nmap-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NMAP_LOCAL | No | Set to "true" to run nmap locally | false |
| NMAP_SSH_KEY | No | Path to SSH private key (optional, uses SSH config default) | |
| NMAP_SSH_HOST | No | SSH host for remote execution | kali |
| NMAP_SSH_USER | No | SSH username (optional, uses SSH config default) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| nmap_scanB | Perform a basic nmap port scan on target hosts. Supports IP addresses, hostnames, CIDR ranges. Returns discovered hosts and open ports. |
| nmap_service_scanA | Perform service version detection (-sV). Identifies service names and versions running on open ports. |
| nmap_os_detectA | Perform OS fingerprinting (-O). Attempts to identify the operating system of target hosts. Requires privileged access. |
| nmap_script_scanC | Run NSE (Nmap Scripting Engine) scripts for advanced reconnaissance and vulnerability assessment. Over 600 scripts available. |
| nmap_quick_scanA | Fast scan preset (-F). Scans fewer ports than default for quick reconnaissance. |
| nmap_vuln_scanB | Run vulnerability scanning scripts (--script vuln). Checks for known vulnerabilities on target services. |
| nmap_comprehensive_scanA | Comprehensive scan combining multiple techniques: SYN scan, service detection, OS detection, and default scripts (-sS -sV -O -sC). Requires privileged access. |
| nmap_ping_sweepA | Host discovery only (-sn). Find live hosts on a network without port scanning. |
| nmap_stealth_scanB | Stealth scan with evasion techniques. Uses timing options, fragmentation, and decoys to avoid detection. |
| nmap_parse_outputA | Parse nmap XML output from a previous scan or file. Useful for analyzing saved scan results. |
| nmap_statusA | Check nmap availability and configuration. Shows whether nmap is accessible via SSH or locally. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Most tools are distinct, but nmap_script_scan and nmap_vuln_scan overlap significantly since vuln_scan is a subset of script_scan. Also, nmap_scan and nmap_quick_scan both perform port scans with only a difference in port count, which could confuse agents.
All tools share the nmap_ prefix and generally follow a descriptive action pattern. However, there is inconsistency in word order (e.g., nmap_scan vs. nmap_service_scan) and some names use modifiers (quick, comprehensive) rather than a uniform verb_noun structure.
Eleven tools is well-scoped for an nmap MCP server. Each tool covers a meaningful aspect of nmap (basic scan, service detection, OS detection, scripting, vulnerability scan, host discovery, stealth, parsing, status), and the count aligns with the complexity of the domain.
The tool set covers the core nmap workflows: port scanning, service detection, OS detection, scripting, vulnerability scanning, host discovery, and output parsing. Minor gaps exist, such as no explicit UDP scan or custom script selection, but agents can likely work around these using the provided options.