pentester-mcp

概述

Pentester-MCP通过模型上下文协议(MCP)将AI助手转变为自主的网络安全专家，提供访问200多个开源渗透测试工具的能力。平台提供两种部署方式：推荐使用的安全Docker沙箱，将工具执行与主机系统隔离；以及本地执行方式，供已有工具安装的用户使用。每个工具都配备AI优化的文档字符串，使AI能够自主理解工具参数、语法和要求。

试试问 AI

装完之后，这里有 6 个你可以让 AI 做的事：

• nmap

  Network scanning tool to discover hosts and services

  试试:Scan the target network for open ports试试:Perform a SYN scan on 192.168.1.0/24
• masscan

  Fast TCP port scanner for large networks

  试试:Scan a target range for open ports at 10 million packets/second试试:Perform a TCP scan on 10.0.0.0/8
• sqlmap

  Automatic SQL injection and database takeover tool

  试试:Test the login form for SQL injection vulnerabilities试试:Extract data from the database using time-based blind injection
• ffuf

  Fuzzing tool for discovering web content and directories

  试试:Discover hidden directories on the target website试试:Fuzz for subdomains with a custom wordlist
• gobuster

  Directory/file and DNS busting tool

  试试:Find hidden directories on the target web server试试:Enumerate subdomains for the target domain
• dirsearch

  Web path scanner for discovering hidden files and directories

  试试:Scan for common directories on the target website试试:Discover backup files and hidden endpoints
• nikto

  Web server scanner that tests for dangerous files/CGIs

  试试:Scan the web server for known vulnerabilities试试:Test the target for outdated software versions
• hydra

  Online password cracking tool supporting various protocols

  试试:Brute force SSH login credentials试试:Perform a dictionary attack on a web login form
• john

  Advanced password cracking tool for various hash types

  试试:Crack the captured password hashes using a dictionary attack试试:Perform a brute-force attack on the NTLM hashes
• hashcat

  Fast password cracking tool supporting multiple attack modes

  试试:Crack the MD5 hash using a rule-based attack试试:Perform a mask attack on the captured password hashes
• nuclei

  Vulnerability scanner with templates for detecting security issues

  试试:Scan the target for known vulnerabilities试试:Test for specific CVEs in the web application
• recon-ng

  Web-based reconnaissance framework

  试试:Perform OSINT reconnaissance on the target domain试试:Gather information about the target organization

说明：Tools extracted from the 'The Arsenal' section which explicitly lists 235+ penetration testing tools available in the MCP server.

可对比工具

安装

git clone https://github.com/halilkirazkaya/pentester-mcp.git
cd pentester-mcp

docker compose up -d --build

{
  "mcpServers": {
    "pentester_mcp": {
      "command": "docker",
      "args": [
        "exec",
        "-i",
        "pentester-mcp",
        "/app/.venv/bin/python",
        "/app/server.py"
      ]
    }
  }
}

git clone https://github.com/halilkirazkaya/pentester-mcp.git
cd pentester-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

FAQ

通过AI助手运行渗透测试工具安全吗？

是的，Pentester-MCP使用Docker沙箱将工具执行与主机系统隔离，防止对您的主机造成任何潜在损害。所有工具都在受控环境中运行。

Pentester-MCP包含多少工具？

该项目提供200多个渗透测试工具的访问权限，涵盖侦察、Web利用、活动目录、网络分析等多个类别。根据社区请求，会定期添加新工具。

我可以向Pentester-MCP添加自定义工具吗？

目前，工具从YAML备忘录自动生成，以确保一致的API设计和安全实践。虽然您不能直接添加任意工具，但可以通过在GitHub仓库上打开问题来请求新工具。

pentester-mcp 对比