渗透测试MCP服务器

You ──► AI Chat ──► server.py (MCP Server) ──► 🔴 Burp Suite REST API
                                           ├──► 🟡 Kali Linux CLI Tools
                                           └──► 🟢 Pure Python Security Modules

╔══════════════════════════════════════════════════════════════╗
║           kali-burp-mcp-bridge  v3.0  (server.py)           ║
╠══════════════════════════════════════════════════════════════╣
║  🔴 Layer 1 — Burp Suite REST API  (port 9876)              ║
║     Proxy history · Active/passive scanner · Repeater        ║
║     Intruder · Collaborator OOB · Encoding · Config          ║
╠══════════════════════════════════════════════════════════════╣
║  🟡 Layer 2 — Kali Linux CLI Tools                          ║
║     nmap · masscan · nikto · gobuster · ffuf · dirb          ║
║     sqlmap · hydra · john · hashcat · metasploit             ║
║     whatweb · wpscan · nuclei · enum4linux · smbclient       ║
║     subfinder · amass · fierce · dnsx · sslscan              ║
║     curl · wget · netcat · openssl · whois · dig             ║
╠══════════════════════════════════════════════════════════════╣
║  🟢 Layer 3 — Pure Python Security Modules                  ║
║     JWT decode/forge/brute · CORS · HTTP smuggling           ║
║     SSRF probe · Cache poisoning · OAuth analysis            ║
║     GraphQL introspect · Session entropy · Param mining      ║
║     CVE lookup · GitHub secret scan · Exploit templates      ║
╚══════════════════════════════════════════════════════════════╝

  MCP Transport:  stdio (default)  |  SSE port 8082 (--transport sse)
  Burp REST API:  http://127.0.0.1:9876  (via BurpAI extension)

git clone https://github.com/yourusername/kali-burp-mcp-bridge.git
cd kali-burp-mcp-bridge

# Option A — using uv (recommended, auto-installs all deps)
pip install uv
uv run server.py

# Option B — using pip manually
pip install "requests>=2,<3" "mcp>=1.2.0,<2" "flask>=3,<4" "websocket-client>=1.6"
python3 server.py

sudo apt-get update && sudo apt-get install -y \
  nmap masscan nikto gobuster dirb ffuf sqlmap \
  hydra john hashcat whatweb wpscan \
  enum4linux smbclient netcat-openbsd \
  curl wget whois dnsutils sslscan \
  amass subfinder fierce \
  metasploit-framework

# Wordlists
sudo apt-get install -y wordlists seclists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz 2>/dev/null || true

# Go-based tools (nuclei, dnsx, ffuf, gobuster latest)
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install github.com/ffuf/ffuf/v2@latest

{
  "mcpServers": {
    "kali-burp": {
      "command": "python3",
      "args": ["/full/path/to/kali-burp-mcp-bridge/server.py"],
      "env": {
        "BURP_URL": "http://127.0.0.1:9876",
        "BURP_API_KEY": "",
        "TOOL_TIMEOUT": "120"
      }
    }
  }
}

# On your Kali machine
python3 server.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8082

{
  "mcpServers": {
    "kali-burp-remote": {
      "url": "http://YOUR_KALI_IP:8082/sse"
    }
  }
}

# Start SSE server on your machine
python3 server.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8082

http://YOUR_IP:8082/sse

# Start SSE server first
python3 server.py --transport sse --mcp-port 8082

# pip install openai-agents
from agents import Agent, MCPServerSse
import asyncio

async def main():
    async with MCPServerSse(
        name="kali-burp",
        params={"url": "http://127.0.0.1:8082/sse"},
    ) as mcp_server:
        agent = Agent(
            name="PenTest Agent",
            instructions="You are an expert penetration tester. Use the available tools to help test targets.",
            mcp_servers=[mcp_server],
        )
        result = await agent.run("Scan 10.10.10.5 for open ports and identify services")
        print(result.final_output)

asyncio.run(main())

{
  "mcpServers": {
    "kali-burp": {
      "command": "python3",
      "args": ["/full/path/to/server.py"],
      "env": {
        "BURP_URL": "http://127.0.0.1:9876",
        "TOOL_TIMEOUT": "120"
      }
    }
  }
}

{
  "mcp": {
    "servers": {
      "kali-burp": {
        "command": "python3",
        "args": ["/full/path/to/server.py"],
        "env": {
          "BURP_URL": "http://127.0.0.1:9876"
        }
      }
    }
  }
}

# Start in SSE mode
python3 server.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8082

# Connect any MCP client to:
# http://YOUR_HOST:8082/sse

"Run a full port scan on 10.10.10.5 and identify all running services"
"Enumerate subdomains for example.com and resolve their IP addresses"
"Do a WHOIS lookup and a service scan on 192.168.1.0/24"
"Find subdomains of target.com using both subfinder and amass"
"Check what web technologies are running on https://target.com"

"Test https://target.com for SQL injection vulnerabilities"
"Run a full web audit on https://target.com"
"Check for CORS misconfigurations on https://api.target.com"
"Fuzz for hidden directories and files on https://target.com"
"Scan https://target.com/graphql for introspection and exposed types"
"Find hidden parameters on https://target.com/search"
"Extract API endpoints and secrets from https://target.com/app.bundle.js"

"Decode this JWT and check for vulnerabilities: eyJhbGciOiJIUzI1NiJ9..."
"Try an alg:none signature bypass on this token"
"Brute-force the HS256 secret on this JWT using rockyou.txt"
"Analyze this OAuth authorization URL for security issues"

"Generate a Windows x64 reverse shell payload for 192.168.1.10 port 4444"
"Run the EternalBlue exploit against 10.10.10.4"
"Use sqlmap to dump all databases from https://target.com/vuln?id=1"
"Brute-force SSH on 10.10.10.5 using rockyou.txt"
"Generate a Python cookie stealer exploit for the XSS at https://target.com/search?q="
"Search Metasploit for Apache Struts exploit modules"

"What CVEs affect Apache 2.4.49?"
"Look up CVE-2021-44228 Log4Shell and explain the risk"
"Scan the GitHub repo owner/repo for exposed API keys in recent commits"
"Map all known CVEs for nginx 1.14.0"

"Get the last 100 requests from Burp proxy history"
"Launch an active scan against https://target.com"
"Show me all high and critical issues from the Burp scanner"
"Generate a Burp Collaborator payload for out-of-band testing"
"Send this HTTP request to Burp Repeater and show me the response"
"Build an Intruder attack with XSS payloads against this request template"

python3 server.py [OPTIONS]

  --burp-url TEXT        Burp REST API URL       (default: http://127.0.0.1:9876)
  --api-key TEXT         Burp API key            (default: empty)
  --transport TEXT       stdio or sse            (default: stdio)
  --mcp-host TEXT        SSE server bind host    (default: 127.0.0.1)
  --mcp-port INT         SSE server port         (default: 8082)
  --timeout INT          HTTP request timeout    (default: 30)
  --tool-timeout INT     CLI tool timeout        (default: 120)
  --debug                Enable debug logging

# Default stdio mode — for Claude Desktop, Cursor, local AI tools
python3 server.py

# SSE mode — for claude.ai web, ChatGPT Agents SDK, remote clients
python3 server.py --transport sse

# SSE mode, publicly accessible, custom port
python3 server.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8082

# With Burp API key and debug output
python3 server.py --api-key YOUR_KEY --debug

# Full custom configuration
python3 server.py \
  --burp-url http://127.0.0.1:9876 \
  --api-key YOUR_KEY \
  --transport sse \
  --mcp-host 0.0.0.0 \
  --mcp-port 8082 \
  --tool-timeout 300 \
  --debug