Ludus FastMCP

A Model Context Protocol (MCP) server for automating Ludus cyber range environments through AI assistants written in Python.

Overview

Ludus FastMCP enables AI-powered management of Ludus cyber ranges through natural language commands. The server exposes 231 tools across 23 modules for range lifecycle management, scenario deployment, template creation, Ansible role management, and security monitoring integration.

Requires Ludus 2.0 or later. This release targets the Ludus 2.x API only, which is what makes blueprints, groups, content sources, VM console access, quotas and diagnostics available. Support for the Ludus 1.x API was removed; pin ludus-fastmcp to a 1.x release if you still run a Ludus 1.x server.

The client covers every endpoint in the Ludus API, validated against a live Ludus 2.3.0 server.

Key Capabilities

Supported Platforms

Works with any MCP-compatible client including Claude Desktop, VS Code (Cline), OpenWebUI, and AnythingLLM.

Related MCP server: Cobalt Strike MCP Server

Quick Start

Requirements

• Python 3.11+

• FastMCP 3.x (installed automatically)

• A Ludus server running 2.0 or later

• Ludus API key, or a JWT token for Pro/SSO deployments

Installation

# Using pipx (recommended)
pipx install git+https://github.com/tjnull/Ludus-FastMCP

# From source
git clone https://github.com/tjnull/Ludus-FastMCP
cd Ludus-FastMCP
pip install -e .

Setup

Run the interactive setup wizard:

ludus-fastmcp --setup

The wizard configures API credentials, tests connectivity, and generates MCP client configuration files.

For manual configuration options, see the Configuration Guide.

Usage

MCP Server (ludus-fastmcp)

ludus-fastmcp --setup          # Interactive setup wizard
ludus-fastmcp --list-tools     # List all 231 available tools
ludus-fastmcp --version        # Display version information
ludus-fastmcp                  # Start MCP server
ludus-fastmcp --daemon         # Run as background service

Client CLI (ludus-ai)

ludus-ai setup-llm                    # Configure local LLM (Ollama)
ludus-ai install anythingllm          # Install AnythingLLM interface
ludus-ai tool list-tools              # List available tools
ludus-ai tool call-tool <name>        # Execute tools directly

Example Interactions

Once connected to an MCP client, interact with your Ludus environment:

Show my current range status
Deploy an Active Directory lab with Wazuh monitoring
Create a snapshot named "pre-attack" for all VMs
Build a lab with 2 domain controllers and 5 workstations
Create a blueprint from my current range and share it with the red-team group
Show system diagnostics and storage usage
List all groups and their members

Examples of using Ludus-FastMCP with grok code through Opencode.

Documentation

Ludus Server Requirements

This release speaks the Ludus 2.x API only. Every request goes to /api/v2; there is no v1 code path left to fall back to.

On the first call the client asks the server for its version and refuses to continue if it does not answer as a 2.x server, so a mismatch surfaces once, up front, instead of as a puzzling 404 from whichever tool you happened to run:

https://ludus.example:8080 does not serve the Ludus 2.x API
(GET /api/v2/ returned HTTP 404). This release requires Ludus 2.0 or later;
upgrade the server, or pin ludus-fastmcp to a 1.x release for a Ludus 1.x server.

Set LUDUS_API_VERSION=v2 to assert the version yourself and skip that check (it saves one request per session). LUDUS_API_VERSION=v1 is rejected at startup rather than silently ignored.

Still on Ludus 1.x?

Pin an older release:

pipx install "git+https://github.com/tjnull/Ludus-FastMCP@v1.0.0"

Upgrading the server is the better path: blueprints, content sources, groups, quotas, deployment log history and VM console access do not exist in the 1.x API at all.

Plugin-gated features

Some Ludus capabilities ship as server plugins that may not be loaded on a given install. Quotas and auto-shutdown are the common examples. When a plugin is absent, the Ludus API answers with HTTP 404 even though the request was correct.

Rather than reporting that as a missing endpoint, those tools return a clear result so an AI assistant does not go hunting for a nonexistent bug:

{
  "available": false,
  "feature": "Quotas",
  "error": "Quotas is not available on this Ludus server.",
  "reason": "This capability is provided by a Ludus plugin that is not loaded on the server.",
  "hint": "The request was well-formed. Do not retry or try alternative endpoints."
}

Endpoints a server does not implement at all (HTTP 501, such as /range/sshconfig on some builds) are reported the same way, with an explicit note that retrying will not help.

Resources

Support

• GitHub Issues - Bug reports and feature requests

• GitHub Discussions - Questions and community discussion

License

This project is licensed under the MIT License. See LICENSE for details.

Disclaimer

This software is intended for authorized security testing, educational purposes, and research in controlled environments. Users are responsible for compliance with applicable laws and organizational policies. The authors make no warranties and assume no liability for use or misuse of this software.

Acknowledgments

• Ludus by Bad Sector Labs

• FastMCP, and the Model Context Protocol community.

Credits

• @LouDeter - MCP request/response logging middleware and log-file support (PR #8)