MCP bridges for security tools

When it applies

You're setting up an agent-driven workflow and need CLI tools (nmap, nuclei, sqlmap, hashcat, gobuster, Metasploit…) callable as MCP tools instead of raw shell. This is infrastructure, not authorization: registering a tool over MCP never widens scope — tradecraft-scope-roe and scope.txt still gate every call. For Burp specifically, see tools-burp-suite; for attacking MCP servers themselves, ai-mcp-security.

Why it works

MCP wraps a tool's CLI behind typed tool definitions, so the agent gets structured parameters and output instead of scraping terminal text. A generic terminal bridge (mcp-kali-server) covers everything but is unstructured; per-tool servers give safer, typed interfaces at the cost of setup.

Options (pick one per need)

Option	Install	Tools covered	Best for
mcp-kali-server (Kali-official)	apt install mcp-kali-server	Any terminal command (nmap, nxc, curl, gobuster…)	General-purpose; CTF/labs
MetasploitMCP (Kali-official)	apt install metasploitmcp	MSF modules/payloads/sessions	MSF-heavy exploitation (tools-metasploit)
pentestMCP (Docker bundle)	docker run -d -p 8080:8080 ramkansal/pentestmcp	20+: nmap, nuclei, ZAP, sqlmap, ffuf, nikto, gobuster, subfinder, httpx	One-container everything
mcp-security-hub (modular)	per-module pip installs	nmap, Ghidra, nuclei, sqlmap, hashcat	Enable only what you need
hexstrike-ai (Kali-official)	apt install hexstrike-ai	150+ tools, multi-agent orchestration	Large-scale automation
Single-tool servers	npm/pip per project	one tool each (e.g. nmap-mcp-server, nuclei-mcp)	Minimal footprint

Method

1. Generic terminal bridge (start here on Kali):

   kali-server-mcp --port 5000        # API side; runs any terminal command
   mcp-server --server http://localhost:5000   # MCP client-facing side
   

2. Metasploit: metasploitmcp --transport stdio (preferred) or --transport http --port 8085. The invocation discipline in tools-metasploit still applies underneath (one-shot -x, ;exit, port checks).
3. Docker bundle: docker pull ramkansal/pentestmcp && docker run -d -p 8080:8080 ramkansal/pentestmcp, then register {"url": "http://localhost:8080/mcp"} in the client's mcpServers.
4. Register stdio servers in the client config, e.g.:

   {
     "mcpServers": {
       "kali-server": { "command": "kali-server-mcp", "args": ["--port", "5000"] },
       "metasploit-mcp": { "command": "metasploitmcp", "args": ["--transport", "stdio"] }
     }
   }
   

5. Verify before relying on it: list the exposed tools and run one harmless call (e.g. a version check) against a lab target before pointing anything at a real engagement.

Gotchas

• A terminal bridge is arbitrary command execution — bind to localhost only, never expose the port on a network interface, and treat the bridge host as compromised-adjacent.
• Community MCP servers are supply chain — audit or pin versions before installing; a malicious tool server sees every command and result. Prefer Kali-official packages when they exist.
• Scope still applies — a registered scanner makes it easier to fire out-of-scope requests, not more allowed. Keep scope.txt loaded and check targets against it before every call.
• Container bundles run as root with mounted sockets — pentestMCP's Docker has full tool capability; don't mount engagement data you can't afford to leak into it.
• Tool availability ≠ tool correctness — the server reports what its manifest claims; confirm the underlying binary exists and is the expected version (nmap --version, etc.).

Verify success

The MCP client lists the server's tools, a harmless invocation returns sane structured output, and every subsequent call is logged against an in-scope target in the engagement workspace.

References

Kali blog on MCP/LLM integration; Wh0am123/MCP-Kali-Server; GH05TCREW/MetasploitMCP; ramkansal/pentestMCP; FuzzingLabs/mcp-security-hub; 0x4m4/hexstrike-ai.

---

Portions adapted from reverse-skill by zhaoxuya520, MIT License.