これは、nmap ネットワーク スキャン機能へのアクセスを提供するモデル制御プロトコル (MCP) サーバーです。
カスタマイズ可能なオプションを使用して、指定したターゲットで nmap スキャンを実行します。
スキャン結果の保存と取得
AIプロンプトを使用してスキャン結果を分析する
Related MCP server: Nmap MCP Server
要件：
Python 3.10以上
Python-libnmap
nmap（システムにインストール済み）
pip install python-libnmapシステムに nmap がインストールされていることを確認してください。
# On Debian/Ubuntu
sudo apt-get install nmap
# On Fedora/CentOS
sudo dnf install nmapソース コードから直接サーバーを実行するには:
python -m src.nmap_mcpパッケージをインストールしてコマンドとして実行するには:
pip install -e .
nmap-mcpnmapスキャンを実行する
指定したターゲットに対して nmap スキャンを実行する
パラメータ:
target : ターゲットホストまたはネットワーク（例：192.168.1.1 または 192.168.1.0/24）
options : Nmapオプション（例：-sV -p 1-1000）
スキャンの詳細を取得する
特定のスキャンに関する詳細情報を取得する
パラメータ:
scan_id : 取得するスキャンのID
すべてのスキャンをリストする
利用可能なすべてのスキャン結果を一覧表示する
パラメータは必要ありません
分析スキャン
nmapスキャン結果を分析する
パラメータ:
scan_id : 分析するスキャンのID
focus : 重点分野（セキュリティ/サービス/概要）
スキャン結果はnmap://scan/{scan_id} URI スキームを持つリソースとして利用できます。
スキャンを実行します:
Call tool: run-nmap-scan
Parameters: {"target": "192.168.1.0/24", "options": "-sV -p 22,80,443"}スキャンの詳細を取得します:
Call tool: get-scan-details
Parameters: {"scan_id": "<scan_id from previous step>"}すべてのスキャンを一覧表示します:
Call tool: list-all-scansスキャン結果を分析します。
Get prompt: analyze-scan
Parameters: {"scan_id": "<scan_id>", "focus": "security"}このサーバーは、システム上で nmap コマンドを実行します。所有していないネットワークやスキャン権限のないネットワークをスキャンする場合は、一部の法域では許可されていないスキャンが違法となる可能性があるため、ご注意ください。
nmap が見つからない、または正しく実行されないことに関連するエラーが発生した場合:
nmapがインストールされ、PATHで利用可能であることを確認してください
nmap実行ファイルが使用されているログを確認します
サーバーは衝突を避けるためにnmapへのフルパスを使用しようとします
MCP サーバーを Docker コンテナ内で実行できます。
# Build the Docker image
docker build -t nmap-mcp-server .
# Run the Docker container
docker run -it --rm nmap-mcp-serverGlama MCP ディレクトリとの統合では、Docker コンテナにより、インストールの依存関係を気にすることなく他のユーザーがこの MCP サーバーを簡単に使用できるようになります。
このプロジェクトは MIT ライセンスに基づいてライセンスされています - 詳細についてはLICENSEファイルを参照してください。
Get detailed information about a specific scan
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | ID of the scan to retrieve |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves information, implying a read-only operation, but lacks details on permissions, rate limits, error handling, or what 'detailed information' includes (e.g., format, fields). This is inadequate for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded with the core action and resource, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what 'detailed information' entails (e.g., scan results, status, metadata), leaving the agent uncertain about the return values. For a tool with no structured output documentation, this gap is significant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the single parameter 'scan_id' well-documented in the schema. The description adds no additional meaning beyond implying retrieval of a 'specific scan', which aligns with the schema but doesn't provide extra context like ID format or examples. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get detailed information') and resource ('about a specific scan'), making the purpose immediately understandable. It distinguishes from the sibling 'list-all-scans' by focusing on a single scan rather than multiple scans, though it doesn't explicitly differentiate from 'run-nmap-scan' beyond the verb difference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided on when to use this tool versus alternatives. The description implies usage for retrieving details of a known scan, but it doesn't mention prerequisites (e.g., needing a scan ID from 'list-all-scans') or contrast with siblings like 'run-nmap-scan' for creating scans.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all available scan results
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but only states the action without details on permissions, rate limits, pagination, or response format. It doesn't clarify if this lists historical scans, real-time results, or includes metadata, leaving significant gaps in understanding how the tool behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any fluff or redundancy. It's front-loaded and wastes no words, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and sibling tools, the description is incomplete. It doesn't address behavioral traits like safety, performance, or how results are returned, nor does it help differentiate from alternatives, leaving the agent with insufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description doesn't add parameter details, but this is appropriate given the schema's completeness, warranting a baseline score above minimum viable due to the lack of parameters to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all available scan results'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'get-scan-details' or 'run-nmap-scan' beyond the basic listing action, which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get-scan-details' for specific scan details or 'run-nmap-scan' to initiate new scans. It lacks context about prerequisites, timing, or exclusions, leaving the agent to infer usage from tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run an nmap scan on specified targets
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Target host or network (e.g., 192.168.1.1 or 192.168.1.0/24) | |
| options | No | Nmap options (e.g., -sV -p 1-1000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('Run an nmap scan') but doesn't describe what this entails—such as network impact, execution time, permission requirements, or output format. For a tool that likely performs network scanning, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's purpose without unnecessary details. It's appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of running an nmap scan (a network operation with potential side effects), the description is incomplete. With no annotations, no output schema, and minimal behavioral context, it fails to provide enough information for safe and effective use. The agent lacks details on execution behavior, results, or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters ('target' and 'options') with clear descriptions. The description adds no additional meaning beyond what the schema provides, such as example usage or constraints, resulting in a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Run') and resource ('nmap scan on specified targets'), making the purpose immediately understandable. It doesn't differentiate from sibling tools like 'get-scan-details' or 'list-all-scans', which are clearly different operations, so it doesn't need explicit sibling differentiation for a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites like network access or permissions, nor does it explain when to choose this over siblings like 'get-scan-details' or 'list-all-scans'. This lack of context leaves the agent with minimal usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
get-scan-detailslist-all-scansrun-nmap-scanScored across 3 tools
Each tool has a clearly distinct purpose with no overlap: get-scan-details retrieves specific scan information, list-all-scans shows all available results, and run-nmap-scan performs new scans. The actions (get, list, run) and targets (details, scans, scan) are well-differentiated, making misselection unlikely.
All tools follow a consistent verb-noun pattern with hyphens (get-scan-details, list-all-scans, run-nmap-scan). The naming is predictable and readable, using clear action words and descriptive nouns without any deviations in style or convention.
With only 3 tools, the server feels thin for an nmap domain, which typically involves more operations like managing scan configurations, exporting results, or filtering scans. While the core functions are covered, the limited count may restrict agent flexibility in complex scenarios.
The tools cover the basic lifecycle of running, listing, and retrieving scans, but there are minor gaps such as updating or deleting scans, or handling scan parameters more granularly. Agents can work around these with the existing tools, but the surface is not fully comprehensive.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Scans remote MCP servers for protocol, security, and TLS issues; exposes scan tools via MCP.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
