# Clone or download the project
cd kali-mcp-server

# Build the Docker image
docker-compose build

# Start the server
docker-compose up -d

# Check logs
docker-compose logs -f

# Verify it's running
curl http://localhost:8010/health

docker build -t kali-mcp-server:latest .

docker run -d \
  --name kali-mcp \
  --cap-add NET_RAW \
  --cap-add NET_ADMIN \
  -p 8010:8010 \
  -v kali-outputs:/app/outputs \
  kali-mcp-server:latest

{
  "mcpServers": {
    "kali-pentest": {
      "url": "http://localhost:8010/sse"
    }
  }
}

{
  "mcpServers": {
    "kali-pentest": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--cap-add=NET_RAW",
        "--cap-add=NET_ADMIN",
        "-p", "8010:8010",
        "kali-mcp-server:latest"
      ]
    }
  }
}

nmap_scan(
    target="192.168.1.1",           # IP, hostname, or CIDR
    ports="80,443,8080",            # Port specification
    scan_type="version",            # default, syn, connect, udp, version, aggressive, vuln
    scripts="http-enum,ssl-enum",   # NSE scripts
    timing=3,                       # 0-5 (paranoid to insane)
    timeout=600
)

nikto_scan(
    target="http://example.com",
    port=80,
    ssl=False,
    tuning="123bde",    # Test categories
    timeout=600
)

sqlmap_scan(
    target_url="http://example.com/page?id=1",
    data="username=admin",          # POST data
    parameter="id",                 # Specific param to test
    level=3,                        # 1-5
    risk=2,                         # 1-3
    technique="BEUST",              # Injection techniques
    dbms="mysql",                   # Target DBMS
    tables=True,                    # Enumerate tables
    timeout=600
)

wpscan_scan(
    target="http://wordpress-site.com",
    enumerate="vp,vt,u",            # plugins, themes, users
    plugins_detection="aggressive",
    api_token="your_token"
)

dirb_scan(
    target="http://example.com",
    wordlist="big",                 # common, big, small
    extensions="php,html,txt",
    recursive=True,
    timeout=600
)

gobuster_scan(
    target="http://example.com",
    mode="dir",                     # dir, dns, vhost
    wordlist="medium",
    extensions="php,html",
    threads=40,
    timeout=600
)

ffuf_fuzz(
    target="http://example.com/FUZZ",
    wordlist="common",
    method="GET",
    headers="X-Custom:value",
    filter_code="404,500",
    threads=50
)

whatweb_scan(
    target="http://example.com",
    aggression=3                    # 1-4
)

wafw00f_detect(
    target="http://example.com",
    list_all=True
)

sslscan_scan(
    target="example.com",
    port=443,
    show_certs=True
)

searchsploit_search(
    search_term="apache 2.4.49",
    exact_match=False,
    exclude="dos,windows"
)

nuclei_scan(
    target="http://example.com",
    templates="cves,vulnerabilities",
    severity="high,critical",
    tags="rce,sqli",
    rate_limit=150
)

; | & ` $ ( ) { } > < || && ../ %00 \n \r

cap_add:
  - NET_RAW           # Required for SYN scans
  - NET_ADMIN         # Network configuration
  - NET_BIND_SERVICE  # Bind to low ports

1. Reconnaissance
   ├── whatweb_scan          # Identify technologies
   ├── wafw00f_detect        # Check for WAF
   └── nmap_scan (ports)     # Open ports/services

2. Discovery
   ├── gobuster_scan (dir)   # Directory enumeration
   ├── gobuster_scan (dns)   # Subdomain enumeration
   └── ffuf_fuzz             # Parameter fuzzing

3. Vulnerability Assessment
   ├── nikto_scan            # General web vulnerabilities
   ├── nuclei_scan           # Template-based scanning
   ├── sslscan_scan          # SSL/TLS issues
   └── wpscan_scan           # If WordPress detected

4. Targeted Testing
   ├── sqlmap_scan           # SQL injection
   └── searchsploit_search   # Find exploits

5. Reporting
   └── Review /app/outputs   # All scan results saved

kali-mcp-server/
├── Dockerfile              # Kali Linux container setup
├── docker-compose.yml      # Orchestration
├── requirements.txt        # Python dependencies
├── README.md              # This file
├── src/
│   ├── __init__.py
│   ├── main.py            # FastMCP server & tools
│   ├── validators.py      # Input sanitization
│   ├── formatters.py      # Output formatting
│   └── config.py          # Settings management
├── config/
│   └── claude_desktop_config.json
├── scripts/               # Helper scripts
└── wordlists/            # Custom wordlists

# Check logs
docker-compose logs kali-mcp

# Verify capabilities
docker run --rm --cap-add NET_RAW kali-mcp-server nmap --version

# Increase timeout
docker-compose exec kali-mcp env DEFAULT_TIMEOUT=900

# Or pass timeout parameter
nmap_scan(target="...", timeout=900)

# Ensure proper capabilities
docker run --cap-add NET_RAW --cap-add NET_ADMIN ...

# Enter container and verify
docker-compose exec kali-mcp which nmap nikto sqlmap