never expose the Kali VM to the public internet
Only run on isolated networks or authorized test environments
Ensure you have proper authorization before testing any systems
The server typically runs as root on Kali — required for many pentest tools but increases risk
MCP uses stdio transport — only local editor/agent processes should launch the server
Contributions welcome. Please open a pull request with a clear summary and test notes (npm test must pass).
Built on the Model Context Protocol · Node.js reimplementation of zebbern-kali-mcp by Zebbern
AS-REP roasting.
Inputs: domain (required), username (required), dc_ip.
BloodHound collection.
Inputs: domain (required), password (required), username (required), dc_ip, +1 more.
AD privilege escalation via bloodyAD.
Inputs: domain (required), password (required), username (required), host, +2 more.
ADCS attacks via certipy-ad.
Inputs: domain, target, password, username, +2 more.
Coerce authentication (coercer or petitpotam).
Inputs: target (required), tool, listener, additional_args.
WinRM shell via evil-winrm.
Inputs: target (required), password (required), username (required), additional_args.
Kerberoasting.
Inputs: domain (required), password (required), username (required).
LDAP enumeration.
Inputs: domain (required), target (required), password (required), username (required).
Password spray.
Inputs: target (required), password (required), users, userlist.
PsExec.
Inputs: domain (required), target (required), password (required), username (required).
Start Responder LLMNR/NBT-NS poisoner.
Inputs: analyze, interface, additional_args.
Impacket secretsdump.
Inputs: target (required), password (required), username (required).
SMB enumeration.
Inputs: target (required), domain, password, username.
Check AD tool availability.
Inputs: no named parameters.
WMIExec.
Inputs: domain (required), target (required), password (required), username (required).
Test auth bypass.
Inputs: url (required), method, headers.
FFUF fuzz.
Inputs: url (required), wordlist (required), method, extensions.
Fuzz API endpoint.
Inputs: url (required), method, wordlist.
GraphQL fuzz.
Inputs: url (required), depth, query.
GraphQL introspection.
Inputs: url (required).
Analyze JWT.
Inputs: token (required).
Crack JWT.
Inputs: token (required), wordlist.
Kiterunner scan.
Inputs: url (required), wordlist.
Run Newman collection.
Inputs: collection (required), environment.
Nuclei API scan.
Inputs: url (required), tags, severity.
Test rate limiting.
Inputs: url (required), method, requests_count.
Check callback token.
Inputs: token (required).
Clear callbacks.
Inputs: no named parameters.
Generate callback URL.
Inputs: base_url (required), path_prefix.
Latest callback.
Inputs: no named parameters.
List callbacks.
Inputs: limit, protocol.
Start callback catcher.
Inputs: port (required), host, dns_port, enable_dns.
Callback catcher status.
Inputs: no named parameters.
Stop callback catcher.
Inputs: no named parameters.
Wait for callback.
Inputs: timeout, protocol.
Connect to CTF platform.
Inputs: url (required), cookies, platform, api_token.
Download CTF file.
Inputs: file_url (required), output_dir.
Get CTF challenge.
Inputs: challenge_id (required).
List CTF challenges.
Inputs: category.
CTF scoreboard.
Inputs: top.
CTF connection status.
Inputs: no named parameters.
Submit CTF flag.
Inputs: flag (required), challenge_id (required).
Audit package.
Inputs: package (required).
Search CVEs.
Inputs: query (required), exact.
Execute a command with streaming output collection.
Inputs: command (required), timeout.
Copy exploit to destination.
Inputs: edb_id (required), destination.
Get exploit details.
Inputs: edb_id (required).
Search exploits via searchsploit.
Inputs: query (required), exact.
Suggest exploits for a service.
Inputs: service (required), version.
Suggest exploits from nmap output.
Inputs: nmap_output (required).
Analyze security headers.
Inputs: url (required).
Fingerprint a URL.
Inputs: url (required).
Detect WAF.
Inputs: url (required).
Analyze firmware/files with binwalk.
Inputs: file (required), extract, additional_args.
Read/write file metadata with exiftool.
Inputs: file (required), additional_args.
Carve files with foremost.
Inputs: file (required), output_dir, additional_args.
Steganography with steghide or stegseek.
Inputs: file (required), action, outfile, wordlist, +2 more.
Extract strings from a binary.
Inputs: file (required), min_len, use_radare2, additional_args.
Memory forensics with Volatility3.
Inputs: memory_file (required), plugin, additional_args.
Check server health and tool availability.
Inputs: no named parameters.
Add entries to /etc/hosts.
Inputs: ip (required), hostnames (required).
Clear managed /etc/hosts entries.
Inputs: no named parameters.
List managed /etc/hosts entries.
Inputs: no named parameters.
Remove hostname from /etc/hosts.
Inputs: hostname (required).
Deobfuscate/beautify JavaScript.
Inputs: file (required), additional_args.
Extract JavaScript files from a URL.
Inputs: url (required), additional_args.
Extract URLs and secrets from JavaScript.
Inputs: url, file, additional_args.
Discover parameters from web archives.
Inputs: domain (required), additional_args.
Scan for secrets with TruffleHog.
Inputs: path, target, additional_args.
Discover links and parameters from JavaScript.
Inputs: url (required), additional_args.
Download file from Kali.
Inputs: remote_path (required), verify_checksum.
Execute ANY command on the Kali server without restrictions. Full root access.
Inputs: command (required), cwd, timeout, background.
Upload file on Kali.
Inputs: content (required), local_path (required), remote_path (required).
Create msfconsole session.
Inputs: no named parameters.
Destroy MSF session.
Inputs: session_id (required).
Destroy all MSF sessions.
Inputs: no named parameters.
Execute in msfconsole.
Inputs: command (required), session_id (required), timeout, read_delay.
List MSF sessions.
Inputs: no named parameters.
Parse raw security tool output into structured JSON.
Inputs: output (required), tool_name (required), output_format.
Generate payload.
Inputs: lhost (required), nops, lport, encoder, +6 more.
Start payload HTTP host.
Inputs: port.
Stop payload HTTP host.
Inputs: no named parameters.
List generated payloads.
Inputs: no named parameters.
Generate reverse shell one-liners.
Inputs: lhost (required), lport, shell_type.
List msfvenom templates.
Inputs: no named parameters.
Add pivot route.
Inputs: name (required), network (required), interface (required).
Start chisel client.
Inputs: remote (required), server (required), local.
Start chisel server.
Inputs: port, reverse.
Generate proxychains config.
Inputs: proxy_type, socks_port.
Start ligolo proxy.
Inputs: port, interface.
List pivots.
Inputs: no named parameters.
List pivot tunnels.
Inputs: no named parameters.
Socat port forward.
Inputs: listen_port (required), target_host (required), target_port (required).
SSH dynamic SOCKS.
Inputs: local_port (required), ssh_target (required).
SSH local port forward.
Inputs: local_port (required), ssh_target (required), remote_host (required), remote_port (required).
SSH remote port forward.
Inputs: local_host (required), local_port (required), ssh_target (required), remote_port (required).
Stop all tunnels.
Inputs: no named parameters.
Stop pivot tunnel.
Inputs: tunnel_id (required).
Read output from any active interactive session.
Inputs: session_id (required), lines, timeout.
Run command in reverse shell.
Inputs: command (required), session_id (required), timeout.
Download via reverse shell.
Inputs: session_id (required), remote_file (required).
Generate reverse shell payload.
Inputs: lhost (required), lport (required), payload_type.
Start reverse shell listener.
Inputs: port (required), listener_type.
Send payload via reverse shell.
Inputs: session_id (required), payload_command (required), timeout, wait_seconds.
Reverse shell status.
Inputs: session_id.
Stop reverse shell.
Inputs: session_id (required).
Upload content via reverse shell.
Inputs: content (required), session_id (required), remote_path (required).
Send text input to any active interactive session.
Inputs: input_text (required), session_id (required), session_type.
Estimate transfer time.
Inputs: file_size_bytes (required), operation.
Run SSH command.
Inputs: command (required), session_id (required), timeout.
Download via SSH.
Inputs: session_id (required), remote_path (required).
List SSH sessions.
Inputs: no named parameters.
Start SSH session.
Inputs: host (required), username (required), port, key_file, +1 more.
SSH session status.
Inputs: session_id (required).
Stop SSH session.
Inputs: session_id (required).
Upload via SSH.
Inputs: content (required), session_id (required), remote_path (required).
Get comprehensive network information for the Kali system.
Inputs: no named parameters.
Download from target session.
Inputs: session_id (required), remote_path (required), session_type, verify_checksum.
Upload to target session.
Inputs: content (required), session_id (required), remote_path (required), session_type.
Execute amass.
Inputs: domain (required), additional_args.
Execute arjun.
Inputs: url (required), method, threads, additional_args.
Execute assetfinder.
Inputs: domain (required), additional_args.
Execute byp4xx.
Inputs: url (required), method, additional_args.
Execute Commix command injection scanner.
Inputs: url (required), data, additional_args.
Query crt.sh.
Inputs: domain, target.
Execute Dalfox XSS scanner.
Inputs: url (required), additional_args.
Execute Dirb web content scanner.
Inputs: url (required), wordlist, additional_args.
Execute enum4linux.
Inputs: target (required), additional_args.
Execute FFUF web fuzzer.
Inputs: url (required), method, wordlist, extensions, +1 more.
Execute fierce.
Inputs: domain (required), additional_args.
Execute Ghauri SQL injection scanner.
Inputs: url (required), data, additional_args.
Execute Gobuster.
Inputs: url (required), mode, threads, wordlist, +3 more.
Execute gowitness.
Inputs: url (required), additional_args.
Execute Hashcat.
Inputs: hash_file (required), mode, wordlist, additional_args.
Execute httpx.
Inputs: target (required), additional_args.
Execute Hydra.
Inputs: target (required), service (required), port, wait, +6 more.
Execute John.
Inputs: hash_file (required), wordlist, format_type, additional_args.
Execute katana.
Inputs: url (required), additional_args.
Execute mapcidr CIDR utilities.
Inputs: cidr (required), additional_args.
Execute masscan.
Inputs: target (required), rate, ports, additional_args.
Execute MassDNS resolver.
Inputs: domain, wordlist, resolvers, additional_args.
Execute Nikto.
Inputs: target (required), tuning, output_format, additional_args.
Execute an Nmap scan.
Inputs: target (required), ports, scan_type, output_format, +1 more.
Execute Nuclei vulnerability scan.
Inputs: target (required), severity, templates, additional_args.
Execute SQLMap.
Inputs: url (required), dbs, data, dump, +5 more.
Execute ssh-audit.
Inputs: target (required), port, timeout, scan_type, +2 more.
Execute sslscan.
Inputs: target (required), additional_args.
Execute subfinder.
Inputs: target (required), additional_args.
Execute subzy.
Inputs: target (required), additional_args.
Execute waybackurls.
Inputs: domain (required), additional_args.
Execute WhatWeb technology detection.
Inputs: url (required), additional_args.
Execute WPScan.
Inputs: url (required), api_token, enumerate, output_format, +1 more.
Connect VPN.
Inputs: config_file (required), vpn_type, socks_port, enable_socks.
Disconnect VPN.
Inputs: no named parameters.
VPN status.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 155 tools
Most tools have clearly distinct purposes, with domain-specific prefixes (tools_, forensics_, ad_, etc.) that clarify intent. However, some overlap exists, such as kali_exec vs exec_stream both executing arbitrary commands, and tools_ffuf vs api_ffuf_fuzz having very similar functionality with only context differentiating them.
The naming is dominated by domain prefixes (e.g., reverse_shell_, pivot_, ctf_), but the verb/noun order varies considerably across the set. Some tools use noun_verb (hosts_list, exploit_search), others use verb_noun (cve_search, send_input), and some are bare tool names (tools_nmap, ad_responder). This mixing is readable but not fully consistent.
With 155 tools, the server is extremely over-scoped. The number far exceeds the typical 3-15 range and even the '50+' threshold for an extreme mismatch. This overwhelming count makes it difficult for an agent to efficiently select the right tool, severely reducing coherence.
The tool set covers a broad penetration testing lifecycle: recon (nmap, subfinder), exploitation (searchsploit, msf), post-exploitation (reverse shells, SSH, pivoting), AD attacks, web/API testing, forensics, and CTF helpers. The coverage is quite thorough, with only minor gaps such as a generic session manager to enumerate all active interactive sessions.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
214 tools for AI agents over one MCP endpoint: image, video, audio, 3D, data, storage, mail, GPUs.
