渗透测试工具集成服务

┌──────────────────────────────────────────────────────────────┐
│                     MCP Client                               │
│            (Claude Desktop / VS Code Copilot)                │
└─────────────────────────┬────────────────────────────────────┘
                          │ HTTP/SSE
                          ▼
┌──────────────────────────────────────────────────────────────┐
│                   PentestMCP Server                          │
│                   (Docker Container)                         │
│  ┌────────────────────────────────────────────────────────┐  │
│  │  MCP Server (Python/FastAPI)                           │  │
│  │  - Tool Registration                                   │  │
│  │  - Request Handling                                    │  │
│  │  - Process Management                                  │  │
│  └────────────────────────────────────────────────────────┘  │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────────────────┐ │
│  │   Network   │ │     Web     │ │   Active Directory      │ │
│  │    Tools    │ │    Tools    │ │        Tools            │ │
│  │  - Nmap     │ │  - Nuclei   │ │  - BloodHound           │ │
│  │  - Masscan  │ │  - Gobuster │ │  - Impacket             │ │
│  │  - RustScan │ │  - ffuf     │ │  - CrackMapExec         │ │
│  └─────────────┘ └─────────────┘ └─────────────────────────┘ │
└──────────────────────────────────────────────────────────────┘

# Pull the pre-built image
docker pull reaper3389/pentestmcp:latest

# Using Docker Compose (recommended)
docker-compose up -d

# Or using Docker directly
docker run -d -p 8080:8080 --name pentestmcp \
  --cap-add=NET_ADMIN --cap-add=NET_RAW \
  reaper3389/pentestmcp:latest

# Clone and build from source
cd /path/to/pentestMCP
docker build -t pentestmcp:latest .

{
  "mcpServers": {
    "pentestmcp": {
      "command": "docker",
      "args": ["run", "--rm", "-p", "8080:8080", "--cap-add=NET_ADMIN", "--cap-add=NET_RAW", "reaper3389/pentestmcp:latest"]
    }
  }
}

User: "Scan 192.168.1.1 for open ports"
Claude: [Uses run_nmap_scan tool]

User: "Find vulnerabilities on https://example.com"
Claude: [Uses run_nuclei tool]

User: "Enumerate Active Directory users"
Claude: [Uses ad_get_users tool]

pentestMCP/
├── Dockerfile              # Container definition
├── docker-compose.yml      # Docker Compose config
├── requirements.txt        # Python dependencies
├── start_services.sh       # Startup script
├── pentestMCP-sse.py       # Main MCP server
│
├── tools/                  # Tool modules
│   ├── __init__.py
│   ├── nmap.py            # Nmap wrapper
│   ├── nuclei.py          # Nuclei wrapper
│   ├── curl_tool.py       # HTTP requests
│   ├── web_tools.py       # Web scanning tools
│   ├── ad_tools.py        # Active Directory tools
│   ├── network_tools.py   # Network scanning
│   └── dns_tools.py       # DNS enumeration
│
├── utils/                  # Utility modules
│   ├── __init__.py
│   ├── parser.py          # Output parsing
│   ├── logger.py          # Logging
│   ├── credentials.py     # Credential storage
│   └── state.py           # State management
│
└── output/                 # Scan outputs

deploy:
  resources:
    limits:
      cpus: '4.0'
      memory: 4G

1. run_subfinder("example.com")      # Find subdomains
2. run_httpx(subdomains_file)        # Probe HTTP services
3. run_nuclei(live_hosts)            # Vulnerability scan
4. run_gau("example.com")            # Historical URLs

1. run_nmap_scan("192.168.1.0/24")   # Network scan
2. run_enum4linux("192.168.1.100")   # Windows enum
3. run_smbmap("192.168.1.100")       # Share enum
4. run_crackmapexec("smb", ...)      # Domain enum

1. ad_get_users(dc, domain, user, pass)         # User enum
2. ad_asreproast(dc, domain)                    # AS-REP roast
3. ad_kerberoast(dc, domain, user, pass)        # Kerberoast
4. ad_bloodhound_collect(dc, domain, user, pass) # BloodHound

# Check container status
docker ps

# View logs
docker logs pentestmcp

# Enter container
docker exec -it pentestmcp /bin/bash

# Test health endpoint
curl http://localhost:8080/health

# Check port mapping
docker port pentestmcp

# Check if tool is available (via MCP)
User: "Check if nmap is available"