Metasploit MCP: AI-Assisted Exploitation via Claude

Metasploit has always rewarded knowing its console cold – modules, options, payloads, all typed out by hand or scripted with msfrpc. Metasploit MCP, one of the more interesting additions in the Kali Linux 2026 release cycle, takes a different approach: it exposes Metasploit’s RPC interface as an MCP server, which means Claude (or any other MCP-aware agent) can drive a Metasploit engagement conversationally instead of you writing the console commands yourself.

What Metasploit MCP actually does

MCP – the Model Context Protocol – is the same open standard that lets Claude Desktop and Claude Code connect to tools like GitHub, databases, or a browser. Metasploit MCP wraps msfrpcd’s API as a set of MCP tools: search for modules, set options, run exploits, list active sessions, interact with a session’s shell. Once it’s connected, you’re no longer memorising module paths – you’re describing what you want to do and letting the agent look up and configure the right module.

Setting it up

The server sits between Metasploit’s RPC daemon and your MCP client:

# start Metasploit's RPC daemon
msfrpcd -P yourpassword -S -a 127.0.0.1 -p 55553

# run the Metasploit MCP server, pointing it at msfrpcd
pip install metasploit-mcp
metasploit-mcp --host 127.0.0.1 --port 55553 --password yourpassword

Then add it as an MCP server in Claude Code or Claude Desktop’s config, the same way you’d add any other MCP connector, and it appears as a set of callable tools in your next session.

What a session actually looks like

Instead of typing search type:exploit platform:windows smb and cross-referencing CVEs by hand, you can ask the agent directly – “find exploits for this SMB service version and set one up against my test VM” – and it searches modules, checks required options, and proposes a configuration for you to confirm before firing anything. That confirmation step matters: a well-built Metasploit MCP setup should surface exactly which module and options it’s about to run, not execute exploits silently, the same “show me the command before you run it” discipline that makes any agent tool safe to point at something as consequential as an exploitation framework.

• Module search and selection by natural-language description rather than exact module paths
• Automatic option configuration (RHOSTS, LHOST, payload) with confirmation before execution
• Session listing and interaction once a target is compromised
• Report drafting from session history, since the agent already has the full narrative of what it tried and what worked

How this differs from the AI pentest tools already covered here

This site has already covered standalone AI-assisted offensive tools like hexstrike, PentestGPT, and pentest-ai – each of those bundles its own LLM integration into a single application. Metasploit MCP is narrower and more composable: it doesn’t bring its own model or reasoning layer at all, it just exposes Metasploit’s existing capabilities to whatever agent you’re already using. That means it inherits your agent’s model choice, your existing MCP tool set, and your existing session history rather than being a separate silo.

The obvious caution

Handing an exploitation framework’s controls to an LLM raises the stakes on getting authorisation and scope right before you start – a misread instruction that fires an exploit at the wrong host is a much bigger problem here than a bad suggestion from a coding agent. Run it only in a lab, only against systems you own or have explicit written authorisation to test, and keep the confirm-before-execute setting on rather than letting the agent auto-run modules unattended. Used carefully, though, it’s a genuinely useful way to spend less time on module lookup and more time interpreting results – the same trade every agent tool on this blog is ultimately making.