Raven Nest MCP server

Raven Nest MCP

A pentesting toolkit that runs as an MCP server, giving AI assistants structured access to industry-standard security tools through a safety-hardened interface.

Authorized use only. Raven Nest is an offensive-security tool intended solely for testing systems you own or have explicit written permission to assess. Unauthorized scanning, enumeration, or exploitation may be illegal. You are solely responsible for obtaining authorization and complying with all applicable laws. The software is provided "as is", without warranty of any kind - see LICENSE.

Demo

Real MCP traffic to the tools - no LLM in the loop, fully deterministic. Targets are the authorized public test hosts example.com / scanme.nmap.org.

Scan → structured finding → report

Recon flow - connectivity, ports, web stack

Metasploit module discovery - requires an MSF-enabled build; the default container image excludes Metasploit

What It Does

Raven Nest wraps 22 security tools plus Metasploit Framework behind an MCP interface with input validation, output quality assessment, session-aware context budgeting, and configurable safety limits. It handles tool execution, restart-safe background scans (completed results survive a server restart; interrupted ones surface as failed), vulnerability finding persistence, target discovery tracking, scan diffing, and multi-format report generation (Markdown, JSON, SARIF, HTML). Findings, reports, and scans are also exposed as MCP resources for browsing. 46 MCP endpoints total.

Supported Tools

How It Fits Together

Raven Nest is an MCP server - it doesn't do anything on its own. An MCP host launches it over stdio and drives the tools. Pick whichever host suits you:

Shortened. The full README is on GitHub.