{
  "markdown": "# Raven Nest MCP\n\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![CI](https://github.com/tidynest/raven-nest-mcp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/tidynest/raven-nest-mcp/actions/workflows/ci.yml)\n[![Release](https://img.shields.io/badge/release-v0.3.0-blue.svg)](https://github.com/tidynest/raven-nest-mcp/releases)\n[![MCP tools: 46](https://img.shields.io/badge/MCP%20tools-46-5A45FF.svg)](https://github.com/tidynest/raven-nest-mcp)\n[![MCP](https://img.shields.io/badge/Model%20Context%20Protocol-server-1f6feb.svg)](https://modelcontextprotocol.io)\n[![Canopii Trust Score](https://index.canopii.dev/api/badge/io.github.tidynest/raven-nest-mcp)](https://index.canopii.dev/server/io.github.tidynest/raven-nest-mcp)\n\nA pentesting toolkit that runs as an [MCP](https://modelcontextprotocol.io/) server, giving AI assistants structured access to industry-standard security tools through a safety-hardened interface.\n\n> **Authorized use only.** Raven Nest is an offensive-security tool intended solely for testing systems you own or have explicit written permission to assess. Unauthorized scanning, enumeration, or exploitation may be illegal. You are solely responsible for obtaining authorization and complying with all applicable laws. The software is provided \"as is\", without warranty of any kind - see [LICENSE](LICENSE).\n\n## Demo\n\nReal MCP traffic to the tools - no LLM in the loop, fully deterministic. Targets are the authorized public test hosts `example.com` / `scanme.nmap.org`.\n\n**Scan → structured finding → report**\n\n![Scan to structured finding to report](docs/assets/report.gif)\n\n**Recon flow - connectivity, ports, web stack**\n\n![Recon flow: ping, nmap, whatweb](docs/assets/recon.gif)\n\n**Metasploit module discovery** - *requires an MSF-enabled build; the default container image excludes Metasploit*\n\n![Metasploit search and module info](docs/assets/metasploit.gif)\n\n## What It Does\n\nRaven Nest wraps 22 security tools plus Metasploit Framework behind an MCP interface with input validation, output quality assessment, session-aware context budgeting, and configurable safety limits. It handles tool execution, restart-safe background scans (completed results survive a server restart; interrupted ones surface as failed), vulnerability finding persistence, target discovery tracking, scan diffing, and multi-format report generation (Markdown, JSON, SARIF, HTML). Findings, reports, and scans are also exposed as MCP resources for browsing. 46 MCP endpoints total.\n\n### Supported Tools\n\n| Category | Tools |\n|----------|-------|\n| Recon | nmap, masscan, whatweb, httpx, subfinder, dnsx, dnsrecon |\n| Crawling | katana |\n| SMB/AD | enum4linux-ng |\n| Credentialed enum (gated) | netexec |\n| Vulnerability | nuclei, nikto, wpscan, dalfox (XSS) |\n| Web fuzzing | feroxbuster, ffuf |\n| Exploitation | sqlmap, hydra |\n| Password cracking | john |\n| Secret scanning | gitleaks, trufflehog |\n| TLS/SSL | testssl.sh |\n| Metasploit | msf\\_search, msf\\_module\\_info, msf\\_exploit, msf\\_auxiliary, msf\\_sessions, msf\\_post |\n| Utility | ping\\_target, http\\_request |\n| Scan management | launch\\_scan, get\\_scan\\_status, get\\_scan\\_results, list\\_scans, cancel\\_scan |\n| Findings | save\\_finding, get\\_finding, list\\_findings, list\\_findings\\_by\\_scan, delete\\_finding, generate\\_report |\n| Engagement | set\\_engagement, list\\_engagements |\n| Discovery tracking | get\\_target\\_info, list\\_targets, diff\\_scans |\n\n## How It Fits Together\n\nRaven Nest is an MCP **server** - it doesn't do anything on its own. An MCP\n**host** launches it over stdio and drives the tools. Pick whichever host suits you:\n\n- **Any MCP host (recommended)** - point Claude Desktop, Cursor, or any MCP client\n  at the Docker image below; the host spawns the server for you.\n- **Companion REPL** - [`raven-nest-client`](https://github.com/tidynest/raven-nest-client)\n  is a TypeScript terminal client (tab-completion, scan/finding/report commands,\n  engagement scoping) for driving Raven Nest by hand. It can launch either a local\n  `raven-server` build or the Docker image.\n\nThe server is the same stdio binary in both cases.\n\n## Quick Start\n\n### Run with Docker (recommended)\n\nThe published image bundles `raven-server` **and all 22 wrapped tools** on a Kali\nbase, so you don't have to install them yourself. Point your MCP client at it\n(stdio):\n\n```json\n{\n  \"mcpServers\": {\n    \"raven-nest\": {\n      \"command\": \"docker\",\n      \"args\": [\"run\", \"--rm\", \"-i\", \"ghcr.io/tidynest/raven-nest-mcp:latest\"]\n    }\n  }\n}\n```\n\n`masscan` and `nmap -O` need raw sockets - append `--cap-add=NET_RAW` and\n`--cap-add=NET_ADMIN` to `args` if you use them (the container runs as a\ndedicated non-root user; the runtime grants those capabilities to the container\nprocess directly, so they keep working without root). The server is also listed\non the [MCP Registry](https://registry.modelcontextprotocol.io) as\n`io.github.tidynest/raven-nest-mcp`.\n\n### Prerequisites\n\n- Rust 1.93+ (2024 edition)\n- One or more external tools installed (nmap, nuclei, nikto, etc.)\n\n### Build\n\n```bash\ncargo build --release\n```\n\n### Configure your MCP client\n\nCreate `.mcp.json` in your project root (or configure your MCP client directly):\n\n```json\n{\n  \"mcpServers\": {\n    \"raven-nest\": {\n      \"command\": \"/path/to/raven-server\",\n      \"args\": []\n    }\n  }\n}\n```\n\nThe server communicates over stdio and requires no network ports.\n\n### Configuration\n\nRaven Nest loads configuration from TOML, resolved in order:\n\n1. `RAVEN_CONFIG` environment variable (path to file)\n2. `config/default.toml` next to the binary\n3. `config/default.toml` in the working directory\n4. Built-in defaults\n\nKey configuration sections:\n\n```toml\n[safety]\nallowed_tools = [\"nmap\", \"nuclei\", \"nikto\", \"whatweb\", \"masscan\", \". . .\"] \ncontext_budget = 65536          # Model context window in chars (0 = disabled)\nexpected_tool_calls = 10        # Anticipated calls per session\nsudo_tools = [\"masscan\", \"nmap\"] # Tools invoked via passwordless sudo\n# auto_save_findings = false     # opt-in: auto-extract findings from scanners\n\n[execution]\ndefault_timeout_secs = 600\nmax_concurrent_scans = 3\noutput_dir = \"/tmp/raven-nest\"\n\n# [scope]                        # engagement authorization allowlist (deny-wins)\n# enabled = true\n# allowed_domains = [\"example.com\"]\n\n# [network]\n# http_proxy = \"http://127.0.0.1:8080\"\n\n# [metasploit]\n# enabled = true\n# host = \"127.0.0.1\"\n# port = 55553\n# password = \"changeme\"\n\n# [netexec]                      # gated, read-only credentialed enumeration\n# enabled = true\n```\n\nSee [docs/USAGE.md](docs/USAGE.md) for the full parameter reference and per-tool configuration options.\n\n## Safety Architecture\n\nEvery tool call passes through six layers:\n\n1. **Allowlist** -- only explicitly permitted tools can execute\n2. **Input validation** -- targets must be valid IPs, hostnames, CIDRs, or URLs; shell metacharacters are rejected\n3. **Preset arguments** -- users pick scan types, never raw CLI flags\n4. **Execution containment** -- configurable timeouts with `kill_on_drop`\n5. **Output sanitisation** -- ANSI stripping, truncation at configurable limits (UTF-8 safe)\n6. **Quality assessment** -- detects empty results, rate-limiting, and WAF blocks\n\nAdditional hardening:\n\n- **Config validation at startup** -- safety limits (sqlmap level/risk, hydra tasks, masscan rate) are range-checked; the server refuses to start with out-of-range values or default MSF credentials\n- **Wordlist path validation** -- hydra, john, feroxbuster, and ffuf only accept wordlists under `/usr/share/`, `/usr/lib/`, or the configured `output_dir`; path traversal (`..`) is rejected\n- **Positional-argument guards** -- free-text values passed to tools as positional arguments are charset-checked so they can't be re-parsed as flags: hydra `service` (lowercase/digits/hyphens) and `form_params` (no leading `-`, no control chars), sqlmap `technique` (subset of `BEUSTQ`), ffuf `filter_size` (digits/commas). Targets get the same treatment (`-oN/tmp/evil` is rejected as flag-like)\n- **Port spec validation** -- nmap and masscan port parameters accept only digits, commas, and hyphens\n- **File permissions** -- cookie files and scan spill files are created with `0o600` (owner-only)\n- **Markdown escaping** -- report generation escapes user-supplied finding fields to prevent markdown injection\n- **Finding ID validation** -- finding get/delete operations require valid UUID format, preventing path traversal\n- **Engagement scope** -- an optional authorization allowlist (`[scope]`): when enabled, every target must match an allowed CIDR/domain and must not match a denied one (deny wins); loopback is allowed unless disabled. `http_request` re-validates each redirect hop against the scope, so a redirect cannot escape it. Off by default\n- **Audit logging** -- every tool execution is appended to `{output_dir}/audit.log` with the tool, target, and redacted arguments\n- **Proactive cooldown** -- an optional `min_exec_gap_ms` spaces out consecutive tool launches so back-to-back aggressive tools don't trip a target's WAF or rate-limiter, and `per_target_min_gap_ms` does the same per host while independent targets proceed in parallel; complements the reactive WAF/rate-limit detection. Both off by default\n\nMetasploit integration adds a 5-layer safety model: disabled by default, per-tool allowlisting, path-boundary module blocklist, exploit confirmation gate (double-call to execute), and session command filtering. Passwords are redacted from error messages, and TLS certificate bypass is restricted to localhost connections. See [docs/METASPLOIT.md](docs/METASPLOIT.md).\n\nTools requiring root (masscan, nmap OS detection) can be run via passwordless `sudo` without elevating the entire server. See `sudo_tools` in the [configuration docs](docs/USAGE.md#sudo_tools--privilege-escalation).\n\n## Context Budget\n\nA session-aware **context budget tracker** dynamically adjusts per-tool output caps based on remaining context window space. This prevents context overflow on local AI models with limited context windows (49-64K tokens).\n\n- **Full mode** -- all findings, all details, up to 8K chars per tool call\n- **Compact mode** -- top-N results, critical/high findings only (triggers at 40% consumed)\n- **Minimal mode** -- one-line summaries (triggers at 70% consumed)\n\nParser result caps scale dynamically via `scale_cap()` -- each tool's output parser adjusts its result limit based on the active budget mode. All tool output passes through centralised ANSI stripping and budget-aware truncation in `wrap_result()`.\n\nWhen the budget is exhausted, the server returns a message directing the AI to save findings and generate a report rather than running additional scans.\n\n## Target Discovery Tracking and Scan Diffing\n\nEvery nmap result (`run_nmap` and background nmap scans) accumulates into a\nper-host discovery record: ports, states, services, versions, and OS guesses,\nwith first/last-seen timestamps. Re-scanning merges rather than overwrites, so\nthe record shows how the target evolved.\n\n- **`list_targets` / `get_target_info`** recall the tracked hosts and full\n  per-host service tables without re-scanning.\n- **`diff_scans`** compares two completed nmap scans: added/removed hosts and\n  ports, plus per-port state/service/version changes (`open (ssh OpenSSH 8.9) →\n  open (ssh OpenSSH 9.0)`).\n- Discovery data is engagement-scoped like findings (`{engagement}/targets/`)\n  and persists across restarts.\n\n`run_nmap` and `run_nuclei` also attach machine-readable `structured_content`\nto their responses (hosts/ports/CVEs; findings list), uncapped by the context\nbudget, so clients can process results without parsing prose.\n\n## Report Generation\n\nThe `generate_report` endpoint produces a structured report -- Markdown by default, or JSON, SARIF, or HTML via the `format` parameter -- containing:\n\n- **Table of Contents** with linked findings\n- **Executive Summary** with severity breakdown table and overall risk rating\n- **Methodology** section (PTES framework)\n- **Tools Used** (deduplicated from findings)\n- **Scope & Timeline** -- targets assessed and the engagement window, derived from the findings\n- **Numbered Findings** with severity, target, tool, CVSS score, CVE identifier, OWASP Top 10 category, evidence, and remediation guidance\n\nThe Markdown and HTML formats render the full narrative (table of contents, methodology, scope, generation timestamp); JSON and SARIF are structured envelopes for tooling. Findings support an `owasp_category` field for mapping vulnerabilities to the OWASP Top 10 (e.g. \"A03:2021 Injection\").\n\n## MCP Resources\n\nBeyond tools, the server exposes its data as read-only [MCP resources](https://modelcontextprotocol.io/docs/concepts/resources) under the `raven://` scheme, so a client can browse or attach them without a tool call:\n\n- `raven://findings` -- JSON index of every saved finding\n- `raven://findings/{id}` -- a single finding as JSON\n- `raven://reports/{markdown|json|sarif|html}` -- a report rendered on demand\n- `raven://scans` -- JSON index of background scans\n- `raven://scans/{id}` -- a scan's captured output\n\nEach saved finding and tracked scan is also listed individually, so they show up as browsable entries in resource-aware clients.\n\n## Output Parsers\n\nEvery security tool has a structured output parser that extracts key data from raw tool output:\n\n- **nmap** -- XML parser with NSE script extraction (vulners CVEs by CVSS)\n- **nuclei** -- JSONL parser with severity filtering\n- **nikto/feroxbuster/ffuf/masscan** -- line-oriented parsers with configurable result caps\n- **sqlmap** -- injection type and parameter extraction\n- **testssl** -- vulnerability and certificate finding extraction\n- **hydra/whatweb** -- credential and technology identification\n- **subfinder/dnsrecon/dnsx** -- subdomain and DNS record extraction\n- **httpx/katana** -- HTTP fingerprint and crawled-endpoint extraction\n- **dalfox/wpscan/enum4linux-ng/john** -- structured finding extraction\n- **netexec** -- authentication verdict and per-host enumeration extraction\n\nAll parsers return `Option<String>` and fall back to raw output when parsing fails. Result limits scale dynamically based on the active budget mode.\n\n## Authenticated Scanning\n\nThe `http_request` tool maintains a shared cookie jar that persists within a session and across context clears (saved to disk). External subprocess tools (sqlmap, nikto, feroxbuster, etc.) do not share this jar -- pass cookies via each tool's `cookie` parameter.\n\n## Testing\n\n381 unit and integration tests across 3 crates:\n\n```bash\ncargo test --workspace\n```\n\n| Crate | Tests |\n|-------|-------|\n| raven-core | 106 |\n| raven-report | 71 |\n| raven-server | 191 |\n| Integration | 13 |\n\nA Python-based MCP integration test harness is also available:\n\n```bash\npython3 -u tests/manual_test_harness.py all     # full suite\npython3 -u tests/manual_test_harness.py phase0   # single phase\n```\n\n## Project Structure\n\n```\ncrates/\n  raven-core/     # Safety validation, subprocess execution, config (TOML),\n                  # scan manager (background scans with disk spill), audit log\n  raven-report/   # Finding types (with OWASP categories), file-per-finding\n                  # persistence, host/service discovery store (targets),\n                  # multi-format report generators (md/json/sarif/html)\n  raven-server/   # MCP server (rmcp), tool handlers (one module per tool),\n                  # context budget tracker, output parsers, progress ticker,\n                  # structured scan results, scan diffing\nconfig/\n  default.toml    # Default configuration\n  sudoers-raven-nest  # Sudoers drop-in for privilege escalation\ntests/\n  manual_test_harness.py  # MCP integration test harness\n```\n\n## Documentation\n\n- [docs/USAGE.md](docs/USAGE.md) -- tool installation, configuration reference, full parameter docs\n- [docs/MCP_TOOLS.md](docs/MCP_TOOLS.md) -- machine-readable manifest of all 46 tools (name + description)\n- [docs/LOCAL_AI_INTEGRATION.md](docs/LOCAL_AI_INTEGRATION.md) -- using Raven Nest with local models (Ollama, LM Studio)\n- [docs/METASPLOIT.md](docs/METASPLOIT.md) -- Metasploit Framework integration setup and safety model\n- [docs/DATA_FLOW.md](docs/DATA_FLOW.md) -- data flow and sources of truth: which module owns each piece of state\n- [raven-nest-client](https://github.com/tidynest/raven-nest-client) -- companion TypeScript REPL client (versioned in lockstep with the server)\n- [CHANGELOG.md](CHANGELOG.md) -- release history (current: v0.3.0)\n\n## License\n\n[Apache-2.0](LICENSE)\n",
  "bytes": 16635,
  "sha": "a1f276a0a1d479aaa07bc3656c371377dcdb3c378c63e5f4abac8613d205dd8f",
  "repo_slug": "tidynest/raven-nest-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_tidynest_raven_nest_mcp_d5d7d153/readme"
}