MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT

What is MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT?

An MCP server (Project Astro V2) that acts as an intelligence layer for LLM-driven penetration testing. It provides 38 Kali Linux tool wrappers, engagement tracking, scope enforcement, and structured output for any MCP-compatible client. This is a devkit intended only for use against targets you own or have explicit authorization to test.

How to use MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT?

Run docker compose up --build to start the server on http://localhost:8080 with streamable-HTTP transport. For local installation, create a virtual environment, run pip install ".[dev,reporting]", then start with astro serve --port 8080. Connect any MCP client via HTTP or stdio. Optionally set a scope YAML file to restrict targets using --scope config/scope.yaml.

Key features of MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT

• 38 Kali tool wrappers (recon, exploitation, post-exploitation, tunneling)
• CIDR + domain scope enforcement via YAML config
• SQLite-backed engagement tracking with finding recording
• Structured output parsers for nmap, sqlmap, wpscan, nuclei, etc.
• Multiple transports: streamable-http, stdio
• Native Ollama and OpenAI-compatible LLM bridges
• Terminal UI with live tool output and methodology tracking
• Reporting exports: SARIF, HTML, Obsidian vault

Use cases of MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT

• Automated penetration testing orchestrated by an LLM
• Authorized security assessments with scope enforcement and findings logging
• CTF labs and training environments with pre-configured lab targets
• Integration with Claude Desktop or any MCP client for conversational security testing

FAQ from MCP Server for Breaking Shyet - Diclaimer - This is a DEVKIT

What is this server?

It’s a devkit MCP server that wraps 38 Kali Linux tools and provides a structured interface for LLM-driven penetration testing. It replaces an earlier Flask-based V1 with a single FastMCP server.

Do I need to install Kali tools separately?

If using the Docker image, all 38 tools are pre-installed. For local installation, the underlying tools must be available on the host.

How does scope enforcement work?

You supply a YAML file with allowed CIDRs, domains, and optional tool restrictions. Every tool call validates its target against this scope; out‑of‑scope targets are rejected.

Where are findings stored?

Findings are persisted in a SQLite database at ~/.astro/engagements.db by default.

Is authentication supported?

Yes. The server supports API key authentication (via the API_KEY environment variable) and OIDC authentication.