Darkmoon MCP server

by ASCIT31·io.github.ASCIT31/darkmoon-mcp-server·v0.1.0

No reviews yet

Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.

A85/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A85/100

full report

Adoption

Growing

0 stars48 downloads/wk

Reviews

Write one

Nobody has reviewed Darkmoon yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Darkmoon tools (4, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

get_findings
Return the vulnerabilities and aggregated severity statistics for a Darkmoon campaign (read only). Each finding carries title, severity, CVSS score, category, status (exploited, confirmed or unconfirmed), endpoint and remediation guidance. Findings may contain false positives and require human review.
get_run_statuswrite action
Report whether a Darkmoon run is 'running', 'completed', 'error' or 'unknown' (run log not found), with the event count and the 5 most recent events.
list_campaigns
List the Darkmoon campaigns visible to the dashboard user, with ids and status. Use a campaign id with get_findings.
run_pentestwrite action
Start an autonomous Darkmoon penetration test against one authorized target. The run executes in the background and can take a long time. Returns the run_id; poll it with get_run_status and read results with get_findings once a campaign exists (list_campaigns). Only use against systems the user owns or has explicit written authorization to test. Findings can include false positives and must be rev

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

no findings

Code scan9 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 1 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Darkmoon compares

Against every graded Productivity MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 85/100; higher than 65% of 1,299 Productivity servers
Tools: 4; the typical Productivity server has 7
Tools that change things: 50%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 48; more than 37% of 427 Productivity servers with a package

What its tools let an agent do: 2 read · 1 change · 1 run or deploy

Install Darkmoon in Claude Code, Cursor or VS Code

Runs npx -y @darkmoon_ai/mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add darkmoon-mcp-server -- npx -y @darkmoon_ai/mcp-server

Add to Cursor

What the publisher says

From the Darkmoon repository's README, as published. We do not edit it. Read it on GitHub

@darkmoon_ai/mcp-server

A Model Context Protocol server that lets an MCP client (Claude Desktop, Goose, Continue, LibreChat, ...) drive Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform.

Requires Darkmoon Pro

The Darkmoon engine and CLI are open source. This server talks to the Darkmoon Dashboard API, which is part of Darkmoon Pro and always self-hosted: there is no public hosted endpoint, so you supply the base URL of your own instance. It does not work against the open source CLI alone.

Tools

Only run assessments against systems you own or are explicitly authorized in writing to test. Findings can include false positives and must be reviewed by a qualified human.

Configuration

Client configuration

Claude Desktop (claudedesktopconfig.json), Continue and LibreChat use the same mcpServers shape:

{
  "mcpServers": {
    "darkmoon": {
      "command": "npx",
      "args": ["-y", "@darkmoon_ai/mcp-server"],
      "env": {
        "DARKMOON_BASE_URL": "https://darkmoon.example.internal",
        "DARKMOON_USERNAME": "your-dashboard-user",
        "DARKMOON_PASSWORD": "your-dashboard-password"
      }
    }
  }
}

Goose (~/.config/goose/config.yaml):

extensions:
  darkmoon:
    type: stdio
    enabled: true
    name: darkmoon
    cmd: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    envs:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Continue (.continue/mcpServers/darkmoon.yaml):

name: Darkmoon
version: 0.1.0
schema: v1
mcpServers:
  - name: darkmoon
    command: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    env:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Develop

npm install
npm run build
npm test      # mocked Dashboard API, in-memory MCP client and a real stdio process

License

GPL-3.0-only, same as Darkmoon.

Nothing above is checked by us. What we check is on the safety report.

Darkmoon: common questions

Is Darkmoon MCP server safe?: Yes, by our scan: it is graded A (85/100). Read the Darkmoon safety report
How do I install Darkmoon?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Darkmoon need an API key?: Yes. The registry entry asks for DARKMOON_PASSWORD, DARKMOON_TOKEN.
Is Darkmoon maintained?: The last commit was 22 days ago (2026-10-13). The latest release is v0.1.0.
What can I use instead of Darkmoon?: Servers from other publishers that do the same job: RevoGrid DataGrid MCP Pro MCP server, Omnidim MCP server and Argent MCP server.
How does Darkmoon compare with other Productivity MCP servers?: safety score 85/100 (higher than 65% of 1,299 Productivity servers); tools 4 (the typical Productivity server has 7); tools that change things 50% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Darkmoon

Same job from other publishers: the closest match first, then the best rated.

RevoGrid DataGrid MCP Pro
Hosted Pro MCP server for RevoGrid DataGrid docs, examples, feature checks, and migration guidance.
not reviewed
Established
A
Omnidim
Official MCP server for OmniDimension. Drive voice agents, dispatch calls, and run bulk campaigns.
not reviewed
Growing
A
Argent
Drive iOS Simulators, Android emulators, TVs and Electron/web apps from your coding agent
not reviewed
Widely used
A
gflow-cli
Drive Google Flow from an agent: Veo video and Imagen image generation
not reviewed
Established
A
Buoy Gg
Let AI agents read and drive a running React Native or Flutter app through Buoy's devtools.
not reviewed
Established
A

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: A · 85/100
Stars: 0
Downloads/wk: 48
Price: Free
Licence: GPL-3.0
Transport: Local · npm
Version: 0.1.0
Category: Productivity
Last release: 2026-10-13

Credentials it needs

DARKMOON_BASE_URLBase URL of your self-hosted Darkmoon Pro Dashboard API
DARKMOON_USERNAMEDashboard user
DARKMOON_PASSWORDsecretDashboard password
DARKMOON_TOKENsecretPre-issued JWT, alternative to username/password

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/ascit31-darkmoon-mcp-server.svg)](https://mcp.market/server/ascit31-darkmoon-mcp-server)

How the badge works