Atlas / MCP servers / noctedefensor / Ludus

LudusBLOCK

Name: Ludus
Author: noctedefensor

mcp/noctedefensor/ludus

MCP server by noctedefensor · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

54 /100

Exposed tools

35 24r · 10w · 1d

Transport

stdio

License

GPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Model Context Protocol server for managing Ludus lab environments through natural language commands.

Prerequisites

For detailed information, please refer to the wiki

System Requirements

Node.js 18.0.0 or higher
npm package manager
Ludus CLI binary installed and in PATH on host with the mcp-client(ex. claude desktop)
Active Ludus server environment
Network connectivity to Ludus server via WireGuard VPN or SSH

Ludus Server Access

Ensure you have:

Ludus server SSH access credentials
Ludus API key (obtain via ludus user apikey command)
WireGuard configuration file OR SSH tunnel capabilities (obtain wireguard conf from Ludus CLI)
Admin USERID for Ludus server.

Installation

NOTE Installation of the MCP server IS NOT on the Ludus server. It will be installed on a device with an MCP client (ex Claude Desktop) that has access to the Ludus server.

Global Installation (Recommended)

Install the package globally to make the ludus-mcp command available system-wide:

npm install -g ludus-mcp@latest
ludus-mcp --setup-keyring

What happens during installation:

Downloads source code and dependencies
Compiles native dependencies (keytar) for your platform (Windows/Linux/macOS)
Builds TypeScript source to JavaScript (src/ → dist/)
Creates global ludus-mcp command in your PATH

This is a one-time installation process that compiles everything for your specific platform.

From Source (Development)

git clone https://github.com/NocteDefensor/LudusMCP.git
cd LudusMCP
From within LudusMCP directory
npm install    # Installs dependencies and builds automatically
npx ludus-mcp --setup-keyring  # Use npx for local from source installations by running it from within clone/install directory

Installation Requirements

The package includes native depe

Read from source at commit e27fc7543028OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ludus-mcp --env LUDUS_API_KEY=${LUDUS_API_KEY} --env LUDUS_SSH_AUTH_METHOD=${LUDUS_SSH_AUTH_METHOD} --env LUDUS_SSH_KEY_PATH=${LUDUS_SSH_KEY_PATH} --env LUDUS_SSH_PASSWORD=${LUDUS_SSH_PASSWORD} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "ludus-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "LUDUS_API_KEY": "${LUDUS_API_KEY}",
        "LUDUS_SSH_AUTH_METHOD": "${LUDUS_SSH_AUTH_METHOD}",
        "LUDUS_SSH_KEY_PATH": "${LUDUS_SSH_KEY_PATH}",
        "LUDUS_SSH_PASSWORD": "${LUDUS_SSH_PASSWORD}"
      }
    }
  }
}

Exposed tools (35)

24 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`command_intent`	read	Describe what you want to accomplish with the CLI command (e.g.,
`confirm_destructive`	write	Set to true only AFTER user explicitly confirms destructive operations (type: true/false, TRUE/FALSE, or t/f)
`create-ludus-range`	write	Create a complete Ludus cyber range from your requirements. Handles the entire workflow from planning to validation.
`deploy_range`	write	Deploy a Ludus range from a configuration file. Creates virtualized training environment. CREDENTIAL SECURITY: Ensure configs use placeholders {{LudusCredName-<user>-<name>}}. DESTRUCTIVE: Always verify before deployment.
`destroy_range`	destructive	DESTRUCTIVE: Permanently destroy/stop a range, deleting all VMs and data. This action is irreversible.
`execute-ludus-cmd`	write	Safely execute Ludus CLI commands with comprehensive safety protocols, tool preference checking, and destructive action confirmation.
`get_connection_info`	read	Get connection information for accessing a Ludus range. Supports RDP configurations, WireGuard VPN configs, and host file entries. Requires admin privileges to get info for other users.
`get_credential_from_user`	read	MCP TOOL (NOT a Ludus CLI command) - Prompt user to securely enter a credential via popup dialog and store in OS keyring. IMPORTANT: This is a Ludus MCP server tool, NOT a native Ludus CLI command. Do NOT use
`get_range_config`	read	Get current range configuration from Ludus server or retrieve example configuration.
`get_range_status`	read	Get the current status and details of a Ludus range. Shows deployment state, VM information, and range configuration. Requires admin privileges to check other users\
`get_tags`	write	Get the ansible tags available for use with deploy. This shows all available deployment tags that can be used with the deploy_range tool. Requires admin privileges to get tags for other users.
`list_all_users`	read	List all users in the Ludus system. Requires admin privileges.
`list_range_configs`	read	List and analyze range configurations in directory. Provides validation status and metadata.
`list_user_ranges`	read	List all deployed ranges for a user, showing current status and basic information.
`ludus_cli_execute`	write	CRITICAL: Do NOT include
`ludus_docs_search`	read	Search Ludus documentation for configuration help, troubleshooting, and best practices.
`ludus_environment_guides_search`	read	Search environment-specific guides and tutorials for different types of cyber ranges.
`ludus_help`	read	Get help information for Ludus CLI commands and subcommands.
`ludus_list_role_collection_schemas`	read	List all available role and collection schema files (.yaml/.yml) in ~/.ludus-mcp/schemas/. Shows inventory of roles, collections, and templates with file metadata.
`ludus_networking_search`	read	Search networking documentation for VPN, network topology, and connectivity guidance.
`ludus_power`	write	Power management for range VMs (start/stop). Power off operations require confirmation as they may interrupt running processes.
`ludus_range_config_check_against_plan`	read	QA checklist tool to verify range configuration against original user requirements and plan. Used during validation phase to ensure all requirements are met.
`ludus_range_planner`	read	PRIMARY RANGE ORCHESTRATOR - Use this FIRST for any range creation! Analyzes requirements, researches roles/templates, designs VM architecture, generates structured instructions using existing MCP tools, and estimates resource requirements.
`ludus_read_range_config_schema`	read	Direct access to official Ludus range configuration JSON schema. Provides complete structure, validation rules, and property definitions.
`ludus_read_role_collection_schema`	read	ROLE SCHEMA REFERENCE - Reads Ludus role and collection schemas from individual YAML files. Returns comprehensive role data including variables, descriptions, dependencies, and GitHub repositories. Essential for range planning and configuration validation.
`ludus_roles_search`	read	Search Ludus roles documentation for specific roles, variables, and usage examples.
`range_abort`	read	Abort an in-progress range deployment, stopping all deployment tasks.
`read_range_config`	read	Read and display range configuration from file or URL. Supports local files and remote URLs.
`requirements`	read	Describe what you want to build in natural language (e.g.,
`roles`	read	Optional: Specify desired Ludus roles/collections to use (e.g.,
`save_config`	write	Whether to save the generated configuration to file (true/false)
`set_range_config`	write	Apply range configuration to Ludus server. Sets active configuration for deployment.\n\nWORKING DIRECTORY: All file paths are relative to ~/.ludus-mcp/range-config-templates/\n\nPATH USAGE: Use relative paths only (e.g.,
`target_user`	read	Target user for admin operations (leave empty for current user operations)
`validate_range_config`	read	Validate range configuration against schema and best practices. Essential before deployment.
`write_range_config`	write	Write range configuration to file with automatic validation. Creates directories as needed.

Trust audit

BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED