# puffert/Kali MCP Server

Source: https://glimind.com/server/glama%2Fpuffert%2Fkali-mcp-server
Registry id: `glama/puffert/kali-mcp-server`
Status: unknown

## Tools (72)

- `add_credential`: Record a credential in the session.
- `add_finding`: Record a vulnerability with severity and optional evidence.
- `add_host`: Manually add/update a host in the session.
- `add_note`: Free-text note with category.
- `bloodhound_ingest`: BloodHound data collection via bloodhound-python with dc_host and dc_ip.
- `bloodhound_query`: Run Cypher queries against Neo4j with 7 presets for common AD queries.
- `bloody_ad`: AD privilege escalation via DACL/ACE manipulation with multiple operations.
- `burp_api`: Interact with Burp REST API: start scans, get sitemap, export issues.
- `cancel_job`: Cancel a running background job via SIGTERM.
- `certipy_scan`: ADCS enumeration and exploitation finding ESC1-ESC8 vulnerable templates.
- `chisel`: TCP/UDP tunnel for SOCKS5 proxy or local/reverse port forwards.
- `desktop_click`: Mouse clicks at coordinates with left/right/middle and double-click.
- `desktop_clipboard`: Get or set clipboard contents via xclip.
- `desktop_disconnect`: Close RDP/VNC sessions by job ID or window name.
- `desktop_focus`: Focus/activate a specific window by name or ID.
- `desktop_mouse_move`: Move cursor to specific coordinates.
- `desktop_screenshot`: Take screenshot and return as base64 image for Claude to see.
- `desktop_type`: Send keyboard input via xdotool to type text or press keys.
- `desktop_unlock`: Unlock Kali desktop if screen is locked, optionally disable screensaver.
- `desktop_windows`: List all open windows with title, ID, position, and size.
- `dirb_scan`: Web content scanner with parsed output matching gobuster format.
- `enum4linux_scan`: Windows/Samba enumeration extracting users, shares, groups, password policy.
- `evil_winrm`: WinRM shell for one-shot commands or interactive sessions with pass-the-hash.
- `execute_command`: Run any shell command with structured output including stdout, stderr, exit code.
- `export_loot`: Export credentials to attack-ready files like passwords.txt and hashes.
- `ffuf_scan`: Fast web fuzzer with structured JSON output per hit.
- `generate_report`: Generate Markdown engagement report with hosts, creds, findings, notes.
- `get_job`: Check status/results of a background job.
- `get_session`: Full session overview: hosts, creds, findings, notes, stats by severity.
- `gobuster_scan`: Directory/DNS/vhost brute-forcing with parsed results.
- `hashcat_crack`: GPU-accelerated cracking with parsed output and auto-added passwords.
- `hydra_attack`: Online brute-forcing with parsed credentials auto-added to session.
- `impacket_tool`: Run any Impacket tool with auto-parsing of secretsdump, GetNPUsers, GetUserSPNs.
- `john_crack`: Offline hash cracking with cracked creds auto-added to session.
- `kerbrute`: Kerberos user enumeration and password spraying with auto-added creds.
- `launch_bloodhound_gui`: Start BloodHound GUI with Neo4j and optional data import.
- `launch_burp`: Start Burp Suite GUI or headless.
- `launch_wireshark`: Start Wireshark GUI or tshark headless capture.
- `ligolo`: Ligolo-ng tunneling proxy to create TUN interfaces and add routes.
- `list_jobs`: List all background jobs with status and runtime.
- `load_session`: Restore a saved session from JSON file.
- `metasploit_run`: Run MSF modules via resource script with async support.
- `msfvenom_generate`: Generate payloads with any format, encoder, and platform.
- `nikto_scan`: Web server vulnerability scanner with auto-added findings.
- `nmap_scan`: Port/service scan returning parsed JSON with hosts, ports, services, OS, scripts.
- `nxc_scan`: NetExec multi-protocol scanner for credential testing, dumping, and execution.
- `ping_sweep`: Quick host discovery via nmap -sn returning live hosts.
- `proxychains_run`: Run any command through a SOCKS proxy with auto-generated config.
- `rdp_connect`: Connect to target via RDP with auto-detection of xfreerdp version.
- `responder`: LLMNR/NBT-NS/mDNS poisoner capturing NTLM hashes as background job.
- `save_session`: Persist session to JSON file with 0600 permissions.
- `screenshot`: Capture desktop or specific window to file.
- `searchsploit`: Search Exploit-DB with structured JSON results.
- `set_engagement`: Initialize engagement with name, scope, and working directory.
- `sliver_armory`: List, search, and install armory extensions and aliases.
- `sliver_command`: Generic escape hatch for any Sliver console command via RC script.
- `sliver_generate`: Generate session or beacon implants for Windows/Linux/macOS.
- `sliver_kill`: Kill sessions, beacons, or jobs.
- `sliver_listener`: Start/stop/list Sliver listeners: mTLS, HTTP, HTTPS, DNS, WireGuard.
- `sliver_profiles`: Create, list, or generate from implant profiles.
- `sliver_server`: Manage sliver-server daemon: start/stop/restart, create operators, multiplayer.
- `sliver_sessions`: List active sessions, beacons, or jobs with optional filtering.
- `sliver_stager`: Generate staged payloads with stage listener setup.
- `sliver_use`: Run commands on a session/beacon via RC script including armory extensions.
- `smb_share`: Host directory over SMB via impacket-smbserver as background job.
- `socat_relay`: TCP/UDP port relay and forwarding.
- `sqlmap_scan`: SQL injection scanner extracting injection points and databases.
- `sshuttle`: VPN-over-SSH tunnel to route traffic through compromised hosts.
- `start_listener`: ncat TCP listener as background job for reverse shells with optional TLS.
- `tshark_analyze`: Analyze pcap files: protocol stats, conversations, filtered output.
- `vnc_connect`: Connect to target via VNC with password auth and view-only mode.
- `wpscan_analyze`: WordPress vulnerability scanner for version, plugins, vulnerabilities.

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.