Atlas / MCP servers / tjnull / Ludus Fast

Ludus FastBLOCK

Name: Ludus Fast
Author: tjnull

mcp/tjnull/ludus-fast

MCP server by tjnull · Audited 2026-10-07

A Model Context Protocol (MCP) server for automating Ludus v1 and v2 cyber range environments through AI assistants. 190+ tools for range management, blueprints, groups, templates, scenarios, and SIEM integration.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

200 155r · 57w · 19d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/tjnull/Ludus-FastMCP) [](https://python.org) [](https://docs.ludus.cloud) [](LICENSE)

A Model Context Protocol (MCP) server for automating Ludus cyber range environments through AI assistants written in Python.

Overview

Ludus FastMCP enables AI-powered management of Ludus cyber ranges through natural language commands. The server exposes 231 tools across 23 modules for range lifecycle management, scenario deployment, template creation, Ansible role management, and security monitoring integration.

Requires Ludus 2.0 or later. This release targets the Ludus 2.x API only, which is what makes blueprints, groups, content sources, VM console access, quotas and diagnostics available. Support for the Ludus 1.x API was removed; pin ludus-fastmcp to a 1.x release if you still run a Ludus 1.x server.

The client covers every endpoint in the Ludus API, validated against a live Ludus 2.3.0 server.

Key Capabilities

Read from source at commit 85139c9df8d7OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ludus-fastmcp --env LUDUS_SSH_KEY_PATH=${LUDUS_SSH_KEY_PATH} --env LUDUS_SSH_PASSWORD=${LUDUS_SSH_PASSWORD} -- uvx ludus-fastmcp

claude-desktop

{
  "mcpServers": {
    "ludus-fastmcp": {
      "command": "uvx",
      "args": [
        "ludus-fastmcp"
      ],
      "env": {
        "LUDUS_SSH_KEY_PATH": "${LUDUS_SSH_KEY_PATH}",
        "LUDUS_SSH_PASSWORD": "${LUDUS_SSH_PASSWORD}"
      }
    }
  }
}

Exposed tools (200)

155 read · 57 write · 19 destructive. Blast radius: 19 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`abort_and_remove_range`	destructive	Abort any active deployment and then remove the range.
`abort_range_deployment`	read	Abort a range deployment.
`abort_template_build`	read	Abort the running packer build(s).
`add_ranges_to_group`	write	Add ranges to a group.
`add_source`	write	Register a new content source on the Ludus server.
`add_template`	write	Add a packer template to Ludus by uploading a local directory.
`add_user`	write	Add a new user to the Ludus system.
`add_users_to_group`	write	Add users to a group.
`allow_testing_domains`	read	Allow specific domains or IPs while the range is in testing mode.
`apply_adversary_profile`	write	Apply adversary profile to inject realistic vulnerabilities for red team training.
`apply_blueprint_to_range`	write	Apply a blueprint to a range.
`apply_defender_profile`	write	Apply defender profile to add monitoring and detection capabilities for blue team training.
`assign_range_to_user`	read	Assign range access to a user.
`auto_scaling`	read	Define auto-scaling rules based on resource usage.
`batch_get_vm_status`	read	Get status of multiple VMs in parallel.
`batch_power_off_hosts`	read	Power off multiple VMs in parallel.
`batch_power_on_hosts`	read	Power on multiple VMs in parallel.
`batch_remove_snapshots`	destructive	Remove snapshots from multiple VMs in parallel.
`batch_rollback_snapshots`	read	Rollback multiple VMs to a snapshot in parallel.
`batch_snapshot_hosts`	write	Create snapshots for multiple VMs in parallel.
`build_container_based_template`	read	Build a custom container-based template for applications.
`build_range_from_description`	read	Build a custom range configuration from a natural language description.
`build_range_from_scratch`	read	Build a completely custom range configuration from scratch.
`build_range_from_skeleton`	read	Build a complete range configuration starting from a skeleton.
`build_template`	write	Start a packer build for one or more VM templates.
`bulk_vm_operations`	read	Perform bulk operations on multiple VMs.
`capture_network_traffic`	read	Capture network traffic on a VM.
`check_role_installed`	read	Check if a specific Ansible role is installed.
`cleanup_old_ranges`	destructive	Delete all ranges EXCEPT those belonging to specified users.
`clear_range_access`	destructive	Clear all range access permissions.
`clone_and_modify_scenario`	write	Clone an existing scenario and modify it to create a new custom scenario.
`clone_range`	read	Clone the current range to another user.
`compliance_check`	read	Check compliance against security framework.
`configure_ssh_role_installation`	read	Configure SSH access for automatic role installation on Ludus server.
`copy_blueprint`	read	Copy a blueprint under a new ID.
`create_blueprint`	write	Create a blueprint from a range configuration you already have.
`create_blueprint_from_range`	write	Create a reusable blueprint from an existing range.
`create_container_template`	write	Create a container-based template.
`create_custom_os_template`	write	Create a custom OS template with specific packages and configuration.
`create_custom_range_from_scenario`	write	Create a custom range configuration based on an existing scenario.
`create_custom_template`	write	Create a custom template from scratch.
`create_deployment_pipeline`	write	Create a deployment pipeline with multiple stages.
`create_group`	write	Create a new group.
`create_kali_weekly_template`	write	Create a Kali Linux weekly template with automatic latest ISO detection.
`create_new_range`	write	Create a new range.
`create_scenario_playbook`	write	Generate a red or blue team playbook for a scenario.
`delete_blueprint`	destructive	Delete a blueprint.
`delete_group`	destructive	Delete a group.
`delete_range`	destructive	Delete the entire range.
`delete_range_by_user`	destructive	Delete a specific user
`delete_range_object`	destructive	Delete a range object entirely, removing its configuration too.
`delete_ranges_by_status`	destructive	Delete all ranges matching a specific status (requires confirmation).
`delete_source`	destructive	Remove a content source.
`delete_template`	destructive	Delete a template.
`deny_testing_domains`	read	Re-block domains or IPs that were previously allowed in testing mode.
`deploy_range`	write	Deploy a range from configuration with optional filters for resuming.
`deploy_range_from_blueprint`	write	Set up and deploy a whole range from a blueprint in one call.
`deploy_scenario`	write	Deploy a scenario with optional SIEM integration and customization.
`deployment_timeline`	read	Get deployment timeline with progress tracking.
`destroy_vm`	destructive	Destroy a specific VM.
`diagnose_network_issues`	read	Diagnose network connectivity issues.
`ensure_scenario_roles`	read	Ensure all required roles for a scenario are installed, installing missing ones automatically.
`explain_range_design_decisions`	read	Explain the design decisions and best practices for a range configuration request.
`export_blueprint`	read	Export a blueprint to a .tar.gz archive on disk.
`export_lab_guide`	read	Export lab guide for training purposes.
`export_metrics`	read	Export metrics data.
`export_range_backup`	read	Export a range backup (configuration and snapshot metadata).
`export_range_config_to_yaml`	read	Export a range configuration to a YAML file for download.
`find_range_by_vm_name`	read	Find which range contains a specific VM by name.
`generate_config_from_description`	read	Generate a complete Ludus range configuration from natural language description.
`generate_range_documentation`	read	Generate comprehensive documentation for the range.
`get_all_user_quotas`	read	Get quotas for every user on the server (admin only).
`get_ansible_role_vars`	read	Get variables for an Ansible role (Ludus 2.0 only).
`get_attack_path_documentation`	read	Generate attack path documentation for an attack technique.
`get_auto_shutdown`	read	Get the auto-shutdown timeout for a range.
`get_blueprint`	read	Get a blueprint
`get_blueprint_config`	read	Get blueprint configuration.
`get_common_container_configs`	read	Get pre-configured container definitions for common applications.
`get_common_galaxy_roles`	read	Get a list of commonly used Ansible Galaxy roles for Ludus scenarios.
`get_common_iso_urls`	read	Get common ISO download URLs for popular operating systems.
`get_container_config`	read	Get configuration for a common container.
`get_cost_estimation`	read	Get cost estimation for the range.
`get_current_range_config_for_download`	read	Get the current range configuration and prepare it for download.
`get_default_quotas`	read	Get the server-wide default quotas that new users inherit.
`get_default_range`	read	Get user
`get_deployment_metrics`	read	Get metrics for the current deployment.
`get_deployment_status`	read	Get current deployment status with detailed information.
`get_detection_summary`	read	Get detection summary from SIEM.
`get_diagnostics`	read	Get system diagnostics.
`get_group_quotas`	read	Get the default quotas configured for each group (admin only).
`get_license`	read	Get license information.
`get_network_topology`	read	Get network topology visualization data.
`get_range`	read	Get current user
`get_range_access`	read	Get range access information.
`get_range_ansible_inventory`	read	Get Ansible inventory for the range.
`get_range_by_user`	read	Get detailed information about a specific user
`get_range_config`	read	Get range configuration.
`get_range_etchosts`	read	Get /etc/hosts entries for the range.
`get_range_log_from_history`	read	Get the full contents of one archived range deployment log.
`get_range_logs`	read	Get deployment logs for the range.
`get_range_metrics`	read	Get comprehensive metrics for the range.
`get_range_rdpconfigs`	read	Get RDP configuration files for the range.
`get_range_skeleton`	read	Get a complete range skeleton configuration.
`get_range_sshconfig`	read	Get SSH config for the range.
`get_range_tags`	read	Get available Ansible tags for the current range.
`get_recovery_recommendation`	read	Get recovery recommendations for failed deployments.
`get_required_roles_for_scenario`	read	Get the list of required Ansible roles for a specific scenario.
`get_resource_quotas`	read	Get resource quotas and current usage.
`get_role_info`	read	Get information about a specific role, including installation method and requirements.
`get_scenario_config`	read	Get scenario configuration.
`get_scenario_yaml`	read	Get scenario configuration as YAML.
`get_sdn_migration_status`	read	Get SDN migration status.
`get_server_openapi_spec`	read	Fetch the Ludus server
`get_siem_agents`	read	Get SIEM agents for the range.
`get_siem_alerts`	read	Get SIEM alerts for the range.
`get_siem_info`	read	Get SIEM information for the range.
`get_source`	read	Get details for a single content source.
`get_source_catalog`	write	Get everything a source publishes, with install state for each item.
`get_template_dependencies`	read	Get template dependencies.
`get_template_log_from_history`	read	Get the full contents of one archived template build log.
`get_template_logs`	read	Get the latest packer build logs.
`get_template_status`	read	Get the status of in-progress packer builds.
`get_user`	read	Get information about a specific user.
`get_user_memberships`	read	Get current user
`get_user_quotas`	read	Get the resource quotas applied to a user.
`get_vm_console_ticket`	read	Get a console (noVNC) ticket for a VM.
`get_vm_console_view_url`	read	Get the console WebSocket URL for a ticket from get_vm_console_ticket.
`get_vm_skeleton`	read	Get a specific VM skeleton template configuration.
`get_vulnerability_scan`	read	Get vulnerability scan results for the range.
`get_wazuh_info`	read	Get Wazuh SIEM information for the range.
`get_yaml_example`	read	Get a ready-to-use YAML configuration example.
`git_sync`	write	Sync range configurations with a Git repository.
`grant_range_access`	read	Grant other users access to your range.
`handle_adws_recovery`	read	Handle Active Directory Web Services (ADWS) recovery for stuck deployments.
`health_check`	read	Check health of Ludus MCP server and Ludus API connectivity.
`health_checks`	write	Run health checks on all VMs in the range.
`import_blueprint`	write	Import a blueprint from a .tar.gz archive.
`import_community_scenario`	write	Import a scenario from the community repository.
`import_range_backup`	write	Import and restore range from backup.
`install_blueprint`	write	Install a blueprint
`install_from_source`	write	Install templates, blueprints, roles or collections from a source.
`install_galaxy_role`	write	Install an Ansible role directly from Ansible Galaxy.
`install_role`	write	Install an Ansible role on the Ludus server via MCP.
`install_role_from_url`	write	Install an Ansible role from a custom Git repository URL.
`install_subscription_roles`	write	Install subscription roles (Ludus 2.0 Enterprise only).
`jira_integration`	read	Configure JIRA issue creation for failed deployments.
`list_accessible_ranges`	read	List ranges accessible to current user.
`list_all_ranges_detailed`	read	List all ranges with detailed information including identification.
`list_available_profiles`	read	List all available adversary and defender profiles with descriptions.
`list_blueprint_access_groups`	read	List groups with access to a blueprint.
`list_blueprint_access_users`	read	List users with access to a blueprint.
`list_blueprints`	read	List all available blueprints.
`list_common_containers`	read	List common container base images.
`list_group_members`	read	List group members.
`list_group_ranges`	read	List group ranges.
`list_groups`	read	List all groups.
`list_hosts`	read	List all hosts in range.
`list_installed_roles`	read	List all installed Ansible roles on the Ludus server.
`list_networks`	read	List the networks (VLANs) in a range.
`list_range_log_history`	read	List previous range deployment logs, most recent first.
`list_range_skeletons`	read	List all available range skeleton templates.
`list_range_users`	read	List users with access to a range.
`list_ranges`	read	List all ranges (admin only).
`list_role_repositories`	read	List all roles that are available from GitHub repositories (directory-based roles).
`list_scenarios`	read	List all available scenarios.
`list_snapshots`	read	List all snapshots for the range.
`list_source_blueprints`	read	List blueprints published by a source (GOAD, AD + Elastic, ...).
`list_source_collections`	read	List Ansible collections published by a source.
`list_source_roles`	read	List Ansible roles published by a source.
`list_source_templates`	read	List packer templates published by a source.
`list_sources`	read	List content sources configured on the Ludus server.
`list_subscription_roles`	read	List available subscription roles (Ludus 2.0 Enterprise only).
`list_template_log_history`	read	List previous template build logs, most recent first.
`list_templates`	read	List available templates.
`list_users`	read	List all users in the Ludus system.
`list_vm_skeletons`	read	List all available VM skeleton templates.
`list_yaml_examples`	read	List all available YAML configuration examples.
`migrate_sqlite_to_pocketbase`	read	Migrate from SQLite to PocketBase.
`migrate_to_sdn`	read	Migrate to SDN networking.
`monitor_deployment`	read	Monitor deployment progress with periodic updates.
`move_ansible_role_scope`	write	Move Ansible roles between user and global scope (Ludus 2.0 only).
`optimize_resource_allocation`	read	Optimize resource allocation for the range.
`optimize_template`	read	Optimize a template for better performance.
`power_off_range`	read	Power off all VMs in the range.
`power_on_range`	read	Power on all VMs in the range.
`preview_profile_changes`	read	Preview changes that would be made by applying a profile without modifying the config.
`preview_scenario`	read	Preview a scenario before deployment with detailed information.
`provision_oauth2_user`	read	Provision an OAuth2 user (Ludus 2.0 only).
`publish_scenario`	write	Publish a scenario to the community repository.
`quick_status`	read	Get one-line deployment status with emoji indicators.
`range_access_logs`	read	Get range access logs.
`regenerate_user_apikey`	read	DESTRUCTIVE: issue a NEW API key for a user, invalidating the old one.
`remove_ranges_from_group`	destructive	Remove ranges from a group.
`remove_snapshot`	destructive	Delete a snapshot from one or more VMs.
`remove_user`	destructive	Remove a user from the Ludus system.
`remove_users_from_group`	destructive	Remove users from a group.
`revoke_range_access`	destructive	Revoke range access from a user.
`revoke_range_from_user`	destructive	Revoke range access from a user.
`rollback_snapshot`	read	Roll one or more VMs back to a snapshot.
`rotate_credentials`	write	Suggest new credentials for VMs in the range. DOES NOT APPLY THEM.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (8 observation(s))
Network: declared (15 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (22)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

ludus_mcp/utils/error_formatter.py:239

"- For self-signed certs: Set LUDUS_SSL_VERIFY=false",

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338

ludus_mcp/scenarios/randomizer.py:184

pattern = random.choice(PASSWORD_PATTERNS)