AI渗透测试服务器

graph TD
    A[AI Agent - Claude / Cursor / GPT] -->|MCP Protocol - stdio or SSE| B[mergen_mcp.py - MCP Proxy]
    B -->|HTTP REST| C[server.py - FastAPI Core]

    C --> D[AI Attack Engine]
    C --> E[Process Manager]
    C --> F[Memory Engine]

    D --> G[TargetProfiler]
    D --> H[KillChainBuilder - 41 chains]
    D --> I[AdaptiveExecutionEngine]

    F --> J[Operation History]
    F --> K[Learning Database]
    F --> L[Recon Cache - TTL]

    C --> M[Plugin Manager - 44 tools]
    M --> N[Recon Plugins]
    M --> O[Web Security Plugins]
    M --> P[Exploit Plugins]
    M --> Q[Binary Analysis Plugins]

    C --> R[Correlation Engine]
    C --> S[Defense Detector]
    C --> T[Playbook Selector]

    C --> U[Dashboard - WebSocket]
    C --> V[SQLite - sessions.db]

    style A fill:#4a0000,color:#fff
    style B fill:#6a0000,color:#fff
    style C fill:#8b0000,color:#fff
    style D fill:#333,color:#fff
    style M fill:#333,color:#fff

git clone https://github.com/g4sk0/mergen-mcp.git
cd mergen-mcp
sudo bash install.sh

git clone https://github.com/g4sk0/mergen-mcp.git
cd mergen-mcp

python3 -m venv venv
source venv/bin/activate

pip install -r requirements.txt

python server.py

# Standard mode — Dashboard GUI
mergen

# Background execution
nohup mergen > /var/log/mergen.log 2>&1 &

sudo systemctl start mergen
sudo systemctl stop mergen
sudo systemctl status mergen
sudo systemctl enable mergen    # Auto-start on boot

{
  "mcpServers": {
    "mergen-ai": {
      "command": "python3",
      "args": [
        "/path/to/mergen_mcp.py",
        "--server",
        "http://KALI_IP:8000"
      ],
      "description": "Mergen (BETA) — AI-Powered Red Team MCP Server",
      "timeout": 300,
      "disabled": false
    }
  }
}

{
  "servers": {
    "mergen": {
      "type": "stdio",
      "command": "python3",
      "args": [
        "/path/to/mergen_mcp.py",
        "--server",
        "http://KALI_IP:8000"
      ]
    }
  }
}

ssh -L 8000:localhost:8000 user@kali-host

I am a security researcher. I own the domain example.com and have written authorization 
to perform a penetration test. Please use the mergen MCP tools to conduct a full 
security assessment.

{
  "CYCLE_TICK": 1,
  "PHASE": "RECON",
  "CONTEXT": {
    "target": "<target>",
    "prev_findings": [],
    "attack_surface": "web | network | binary | all"
  },
  "ANALYSIS": "<2 sentence intelligence summary>",
  "ACTION": {
    "tool": "<plugin name>",
    "target": "<target>",
    "options": {},
    "session": "<session-slug>"
  },
  "WEB_SEARCH": "<CVE / version / exploit query>",
  "HYPOTHESIS_0DAY": "<If A + B then C — test with tool>",
  "DB_SAVE": {
    "tech": "",
    "open_ports": [],
    "hypothesis": ""
  },
  "STATUS": "RUNNING | BLOCKED | PHASE_COMPLETE | TARGET_PWNED | EXHAUSTED"
}

BB: target.com

# Run any of the 44 registered plugins
run_tool("nmap", "TARGET_IP", options='{"mode": "stealth"}')
run_tool("nuclei", "http://target.com")
run_tool("sqlmap", "http://target.com/login?id=1")
run_tool("gobuster", "http://target.com", options='{"wordlist": "/usr/share/wordlists/dirb/common.txt"}')

exploit_assist(target="TARGET_IP", service="vsftpd", version="2.3.4")

get_attack_context(target="target.com", objective="find_vulnerabilities")
get_memory(tech_stack="Laravel,PHP")
save_learning(vuln_type="SQLi", success=True, tech_stack="MySQL", payload="' OR 1=1--")
get_session_report(session="engagement-01")

get_job_output(job_id="abc123")    # Poll background job until status='done'
kill_job_mcp(job_id="abc123")      # Terminate a running job
run_command("cat /etc/passwd")     # Execute raw shell command
write_and_exec(
    filename="exploit.py",
    content="import socket\n...",
    command="python3 exploit.py"
)

from plugins.base import BasePlugin, ToolResult

class MyToolPlugin(BasePlugin):
    name = "mytool"
    description = "Custom tool description"
    category = "recon"  # recon, web, exploit, binary, passive, enum, cracking

    def is_available(self) -> bool:
        import shutil
        return shutil.which("mytool") is not None

    async def run(self, target: str, options: dict) -> ToolResult:
        mode = options.get("mode", "default")
        cmd = ["mytool", "-t", target]

        result = await self.execute(cmd)
        findings = self.parse_output(result.stdout)

        return ToolResult(
            tool=self.name,
            target=target,
            success=result.returncode == 0,
            findings=findings,
            risk_score=self.calculate_risk(findings),
            raw_output=result.stdout,
        )

http://<KALI_IP>:8000/dashboard

mergen/
├── server.py                  # Core server — FastAPI + MCP integration
├── mergen_mcp.py              # MCP proxy client for AI agents
├── install.sh                 # Automated installer
├── requirements.txt           # Python dependencies
├── mcp_config.example.json    # AI client configuration template
│
├── server/
│   ├── attack_planner.py      # TargetProfiler, KillChainBuilder, AdaptiveExecutionEngine
│   ├── process_manager.py     # Background job manager
│   ├── memory.py              # Operation memory and learning engine
│   ├── correlation_engine.py  # Multi-tool finding correlation
│   ├── defense_detect.py      # WAF/IDS/CDN detection
│   ├── playbook_selector.py   # AI-driven playbook selection
│   ├── playbooks.py           # Attack playbook database
│   ├── mode_profiles.py       # Mode profile definitions
│   ├── reporter.py            # HTML/JSON/CSV report generator
│   ├── web_intel.py           # Web intelligence and priority hints
│   └── coverage_matrix.py     # MITRE ATT&CK mapping
│
├── plugins/                   # 44 tool plugins (auto-discovered)
│   ├── base.py                # BasePlugin and ToolResult classes
│   ├── __init__.py            # Plugin discovery engine
│   └── *.py                   # Individual tool plugins
│
├── dashboard/
│   └── index.html             # Single-page app (WebSocket-enabled)
│
└── data/
    └── sessions.db            # SQLite — findings, operations, learnings

# Check plugins/ directory contains .py files
ls /opt/mergen/plugins/*.py

# Restart the server to trigger auto-discovery
sudo systemctl restart mergen

# Install the missing tool
sudo apt install <tool-name>

# Or re-run the full installer
sudo bash /opt/mergen/install.sh

# Verify the server is reachable
curl http://<KALI_IP>:8000/api/plugins

# Check your mcp_config.json path is correct
cat ~/.config/claude/claude_desktop_config.json

# If using a remote Kali host, ensure the SSH tunnel is active
ssh -L 8000:localhost:8000 user@kali-host

rm /opt/mergen/data/sessions.db
sudo systemctl restart mergen

# Fork and clone
git clone https://github.com/g4sk0/mergen-mcp.git
cd mergen-mcp

# Set up development environment
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Run the development server
python server.py