pentestMCP

概述

pentestMCP通过模型上下文协议（MCP）将大型语言模型与实用的渗透测试工具连接起来。它作为MCP服务器运行，在Docker容器中暴露20多种安全评估工具，供兼容的客户端（如Claude Desktop或VS Code）调用。服务器通过stdio与客户端通信，支持对长时间运行的扫描采用异步模式，并包含资源管理功能，使渗透测试能力更易于访问和集成到AI驱动的工作流中。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• run_subfinder

  Discovers subdomains using ProjectDiscovery's Subfinder.

  试试:Find subdomains for example.com试试:Run subfinder scan on target.com
• launch_nmap_scan

  Executes Nmap network scans asynchronously.

  试试:Launch Nmap service scan on scanme.nmap.org试试:Run comprehensive Nmap scan on 192.168.1.1
• fetch_nmap_results

  Retrieves results from an asynchronous Nmap scan.

  试试:Get my Nmap scan results试试:Fetch the output from the Nmap scan I launched
• run_gobuster_scan

  Performs directory/file/DNS bruteforcing with Gobuster asynchronously.

  试试:Use Gobuster to find directories on example.com试试:Run Gobuster DNS enumeration on domain.com
• launch_nuclei_scan

  Runs template-based vulnerability scans with ProjectDiscovery's Nuclei asynchronously.

  试试:Launch Nuclei scan on target.com试试:Run Nuclei vulnerability scan against IP address
• run_sqlmap_tool

  Executes SQLmap for SQL injection testing asynchronously.

  试试:Run SQLmap on this login page URL试试:Test for SQL injection vulnerabilities with SQLmap
• run_searchsploit

  Searches the local Exploit-DB database using Searchsploit.

  试试:Search for exploits for Apache 2.4试试:Find vulnerabilities related to WordPress 5.0
• ad_user_enum

  Enumerates users in Active Directory.

  试试:Enumerate users in Active Directory试试:List AD users for domain controller
• ad_bloodhound_collect

  Collects data for Active Directory analysis with BloodHound.

  试试:Collect AD data for BloodHound analysis试试:Run BloodHound data collection
• run_zap_active_scan

  Performs an active scan with OWASP ZAP.

  试试:Run ZAP active scan on this website试试:Initiate OWASP ZAP scan for target application
• run_curl_tool

  Executes cURL commands for HTTP interaction.

  试试:Use curl to make a GET request to example.com试试:Execute a curl POST request with JSON data
• fetch_whois_data

  Retrieves WHOIS information for a domain.

  试试:Get WHOIS data for example.com试试:Find the registration details for target-domain.com

可对比工具

安装

docker pull ramgameer/pentest-mcp:latest

{
  "mcpServers": {
    "pentestMCP": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ramgameer/pentest-mcp:latest"
      ]
    }
  }
}

FAQ

pentestMCP是什么？

pentestMCP是一个MCP服务器，将渗透测试工具（如Nmap、Nuclei、ZAP等）作为可调用工具暴露给AI代理，用于安全分析。

如何将pentestMCP与Claude Desktop集成？

将MCP服务器配置添加到您的claude_desktop_config.json文件中，使用README中提供的Docker运行命令，然后重启Claude Desktop。

pentestMCP 对比