安全工具容器化服务

cd /path/to/kali-mcp-server
uv sync

docker build -t kali-mcp:latest .

# Required: Your Mullvad account number
MULLVAD_ACCOUNT_NUMBER=YOUR_16_DIGIT_ACCOUNT_NUMBER

# Optional: Default server location (default: se)
MULLVAD_DEFAULT_SERVER=se

# Optional: Default protocol (default: wireguard)
MULLVAD_DEFAULT_PROTOCOL=wireguard

{
  "mcpServers": {
    "kali-linux": {
      "command": "uv",
      "args": [
        "run",
        "--directory",
        "/absolute/path/to/kali-mcp-server",
        "python",
        "src/kali_mcp_server/mcp_server.py"
      ]
    }
  }
}

export MULLVAD_ACCOUNT_NUMBER="YOUR_16_DIGIT_ACCOUNT"
export MULLVAD_DEFAULT_SERVER="se"
export MULLVAD_DEFAULT_PROTOCOL="wireguard"

// 1. Check security headers first
security_headers_check({
  target: 'http://localhost:3000',
});

// 2. Scan for vulnerable JavaScript libraries
retirejs_scan({
  target: 'http://localhost:3000',
});

// 3. Test for SQL injection vulnerabilities
sqlmap_scan({
  target: 'http://localhost:3000/api/users?id=1',
  level: 3,
  risk: 2,
});

// 4. Test POST forms for SQL injection
sqlmap_scan({
  target: 'http://localhost:3000/login',
  data: 'username=admin&password=test',
  level: 2,
});

// 5. Comprehensive web app scan
zap_scan({
  target: 'http://localhost:3000',
  scan_type: 'baseline',
});

// 6. Fast vulnerability detection with Nuclei
nuclei_scan({
  target: 'http://localhost:3000',
  templates: 'cves,misconfigurations,exposures',
  severity: 'critical,high',
});

// 7. Test HTTPS configuration (if using SSL)
testssl_scan({
  target: 'https://localhost:8443',
});

// Quick port scan
nmap_scan({
  target: '192.168.1.0/24',
  scan_type: 'quick',
});

// Full scan with OS detection
nmap_scan({
  target: 'example.com',
  scan_type: 'full',
  ports: '1-65535',
});

// Web vulnerability scan
nikto_scan({
  target: 'https://example.com',
});

// Directory enumeration
dirb_scan({
  target: 'https://example.com',
  wordlist: '/usr/share/dirb/wordlists/common.txt',
});

// Connect to VPN before testing
vpn_connect({
  server: 'se got',
  protocol: 'wireguard',
});

// Verify VPN connection
vpn_status({ verbose: true });

// Perform anonymous testing
nmap_scan({
  target: 'authorized-target.com',
  scan_type: 'stealth',
});

// Disconnect when done
vpn_disconnect();

// Decode JWT token
jwt_decode({
  token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
  verify: true,
  secret: 'suspected-secret',
});

// Security vulnerability testing
jwt_security_test({
  token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
  endpoint: 'https://api.example.com/protected',
});

// 1. Establish anonymous connection
vpn_connect({ server: 'se got' });
vpn_status({ verbose: true });

// 2. Initial reconnaissance
nmap_scan({
  target: 'authorized-target.com',
  scan_type: 'stealth',
  ports: '1-10000',
});

// 3. Web application security testing
// a. Modern vulnerability scan
zap_scan({
  target: 'https://authorized-target.com',
  scan_type: 'baseline',
});

// b. Fast CVE and misconfiguration detection
nuclei_scan({
  target: 'https://authorized-target.com',
  templates: 'cves,misconfigurations,exposures',
  severity: 'critical,high',
});

// c. Security headers check
security_headers_check({
  target: 'https://authorized-target.com',
});

// d. Check for vulnerable JavaScript libraries
retirejs_scan({
  target: 'https://authorized-target.com',
});

// 4. Database security testing
sqlmap_scan({
  target: 'https://authorized-target.com/api/products?id=1',
  level: 3,
  risk: 2,
});

// 5. SSL/TLS security analysis
testssl_scan({
  target: 'authorized-target.com:443',
});

// 6. API and JWT security testing
jwt_security_test({
  token: 'captured-jwt-token',
  endpoint: 'https://api.authorized-target.com/v1/user',
});

// 7. Switch VPN location if needed
vpn_connect({ server: 'nl ams' });

// 8. Additional testing from new IP
nmap_scan({
  target: 'authorized-target.com',
  scan_type: 'full',
});

// 9. Clean disconnect
vpn_disconnect();

// Comprehensive security check for your local web application
const target = 'http://localhost:3000';

// Step 1: Quick security posture
security_headers_check({ target });

// Step 2: Check for vulnerable dependencies
retirejs_scan({ target });

// Step 3: SQL injection testing
sqlmap_scan({
  target: `${target}/api/search?q=test`,
  level: 2,
  risk: 1,
});

// Step 4: Comprehensive vulnerability scan
zap_scan({
  target,
  scan_type: 'baseline',
});

// Step 5: Template-based checks
nuclei_scan({
  target,
  templates: 'misconfigurations,exposures',
  severity: 'medium,high,critical',
});

// Step 6: If using HTTPS locally
testssl_scan({
  target: 'https://localhost:8443',
});

kali-mcp-server/
├── src/
│   └── kali_mcp_server/
│       ├── __init__.py
│       ├── mcp_server.py           # Main MCP server (clean coordinator)
│       ├── core/
│       │   ├── __init__.py
│       │   └── docker_executor.py  # Reusable Docker execution engine
│       └── tools/
│           ├── __init__.py
│           ├── network_tools.py    # Nmap, Nikto, DIRB
│           ├── web_tools.py        # SQLMap, ZAP, Nuclei, testssl, retire.js
│           ├── vpn_tools.py        # Mullvad VPN management
│           └── jwt_tools.py        # JWT security testing
├── Dockerfile                       # Kali Linux container definition
├── pyproject.toml                   # Python dependencies
├── .env                            # Environment configuration (git-ignored)
├── .env.example                    # Environment template
└── README.md                       # This file

# Install development dependencies
uv sync --dev

# Format code
uv run black .

# Lint code
uv run ruff check .

# Run tests (if available)
uv run pytest

# Test server locally
uv run python src/kali_mcp_server/mcp_server.py

# In tools/network_tools.py
async def run_masscan(args: Dict[str, Any]) -> Dict[str, Any]:
    """Execute Masscan port scanner.

    Args:
        args: Dictionary containing target and rate parameters

    Returns:
        Dictionary with scan results
    """
    target = args["target"]
    rate = args.get("rate", 1000)
    cmd = ["masscan", target, "-p1-65535", f"--rate={rate}"]
    return await execute_in_container(cmd, privileged=True)

# Add custom tools
RUN apt-get update && apt-get install -y \
    your-custom-tool \
    another-tool \
    && rm -rf /var/lib/apt/lists/*

# Add Python packages
RUN pip3 install --no-cache-dir --break-system-packages \
    your-python-package

docker build -t kali-mcp:latest .

"args": ["run", "--directory", "/absolute/path/to/project", "python", "src/kali_mcp_server/mcp_server.py"]

# Start Docker service
sudo systemctl start docker

# Add user to docker group
sudo usermod -aG docker $USER
newgrp docker

# Reinstall dependencies
uv sync

# Verify uv is using correct Python version
uv run python --version  # Should be 3.10+

# Verify Docker image is updated
docker images | grep kali-mcp

# Rebuild if needed
docker build -t kali-mcp:latest .

# Test manually
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  kali-mcp:latest nmap -F 192.168.1.1