A
license-
qualityF
maintenanceProvides a bridge between large language models and the Metasploit Framework, enabling AI assistants to access and control penetration testing functionality through natural language.
708
Apache 2.0
attackforge-mcp
by unstrike
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@attackforge-mcplist projects with status 'active'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
attackforge-mcp
An MCP server that connects AI assistants (Claude, etc.) to the AttackForge Self-Service API (SSAPI).
vs. the official AttackForge MCP
AttackForge publishes an official MCP server. It exposes a limited subset of
the SSAPI — specifically: whoami, get_file, count_projects,
count_vulnerabilities, count_writeups, find_affected_assets,
find_projects, find_writeups, find_vulnerabilities, and
get_field_structure.
This server covers the full SSAPI and adds a layer of context efficiency on top, designed specifically for use inside long AI conversations:
Official MCP | attackforge-mcp | |
API coverage | 10 endpoints | Full SSAPI |
Response passthrough | Raw API JSON | Slimmed (see below) |
HTML fields | Returned | Stripped globally (−40–60% size) |
List responses | Full objects | Summary projection + |
Static data (form configs, testsuite library, project index) | Re-fetched every call | SQLite cache with TTLs |
Cache management | — |
|
Escape hatch | — |
|
Why it matters: Large tool responses dump hundreds of lines of JSON into context on every call. Over a multi-step engagement that context fills up fast. By stripping HTML duplicates, projecting summary fields, and caching data that never changes mid-engagement, this server keeps each tool response as small as possible without losing information.
Related MCP server: PowerShell Empire MCP Server
Setup
Requirements
Python 3.12+
Install
git clone https://github.com/unstrike/attackforge-mcp
cd attackforge-mcp
uv syncConfiguration
Set two environment variables before starting the server:
Variable | Description | Default |
| Your AttackForge instance hostname | (required) |
| Your SSAPI key | (required) |
Run
AF_HOSTNAME=your.attackforge.com X_SSAPI_KEY=your-key uv run attackforge-mcpOr add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"attackforge-mcp": {
"command": "uv",
"args": ["run", "--directory", "/path/to/attackforge-mcp", "attackforge-mcp"],
"env": {
"AF_HOSTNAME": "your.attackforge.com",
"X_SSAPI_KEY": "your-key"
}
}
}
}Tools
Tool | What it does |
| List, get, create, update, clone, archive projects and notes |
| List, get, create, update, bulk-create vulnerabilities |
| Browse and manage the testsuite library |
| List, assign, update test cases on a project |
| Manage project and library assets |
| Create and update remediation notes on vulnerabilities |
| Generate and retrieve project reports |
| Failed testcases, vulnerable assets, common vulnerabilities |
| Markdown → rich text conversion; form config lookup |
| Inspect and invalidate the local SQLite cache |
| Direct access to any SSAPI endpoint |
See CLAUDE.md for usage patterns.
This server cannot be installed
Maintenance
–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseBqualityFmaintenanceEnables AI assistants to manage Empire listeners, stagers, agents, modules, and credentials via the Empire REST API.141MIT
- Flicense-qualityDmaintenanceConnects AI assistants and agentic frameworks to the Graphor API, enabling graph-based operations through natural language.
- Alicense-qualityCmaintenanceConnects AI assistants to Intigriti by syncing programs, scopes, and rules of engagement, then provides tools to search and generate actionable attack briefings.1MIT
Related MCP Connectors
Connect AI assistants to your GitHub-hosted Obsidian vault to seamlessly access, search, and analy…
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
SaaS intelligence for AI agents. 5 unified tools cover 1,000+ services with 91-96% token savings.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/unstrike/attackforge-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server