Agent skill · security · aradotso
pentester-mcp-security-tools
MCP server integrating 200+ penetration testing tools (nmap, sqlmap, ffuf, etc.) via Docker sandbox for AI-driven security testing
Why this skill is useful
Adds a Docker-based MCP server that integrates 200+ penetration testing tools, enabling AI-driven security testing capabilities.
What it needs
Requires docker installed locally. About 5k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Pentester-MCP Security Tools Skill by ara.so — Security Skills collection. Pentester-MCP provides Model Context Protocol (MCP) integration for 200+ open-source penetration testing and cybersecurity tools. It enables AI assistants (Claude Desktop, Cursor, etc.) to autonomously execute security tools like nmap, sqlmap, ffuf, gobuster, nuclei, impacket, and hundreds more within a secure Docker sandbox. Each tool is wrapped as an MCP server with AI-optimized documentation, safe argument handling, timeout enforcement, and output truncation to prevent shell injection and system pollution. Installation Docker Sandbox (Recommended) The Docker approach isolates all 200+ tools in a container, avoiding host system pollution: Local Execution (Advanced) For Kali Linux, Parrot OS, or systems with tools pre-installed: Configuration Tool Selection Edit configs/example-config.yaml to enable/disable tools: MCP Client Configuration Claude Desktop Add to claudedesktopconfig.json: Cursor Add to Cursor's MCP settings: Local Execution Configuration For host-based execution, modify the configuration: Tool Categories & Examples Reconnaissance Nmap - Network scanning and port enumeration: Usage via AI: "Scan 192.168.1.1 with nmap using default scripts" "Run aggressive nmap scan on target.com" Web Exploitation SQLMap - Automated SQL injection testing: FFUF - Web fuzzing: Active Directory & Network Impacket Suite - AD exploitation tools: Password Cracking Hydra - Brute force authentication: Common Patterns AI-Driven Recon Workflow When an AI assistant has Pentester-MCP configured, it can autonomously chain tools: 1. Initial Scan: "Scan example.com for open ports" AI executes: nmap -sV -sC example.com 2. Web Discovery: AI detects port 80/443 open Auto-executes: ffuf -u https://example.com/FUZZ -w /wordlists/common.txt 3. Vulnerability Testing: AI finds /admin directory Auto-executes: sqlmap -u https://example.com/admin?id=1 --batch Environment Variables for Credentials Never hardcode secrets. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/pentester-mcp-security-tools