┌─────────────────┐      MCP Protocol      ┌─────────────────┐      SSH/RPC       ┌─────────────────┐
│                 │ ───────────────────▶   │                 │ ───────────────▶   │                 │
│  AI Assistant   │                        │   MCP Server    │                    │  Kali Linux     │
│  (Claude, etc)  │                        │  (This Project) │                    │  Security Tools │
│                 │ ◀───────────────────   │                 │ ◀───────────────   │                 │
└─────────────────┘    Structured Results  └─────────────────┘   Tool Output      └─────────────────┘

kali-linux-mcp/
├── main.py                 # MCP server entry point
├── tools/
│   ├── helpers.py          # Shared utilities
│   ├── reconnaissance.py   # Port/web scanning
│   ├── authentication.py   # Auth testing
│   ├── injection.py        # SQL/XSS testing
│   ├── access_control.py   # IDOR, path traversal
│   ├── network.py          # Local network scanning
│   ├── metasploit.py       # Metasploit integration
│   ├── browser.py          # Selenium automation
│   └── reports.py          # Report generation
├── tests/                  # Test suite (72 tests)
├── pyproject.toml
└── README.md

git clone https://github.com/rifkyekayama/kali-linux-mcp.git
cd kali-linux-mcp
uv sync
uv run python main.py

# Install OrbStack
brew install orbstack

# Create Kali machine
orb create kali kali

# Enter the machine
orb -m kali

# Install security tools
sudo apt update && sudo apt upgrade -y
sudo apt install -y metasploit-framework nmap nikto sqlmap gobuster dirb hydra sslscan arp-scan

# Initialize and start Metasploit RPC
sudo msfdb init
msfrpcd -P yourpassword -S -a 0.0.0.0

docker pull kalilinux/kali-rolling
docker run -it --name kali -p 55553:55553 kalilinux/kali-rolling /bin/bash

# Inside container
apt update && apt install -y kali-linux-headless

wsl --install -d kali-linux

{
  "mcpServers": {
    "kali-linux-mcp": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/kali-linux-mcp", "python", "main.py"]
    }
  }
}

msfrpcd -P yourpassword -S -a 0.0.0.0 -p 55553

Run a comprehensive vulnerability scan on https://example.com and generate a PDF report with all findings.

Test https://example.com/login for SQL injection vulnerabilities on the username and password parameters.

Check https://example.com for XSS vulnerabilities in all input fields and forms.

Analyze the SSL/TLS configuration of https://example.com and identify any weak ciphers or outdated protocols.

Enumerate all directories and files on https://example.com using common wordlists.

Scan the JavaScript application at https://app.example.com for client-side vulnerabilities including DOM-based XSS and prototype pollution.

Validate and exploit the SQL injection vulnerability at https://example.com/product?id=1 and extract the database schema.

Test the authentication mechanism at https://example.com/login for weak password policies, session management issues, and account enumeration vulnerabilities.

Test https://example.com/api/users for IDOR vulnerabilities by attempting to access user IDs from 1 to 100.

Scan https://example.com for all injection vulnerabilities (SQL, NoSQL, command injection, template injection) and provide proof of concept for any findings.

Scan my local network for all active devices and identify their operating systems and open ports.

Scan the network range 192.168.1.0/24 for active hosts and enumerate all open ports on each device.

Scan for nearby wireless networks and analyze their security configurations.

Use ARP scanning to discover all clients on the local network and identify their MAC addresses and vendors.

Check if the host 192.168.1.100 is vulnerable to EternalBlue (MS17-010) or other SMB exploits.

Perform an SSH brute force attack on 192.168.1.50 using common credentials.

Run a deep vulnerability scan on 192.168.1.100 and identify all potential security weaknesses.

Connect to Metasploit, search for Apache Struts exploits, and show me the top 5 most relevant modules.

Use Metasploit to exploit the SMB vulnerability on 192.168.1.100 and establish a reverse shell session.

Run the SSH version scanner auxiliary module against 192.168.1.0/24 to identify all SSH servers and their versions.

Scan https://example.com comprehensively and generate both HTML and PDF reports with all vulnerabilities categorized by severity.

Export all findings from the last scan to JSON format for integration with my vulnerability management system.

Perform a complete security assessment of https://example.com including:
1. Port scanning and service enumeration
2. Web vulnerability testing (SQL injection, XSS, CSRF)
3. SSL/TLS configuration analysis
4. Directory enumeration
5. Authentication and access control testing
Then generate a comprehensive PDF report with remediation recommendations.

Conduct a penetration test on my local network (192.168.1.0/24):
1. Discover all active hosts
2. Scan for open ports and services
3. Check for SMB vulnerabilities
4. Test for weak SSH/FTP credentials
5. Generate a detailed report with findings

# Run all tests
uv run pytest tests/ -v

# Run specific module tests
uv run pytest tests/test_network.py -v

# Run with coverage
uv add --dev pytest-cov
uv run pytest tests/ --cov=tools