이는 nmap 네트워크 스캐닝 기능에 대한 액세스를 제공하는 모델 제어 프로토콜(MCP) 서버입니다.
사용자 정의 가능한 옵션을 사용하여 지정된 대상에 대한 nmap 스캔을 실행합니다.
스캔 결과 저장 및 검색
AI 프롬프트를 사용하여 스캔 결과 분석
Related MCP server: Nmap MCP Server
요구 사항:
파이썬 3.10+
파이썬-libnmap
nmap(시스템에 설치됨)
지엑스피1
시스템에 nmap이 설치되어 있는지 확인하세요:
# On Debian/Ubuntu
sudo apt-get install nmap
# On Fedora/CentOS
sudo dnf install nmap소스 코드에서 직접 서버를 실행하려면:
python -m src.nmap_mcp패키지를 설치하고 명령으로 실행하려면:
pip install -e .
nmap-mcp실행-nmap-스캔
지정된 대상에 대해 nmap 스캔을 실행합니다.
매개변수:
target : 대상 호스트 또는 네트워크(예: 192.168.1.1 또는 192.168.1.0/24)
options : Nmap 옵션(예: -sV -p 1-1000)
스캔 세부 정보 가져오기
특정 스캔에 대한 자세한 정보를 얻으세요
매개변수:
scan_id : 검색할 스캔의 ID
모든 스캔 목록
사용 가능한 모든 스캔 결과 나열
매개변수가 필요하지 않습니다
분석-스캔
nmap 스캔 결과 분석
매개변수:
scan_id : 분석할 스캔의 ID
focus : 집중 분야(보안/서비스/개요)
스캔 결과는 nmap://scan/{scan_id} URI 체계를 사용하여 리소스로 사용할 수 있습니다.
검사를 실행하세요:
Call tool: run-nmap-scan
Parameters: {"target": "192.168.1.0/24", "options": "-sV -p 22,80,443"}스캔 세부 정보 받기:
Call tool: get-scan-details
Parameters: {"scan_id": "<scan_id from previous step>"}모든 스캔을 나열하세요:
Call tool: list-all-scans검사 결과 분석:
Get prompt: analyze-scan
Parameters: {"scan_id": "<scan_id>", "focus": "security"}이 서버는 사용자 시스템에서 nmap 명령을 실행합니다. 소유하지 않았거나 스캔 권한이 없는 네트워크를 스캔할 때는 주의하십시오. 일부 관할 지역에서는 무단 스캔이 불법일 수 있습니다.
nmap을 찾을 수 없거나 잘못 실행된 것과 관련된 오류가 발생하는 경우:
nmap이 설치되어 PATH에 사용 가능한지 확인하세요.
nmap 실행 파일이 사용되는 로그를 확인하세요.
서버는 충돌을 피하기 위해 nmap에 대한 전체 경로를 사용하려고 시도합니다.
Docker 컨테이너에서 MCP 서버를 실행할 수 있습니다.
# Build the Docker image
docker build -t nmap-mcp-server .
# Run the Docker container
docker run -it --rm nmap-mcp-serverGlama MCP 디렉토리와 통합하기 위해 Docker 컨테이너를 사용하면 다른 사용자가 설치 종속성을 걱정하지 않고도 이 MCP 서버를 쉽게 사용할 수 있습니다.
이 프로젝트는 MIT 라이선스에 따라 라이선스가 부여되었습니다. 자세한 내용은 라이선스 파일을 참조하세요.
Get detailed information about a specific scan
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | ID of the scan to retrieve |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves information, implying a read-only operation, but lacks details on permissions, rate limits, error handling, or what 'detailed information' includes (e.g., format, fields). This is inadequate for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It is front-loaded with the core action and resource, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what 'detailed information' entails (e.g., scan results, status, metadata), leaving the agent uncertain about the return values. For a tool with no structured output documentation, this gap is significant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the single parameter 'scan_id' well-documented in the schema. The description adds no additional meaning beyond implying retrieval of a 'specific scan', which aligns with the schema but doesn't provide extra context like ID format or examples. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get detailed information') and resource ('about a specific scan'), making the purpose immediately understandable. It distinguishes from the sibling 'list-all-scans' by focusing on a single scan rather than multiple scans, though it doesn't explicitly differentiate from 'run-nmap-scan' beyond the verb difference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided on when to use this tool versus alternatives. The description implies usage for retrieving details of a known scan, but it doesn't mention prerequisites (e.g., needing a scan ID from 'list-all-scans') or contrast with siblings like 'run-nmap-scan' for creating scans.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all available scan results
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but only states the action without details on permissions, rate limits, pagination, or response format. It doesn't clarify if this lists historical scans, real-time results, or includes metadata, leaving significant gaps in understanding how the tool behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any fluff or redundancy. It's front-loaded and wastes no words, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and sibling tools, the description is incomplete. It doesn't address behavioral traits like safety, performance, or how results are returned, nor does it help differentiate from alternatives, leaving the agent with insufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description doesn't add parameter details, but this is appropriate given the schema's completeness, warranting a baseline score above minimum viable due to the lack of parameters to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all available scan results'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'get-scan-details' or 'run-nmap-scan' beyond the basic listing action, which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get-scan-details' for specific scan details or 'run-nmap-scan' to initiate new scans. It lacks context about prerequisites, timing, or exclusions, leaving the agent to infer usage from tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run an nmap scan on specified targets
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Target host or network (e.g., 192.168.1.1 or 192.168.1.0/24) | |
| options | No | Nmap options (e.g., -sV -p 1-1000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('Run an nmap scan') but doesn't describe what this entails—such as network impact, execution time, permission requirements, or output format. For a tool that likely performs network scanning, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's purpose without unnecessary details. It's appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of running an nmap scan (a network operation with potential side effects), the description is incomplete. With no annotations, no output schema, and minimal behavioral context, it fails to provide enough information for safe and effective use. The agent lacks details on execution behavior, results, or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters ('target' and 'options') with clear descriptions. The description adds no additional meaning beyond what the schema provides, such as example usage or constraints, resulting in a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Run') and resource ('nmap scan on specified targets'), making the purpose immediately understandable. It doesn't differentiate from sibling tools like 'get-scan-details' or 'list-all-scans', which are clearly different operations, so it doesn't need explicit sibling differentiation for a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites like network access or permissions, nor does it explain when to choose this over siblings like 'get-scan-details' or 'list-all-scans'. This lack of context leaves the agent with minimal usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
get-scan-detailslist-all-scansrun-nmap-scanScored across 3 tools
Each tool has a clearly distinct purpose with no overlap: get-scan-details retrieves specific scan information, list-all-scans shows all available results, and run-nmap-scan performs new scans. The actions (get, list, run) and targets (details, scans, scan) are well-differentiated, making misselection unlikely.
All tools follow a consistent verb-noun pattern with hyphens (get-scan-details, list-all-scans, run-nmap-scan). The naming is predictable and readable, using clear action words and descriptive nouns without any deviations in style or convention.
With only 3 tools, the server feels thin for an nmap domain, which typically involves more operations like managing scan configurations, exporting results, or filtering scans. While the core functions are covered, the limited count may restrict agent flexibility in complex scenarios.
The tools cover the basic lifecycle of running, listing, and retrieving scans, but there are minor gaps such as updating or deleting scans, or handling scan parameters more granularly. Agents can work around these with the existing tools, but the surface is not fully comprehensive.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Scans remote MCP servers for protocol, security, and TLS issues; exposes scan tools via MCP.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
