mcp-kali-tools

A Docker image that runs a Model Context Protocol server exposing common Kali Linux pentesting tools to an MCP client (e.g. Claude Desktop). Each tool runs as its own MCP tool call, executed directly as argv (no shell), so arguments can't be used to chain or inject arbitrary shell commands — but each tool still has the full power of its underlying binary.

Authorized use only. This bundles offensive security tooling (nmap, sqlmap, hydra, Metasploit, etc.). Only point it at systems and networks you're authorized to test.

Tools included

nmap, sqlmap, nikto, hydra, john, hashcat, msfconsole, gobuster, ffuf, whatweb, wpscan, aircrack-ng, searchsploit

aircrack-ng can crack existing capture files, but live wireless capture (monitor mode) needs a physical adapter passed through to the container (--device, --net=host), which isn't set up by default.

Build

docker build -t mcp-kali-tools:latest .

Run manually (for testing)

The server speaks MCP over stdio — it's not meant to be left running standalone. To smoke-test it, pipe JSON-RPC requests in directly:

docker run -i --rm mcp-kali-tools:latest

Configure in Claude Desktop

Create a host directory for wordlists/scan output to persist across runs, e.g.:

mkdir -p ~/mcp-data

Add this to mcpServers in your claude_desktop_config.json:

{
  "mcpServers": {
    "kali-tools": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--cap-add=NET_RAW", "--cap-add=NET_ADMIN",
        "-v", "/home/YOUR_USER/mcp-data:/data",
        "mcp-kali-tools:latest"
      ]
    }
  }
}

--cap-add=NET_RAW --cap-add=NET_ADMIN is required for full nmap functionality (e.g. SYN scans). The /data mount is where wordlists (e.g. rockyou.txt) and scan output should live — pass paths under /data/... in tool arguments to read/write there.

Restart Claude Desktop after editing the config. If Docker was installed or your user was just added to the docker group, log out and back in first — group membership only applies to new login sessions.

Notes

• Each container run is ephemeral (--rm); nothing persists except what's written to /data.
• Output per tool call is capped at 20,000 characters and each call times out after 180s by default (override with the timeout argument on any tool call).