Exploit for RedTeam-MCP

Name: Exploit for RedTeam-MCP
Rating: 5 (463 reviews)
2026-02-28 | CVSS 6.0
## https://sploitus.com/exploit?id=ADA6EF86-A6CD-52AE-9878-534FDB535261
# 🔴 RedTeam-MCP

### AI-Powered Autonomous Red Team Framework via Model Context Protocol

[! [License: MIT](https://img.shields.io/badge/License-MIT-red.svg)](LICENSE)
[! [Python 3.10+](https://img.shields.io/badge/Python-3.10+-blue.svg)](https://python.org)
[! [MCP](https://img.shields.io/badge/MCP-Compatible-brightgreen.svg)](https://modelcontextprotocol.io)
[! [Platform](https://img.shields.io/badge/Platform-Windows%20|%20Linux-0078D6.svg)](/)
[! [Tools](https://img.shields.io/badge/Integrated_Tools-15+-orange.svg)](/)
[! [Stars](https://img.shields.io/github/stars/ktol1/RedTeam-MCP?style=social)](https://github.com/ktol1/RedTeam-MCP)

**Let AI autonomously plan attack paths, invoke security tools, move laterally, and escalate domain privileges - like a real pentester.**

[English](#-overview) - [Simplified Chinese](#-overview) - [Quick Start](#-quick-start) - [Tools](#-integrated-tools) - [Architecture](#-architecture)



---





## 📖 Overview

**RedTeam-MCP** is an AI red team automation framework built on the [Model Context Protocol (MCP)](https://modelcontextprotocol.io). It wraps **15+ mainstream offensive security tools** into standardized interfaces that any LLM can invoke directly.

With it, Claude / GPT / any MCP-compatible LLM can.

- 🔍 **Autonomous Asset Discovery** - Scan subnets, fingerprint OS, enumerate ports & services
- 🌐 **Web Fingerprinting** - Detect tech stacks, middleware, CMS versions
- 💥 **Precision Vulnerability Verification** - Template-based CVE/RCE/SQLi detection
- 🏰 **Active Directory Attacks** - Kerberoasting / AS-REP Roasting / DCSync / Delegation
- 🔀 **Lateral Movement** - Pass-the-Hash / WMI exec / SMB relay
- 📊 **Automated Reporting** - AI summarizes all findings into attack chain analysis

> **⚠️ Disclaimer**: This tool is for authorized security testing and educational purposes only. Always obtain proper authorization before testing.

---

## ✨ Key Features





### 🤖 AI-Native Design
- All tools exposed via MCP Tool protocol, directly callable by AI
- Built-in timeout protection, output truncation, error recovery
- Non-interactive execution, no password prompt blocking




### ⚡ Zero-Config Setup
- One-click install script: binaries + Python packages auto-deployed
- No Nmap/Npcap driver dependencies
- **Windows & Linux** natively supported, works out of the box






### 🔧 15+ Integrated Tools
- Go high-performance engines: gogo / fscan / httpx / nuclei / ffuf / dnsx / kerbrute
- Python AD pentest suite: Impacket / NetExec (nxc) / BloodHound
- Built-in native port scanner replacing Nmap




### 🧠 Agent Skill System
- Bundled `.github/skills/redteam/SKILL.md` knowledge base
- Guides AI on correct parameters & best practices per tool
- Progressive recon workflow: Discovery → Fingerprint → Exploit





---

## 🚀 Quick Start

### Prerequisites

| Requirement | Windows | Linux
|------------|---------|-------|
| OS | Windows 10/11 (x64) | Ubuntu 20.04+ / Kali / Debian (x64) |
| Runtime | Python 3.10+ | Python 3.10+ |
| Network | Internet (for tool download) | Internet (for tool download) |

### Step 1: Clone & Install


🪟 Windows

```powershell
git clone https://github.com/ktol1/RedTeam-MCP.git
cd RedTeam-MCP/redteam-server

# Create virtual environment
python -m venv venv
venv\Scripts\activate.bat

# Install dependencies & download all tools
pip install -r requirements.txt
python install_tools.py
``



🐧 Linux

```bash
git clone https://github.com/ktol1/RedTeam-MCP.git
cd RedTeam-MCP/redteam-server

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies & download all tools
pip install -r requirements.txt
python3 install_tools_linux.py

# Make binaries executable
chmod +x ... /redteam-tools/*
```


### Step 2: Add tools to PATH


Windows

Add the `redteam-tools` directory to your system `PATH` environment variable.



🐧 Linux

```bash
# Add to ~/.bashrc or ~/.zshrc
echo 'export PATH="$HOME/RedTeam-MCP/redteam-tools:$PATH"' >> ~/.bashrc
source ~/.bashrc
``


### Step 3: Connect to AI Client


VS Code (Cline / Roo Code)

```json
{
"mcpServers": {
"RedTeam": {
"command": "path/to/venv/Scripts/python.exe",
"args": ["path/to/redteam-server/server.py"]
}
}
}
```
Linux: replace `Scripts/python.exe` with `bin/python3`



Claude Desktop

**Windows**: Edit `%APPDATA%\Claude\claude_desktop_config.json`
**Linux**: Edit `~/.config/claude/claude_desktop_config.json`

``json
{
"mcpServers": {
"RedTeam": {
"commands": "path/to/venv/bin/python3",
"args": ["path/to/redteam-server/server.py"]
}
}
}
``



Cursor IDE

Settings → Features → MCP Servers → Add.
- **Type**: `command`
- **Name**: `RedTeam`
- **Command**: `path/to/venv/bin/python3 path/to/redteam-server/server.py`


### Step 4: Test

``bash
# Start MCP Inspector
mcp dev server.py
```

Then tell your AI: *"Scan the 192.168.1.0/24 network for live Windows hosts and identify open services. "*

---

## 🔧 Integrated Tools

| Category | Tool | Description |
|----------|------|-------------|
| 🔍 Asset Discovery | **[gogo](https://github.com/chainreactors/gogo)** | Ultra-fast port scanning & protocol fingerprinting |
| 🔍 Asset Discovery | **[fscan](https://github.com/shadow1ng/fscan)** | All-in-one intranet scanner (ports, vuln, brute-force) |
| 🌐 Web Recon | **[httpx](https://github.com/projectdiscovery/httpx)** | HTTP probing, tech detection, title extraction |
| 💥 Vuln Scanning | **[nuclei](https://github.com/projectdiscovery/nuclei)** | Template-based vulnerability scanner (CVE/RCE/ SQLi) |
| 📂 Fuzzing | **[ffuf](https://github.com/ffuf/ffuf)** | Web directory & VHost brute-forcer |
| 🌍 DNS | **[dnsx](https://github.com/projectdiscovery/dnsx)** | DNS resolution & subdomain enumeration |
| 🔑 Kerberos | **[kerbrute](https://github.com/ropnop/kerbrute)** | Kerberos user enumeration & password spraying |
| 🏰 AD Attack | **[Impacket](https://github.com/fortra/impacket)** | wmiexec / psexec / secretsdump / getST / ntlmrelayx |
| 🔀 Lateral Movement | **[NetExec (nxc)](https://github.com/Pennyw0rth/NetExec)** | Multi-protocol pentest framework (SMB/WinRM/ LDAP...) || LDAP...)
| 🗺️ AD Mapping | **[BloodHound.py](https://github.com/dirkjanm/BloodHound.py)** | Active Directory privilege path collection |
| 📡 Port Scan | **Built-in** | Native async Python port scanner (no Npcap needed) |

---

## 🏗️ Architecture

``
┌─────────────────────────────────────────────────────────┐
│ AI Agent (LLM) │
│ Claude / GPT / Any MCP Client │
└──────────────────────┬¥──────────────────────────────────┘
│ MCP Protocol (stdio)
▼
┌─────────────────────────────────────────────────────────┐
│ redteam-server/server.py │
│ FastMCP Server │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌───────────┐ │
│ │invoke_ │ │invoke_ │ │invoke_ │ │invoke_ │ │
│ │gogo() │ │fscan() │ │nuclei() │ │dcsync() │ │
│ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ │
│ │ async subprocess + timeout protection │ │
└───────┼─────────────┼───────────┼───────────────┼───────┘
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────┐
│ redteam-tools/ │
│ Windows: gogo.exe fscan.exe httpx.exe nuclei.exe │
│ Linux: gogo fscan httpx nuclei │
│ + impacket-* / nxc / bloodhound-python (pip) │
└─────────────────────────────────────────────────────────┘
``

---

## 🎯 Demo

### Example: Autonomous Network Penetration

```
User: "Scan 10.10.26.0/24, find all Windows hosts, check for vulnerabilities."

AI Agent Execution Plan.
1. gogo -i 10.10.26.0/24 -p win -v -q → Found 4 Windows hosts
2. httpx → Web services on :80, :8080 → Identified IIS, Tomcat
3. nuclei -as -s critical,high → CVE-2024-XXXX confirmed
4. nxc smb ... --shares → Writable share found
5. Report: Complete attack chain documented
``

### Example: Active Directory Attack Chain

``## User: "We have credentials user:pass for corp.
User: "We have credentials user:pass for corp.local. Find a path to Domain Admin."

AI Agent.
1. bloodhound-python -c All → Collected AD graph
2. kerbrute userenum → 47 valid users discovered
3. GetUserSPNs.py (Kerberoast) → 3 SPN hashes captured
4. cracked svc_backup hash → DA privileges via backup operator
5. secretsdump.py -just-dc → Full domain hash dump
``

---

## 📁 Project Structure

``
RedTeam-MCP/
├── 📄 README.md # Bilingual docs (EN + Chinese)
├── 📄 LICENSE # MIT License
├── 📂 assets/ │ ├── 📄 LICENSE # MIT License
│ ├── logo.svg # Project logo
│ └── banner.svg # Project banner
├─ 📂 .github/skills/redteam/
│ └── 📄 SKILL.md # AI Agent knowledge base
├── 📂 redteam-server/ │ ├── .
│ ├── 📄 server.py # MCP Server (all tool wrappers)
│ ├── 📄 install_tools.py # Windows tool installer
│ ├── 📄 install_tools_linux.py # Linux tool installer
│ ├── 📄 requirements.txt # Python dependencies
│ └── 📄 README.md # Server-specific docs
└── 📂 redteam-tools/ # Binary tools (auto-populated)
├── 🪟 *.exe # Windows binaries
└── 🐧 * (no extension) # Linux binaries
```

---

## 🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the Project
2. Create your Feature Branch (`git checkout -b feature/AmazingFeature`)
3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)
4. Push to the Branch (`git push origin feature/AmazingFeature`)
5. Open a Pull Request

---

## 📜 License

Distributed under the MIT License. See [LICENSE](LICENSE) for more information.

---







# 🔴 Simplified Chinese Documentation



## 📖 Overview

**RedTeam-MCP** is a **AI RedTeam automation framework** based on [Model Context Protocol (MCP)](https://modelcontextprotocol.io), which encapsulates 15+ mainstream penetration testing tools into standardized interfaces that can be directly invoked by AI.

Through it, Claude / GPT / any MCP-compatible large model can:

- 🔍 **Autonomous Asset Discovery** - Scan network segments, recognize operating systems, enumerate ports and services
- 🌐 **Web Fingerprinting** - detect technology stacks, middleware, CMS versions
- 💥 **Vulnerability Precision Verification** - template-based CVE/RCE/SQLi detection
- 🏰 **In-Domain Attacks** - Kerberoasting / AS-REP Roasting / DCSync / Delegated Attacks
- 🔀 **Lateral Movement** - Pass-the-Hash / WMI Execution / SMB Relay
- 📊 **Automated Reporting** - AI aggregates all findings and generates attack chain analysis

> **⚠️ DISCLAIMER**: This tool is intended for **authorized security testing** and educational purposes only. Please be sure to obtain legal authorization before use.

---

## ✨ Core Features





### 🤖 AI native design
- All tools are exposed through the MCP Tool protocol and can be called directly by AI.
- Built-in timeout protection, output truncation, and error recovery.
- Completely non-interactive execution, no risk of blocking with password hints.




### ⚡ Zero-Configuration Installation
- One-click install script: binary tool + Python package fully automated deployment
- No Nmap/Npcap driver dependency required.
- Native support for both Windows and Linux** out of the box.






### 🔧 15+ integration tools
- Go high performance engines: gogo / fscan / httpx / nuclei / ffuf / dnsx / kerbrute
- Python domain penetration suite: Impacket full set / NetExec (nxc) / BloodHound
- Built-in native port scanner instead of Nmap




### 🧠 Agent Knowledge Base System
- Comes with `.github/skills/redteam/SKILL.md` Expert Knowledge Base
- Parameters and best practices to guide AI in the proper use of each tool
- Progressive probing workflow: discovery → fingerprinting → vulnerability verification





---

## 🚀 Quick start

### Environmental requirements

|Requirements | Windows | Linux |
|------|---------|-------|
| Operating Systems | Windows 10/11 (x64) | Ubuntu 20.04+ / Kali / Debian (x64) |
| Runtime | Python 3.10+ | Python 3.10+ |
| Network | Requires Internet access (download tool) | Requires Internet access (download tool) |

### The first step: clone and install


🪟 Windows Installation

```powershell
git clone https://github.com/ktol1/RedTeam-MCP.git
cd RedTeam-MCP\redteam-server

# Create the virtual environment
python -m venv venv
venv\Scripts\activate.bat

# Install dependencies and download all tools in one click
pip install -r requirements.txt
python install_tools.py
``



🐧 Linux installation

```bash
git clone https://github.com/ktol1/RedTeam-MCP.git
cd RedTeam-MCP/redteam-server

# Create the virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies and download all tools in one click
pip install -r requirements.txt
python3 install_tools_linux.py

# Give execute permission
chmod +x ... /redteam-tools/*
```


### Step 2: Add the tools to the PATH


🪟 Windows

Add the `redteam-tools` directory to your system's `PATH` environment variable.



🐧 Linux

```bash
echo 'export PATH="$HOME/RedTeam-MCP/redteam-tools:$PATH"' >> ~/.bashrc
source ~/.bashrc
``


### Step 3: Accessing the AI Client


VS Code (via Cline / Roo Code plugin)

Add the following configuration to the MCP Server settings:

```json
{
"mcpServers": {
"RedTeam": {
"command": "Your path/venv/Scripts/python.exe",
"args": ["your path/redteam-server/server.py"]
}
}
}
```
Linux users: replace `Scripts/python.exe` with `bin/python3`



Claude Desktop desktop version

**Windows**: edit `%APPDATA%\Claude\claude_desktop_config.json`
**Linux**: edit `~/.config/claude/claude_desktop_config.json`

``json
{
"mcpServers": {
"RedTeam": {
"command": "Your path/venv/bin/python3",
"args": ["your path/redteam-server/server.py"]
}
}
}
``



Cursor IDE

Settings → Features → MCP Servers → Add:
- **Type**: `command`
- **Name**: `RedTeam`
- **Command**: `your path/venv/bin/python3 your path/redteam-server/server.py`


### Step 4: Test

``bash.
### Start MCP Inspector debug mode
mcp dev server.py
```

Then say to the AI: *"Scanning 192.168.1.0/24 segment, discovering all Windows hosts and identifying open services." *

---

## 🔧 List of Integration Tools

|Category |Tools |Description |
|------|------|------|
| 🔍 Asset Discovery | **[gogo](https://github.com/chainreactors/gogo)** | Extreme Port Scanning & Protocol Fingerprinting |
| 🔍 Asset Discovery | **[fscan](https://github.com/shadow1ng/fscan)** | Comprehensive Intranet Scanner (Port/Vulnerability/Weak Password Blasting)|
| 🌐 Web Reconnaissance | **[httpx](https://github.com/projectdiscovery/httpx)** | HTTP Detection, Tech Stack Fingerprinting, Header Extraction |
| 💥 Vulnerability Scanning | **[nuclei](https://github.com/projectdiscovery/nuclei)** | Template-based Vulnerability Scanner (CVE/RCE/SQLi)|
| 📂 Fuzz Testing | **[ffuf](https://github.com/ffuf/ffuf)** | Web Directory and Virtual Host Blasting |
| 🌍 DNS | **[dnsx](https://github.com/projectdiscovery/dnsx)** | DNS Resolution and Subdomain Enumeration |
| 🔑 Kerberos | **[kerbrute](https://github.com/ropnop/kerbrute)** | Kerberos username enumeration with password spraying |
| 🏰 Domain Attacks | **[Impacket](https://github.com/fortra/impacket)** | wmiexec / psexec / secretsdump / getST / ntlmrelayx |
| 🔀 Lateral Movement | **[NetExec (nxc)](https://github.com/Pennyw0rth/NetExec)** | Multi-Protocol Penetration Framework (SMB/WinRM/LDAP ...) |
| 🗺️ Domain Mapping | **[BloodHound.py](https://github.com/dirkjanm/BloodHound.py)** | Active Directory Privilege Path Collection |
| 📡 Port Scanning | **Built-in** | Native Asynchronous Python Port Scanner (no Npcap required)|

---

## 🎯 Demo.

### Example: Autonomous network penetration

```
User: "Scanning 10.10.26.0/24, found all Windows hosts, checking for vulnerabilities."

AI Agent executes plan:
1. gogo -i 10.10.26.0/24 -p win -v -q → find 4 Windows hosts
2. httpx → :80, :8080 Web services → IIS, Tomcat identified
3. nuclei -as -s critical,high → confirm CVE-2024-XXXX
4. nxc smb ... --shares → discover writable shares
5. report: full attack chain log output
``

### Example: Active Directory attack chain

```
User: "We have corp.local credentials user:pass to find the path to the domain pipe."

AI Agent:
1. bloodhound-python -c All → collect AD graphs
2. kerbrute userenum → found 47 valid users
3. getUserSPNs.py (Kerberoast) → captured 3 SPN hashes
4. crack svc_backup hash → get domain admin rights via backup operator
5. secretsdump.py -just-dc → export domain-wide hash
```

---

## ⭐ Star History

If you find this program useful, please give a Star to support it! ⭐

---



**Built with ❤️ for the Security Community**

**RedTeam-MCP - Where AI Meets Offensive Security **