yindo/pentestagent
1
0
Fork 0
mirror of https://github.com/GH05TCREW/pentestagent.git synced 2026-07-25 02:35:23 -04:00
Code Issues 7 Packages Projects Releases Wiki Activity

[PR #17] [MERGED] MCP: Add Metasploit integration, HexStrike parity, auto-start flags and SSETransport improvements #21

New Issue
Closed
opened 2026-02-27 13:59:23 -05:00 by yindo · 0 comments
yindo commented 2026-02-27 13:59:23 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/GH05TCREW/pentestagent/pull/17
Author: @giveen
Created: 1/14/2026
Status: ✅ Merged
Merged: 1/14/2026
Merged by: @GH05TCREW

Base: main ← Head: hexstrike-ai-integration

📝 Commits (10+)

  • 48cd4f2 WIP: prepare for hexstrike subtree
  • 9361172 Squashed 'third_party/hexstrike/' content from commit 3326704
  • 734f1d3 Merge commit '93611722c0501d8e1794849bdc4329911284b75a' as 'third_party/hexstrike'
  • a3822e2 docs: add HexStrike credit and note TUI fixes
  • 704b505 ui: open interactive ToolsScreen on /tools; fallback to list if push fails
  • 57a0e6e chore: add PowerShell installer for vendored HexStrike deps; call from setup.ps1
  • 97df933 mcp: add MetasploitMCP adapter, installer, and config; add LAUNCH_METASPLOIT_MCP env var
  • abaaca1 setup: add MetasploitMCP env flag and auto-install step
  • 8415d9f scripts: vendor/install MetasploitMCP during setup (setup.sh, setup.ps1)
  • 19bdff8 mcp: launch MetasploitMCP in stdio transport for manager compatibility

📊 Changes

31 files changed (+25455 additions, -59 deletions)

View changed files

📝 .env.example (+66 -1)
📝 README.md (+11 -0)
📝 pentestagent/interface/main.py (+24 -0)
📝 pentestagent/interface/tui.py (+168 -48)
➕ pentestagent/mcp/hexstrike_adapter.py (+244 -0)
📝 pentestagent/mcp/manager.py (+306 -4)
📝 pentestagent/mcp/mcp_servers.json (+27 -1)
➕ pentestagent/mcp/metasploit_adapter.py (+341 -0)
📝 pentestagent/mcp/transport.py (+210 -5)
📝 pyproject.toml (+14 -0)
➕ pyrightconfig.json (+4 -0)
➕ requirements-hexstrike.txt (+3 -0)
➕ scripts/add_hexstrike_subtree.sh (+32 -0)
➕ scripts/add_metasploit_subtree.sh (+84 -0)
➕ scripts/install_hexstrike_deps.ps1 (+45 -0)
➕ scripts/install_hexstrike_deps.sh (+42 -0)
➕ scripts/install_metasploit_deps.sh (+40 -0)
📝 scripts/setup.ps1 (+100 -0)
📝 scripts/setup.sh (+79 -0)
➕ third_party/hexstrike/README.md (+757 -0)

...and 11 more files

📄 Description

MCP: Add Metasploit integration, HexStrike parity, auto-start flags and SSETransport improvements

Summary

This PR adds a vendored Metasploit MCP integration and brings it to parity with the existing HexStrike MCP integration. It also improves the MCP transport layer (SSE) to reliably handle HTTP/SSE MCP servers that return 202/async responses.

Key changes

  • Add Metasploit MCP support via a MetasploitAdapter that can start/stop the vendored MetasploitMCP server and optionally start msfrpcd for local testing.
  • Make MCP tool registration automatic: MCP tools are discovered and registered at startup so they appear in the TUI /tools view.
  • Add environment flags to control vendored servers and subtree updates:
    • LAUNCH_HEXTRIKE / LAUNCH_HEXSTRIKE — control HexStrike vendored server auto-start behavior
    • LAUNCH_METASPLOIT_MCP — control Metasploit vendored server auto-start behavior
    • FORCE_SUBTREE_PULL — helper for scripts that add/update vendored third_party subtrees
  • Improve HTTP/SSE transport (SSETransport) to:
    • Discover the server's POST endpoint announced over /sse
    • Maintain a persistent SSE listener instead of transient GETs
    • Correlate pending requests with SSE-delivered responses (supporting 202 Accepted flows)
    • Wait for endpoint discovery on connect to avoid writer races
  • Add/update helper scripts (scripts/add_metasploit_subtree.sh, scripts/setup.sh) to vendor/update the Metasploit subtree and provide optional msfrpcd auto-start during setup.

Files touched (high level)

  • pentestagent/mcp/metasploit_adapter.py — new adapter to manage vendored Metasploit MCP and optional msfrpcd.
  • pentestagent/mcp/transport.py — SSETransport enhancements and robustness fixes.
  • pentestagent/mcp/manager.py — LAUNCH env handling, auto-start wiring and connection logic (fixes applied so LAUNCH_* works as expected).
  • pentestagent/mcp/mcp_servers.json — added/updated metasploit-local entry in HexStrike-style (--server http://...).
  • .env.example — grouped MCP settings; documents FORCE_SUBTREE_PULL and LAUNCH flags.
  • scripts/add_metasploit_subtree.sh, scripts/setup.sh — vendoring helpers and optional msfrpcd startup.

(See the full commit set on this branch for exact diffs and additional smaller edits.)

Behavior / Usage

  • Default: vendored MCP entries are present in pentestagent/mcp/mcp_servers.json but not started unless configured.
  • To allow PentestAgent to auto-start vendored MCPs at runtime, set the corresponding LAUNCH_* environment variable to a truthy value (e.g. true, 1, yes):

```bash
export LAUNCH_METASPLOIT_MCP=true
export LAUNCH_HEXTRIKE=true
pentestagent
```

When LAUNCH_METASPLOIT_MCP is truthy and the manager is started, the manager will attempt to auto-start the vendored Metasploit adapter and connect to it so its tools are registered automatically.

If you prefer to run the vendored MCP server manually (recommended for debugging), start it separately and then run PentestAgent/TUI. Example:

```bash
python third_party/MetasploitMCP/MetasploitMCP.py --server http://127.0.0.1:7777 \

loot/artifacts/metasploit_mcp.log 2>&1 & disown
pentestagent mcp test metasploit-local
```

How to test

  1. Pull this branch and install dependencies (see scripts/setup.sh).

  2. Manual test:

    • Start msfrpcd (or configure MSF_* envs to point to an existing Metasploit RPC)

    • Start the vendored MCP server:

      ```bash
      python third_party/MetasploitMCP/MetasploitMCP.py --server http://127.0.0.1:7777
      ```

    • Run the manager test:

      ```bash
      pentestagent mcp test metasploit-local
      ```

    • Expected: + Connected successfully! and a list of available Metasploit tools.

  3. Auto-start test:

    • Export LAUNCH_METASPLOIT_MCP=true and run pentestagent (or the TUI). The manager should auto-start the adapter and register tools so they appear in /tools.

Security / Notes

  • Do not commit real passwords or API keys. Use a local .env (never committed) to provide secrets like MSF_PASSWORD.
  • The setup helper that may start msfrpcd will never invoke sudo — it only starts a local msfrpcd process if credentials are present and auto-start is enabled.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/GH05TCREW/pentestagent/pull/17 **Author:** [@giveen](https://github.com/giveen) **Created:** 1/14/2026 **Status:** ✅ Merged **Merged:** 1/14/2026 **Merged by:** [@GH05TCREW](https://github.com/GH05TCREW) **Base:** `main` ← **Head:** `hexstrike-ai-integration` --- ### 📝 Commits (10+) - [`48cd4f2`](https://github.com/GH05TCREW/pentestagent/commit/48cd4f2a9adbcbf64c849c62b3ba922136e9f1eb) WIP: prepare for hexstrike subtree - [`9361172`](https://github.com/GH05TCREW/pentestagent/commit/93611722c0501d8e1794849bdc4329911284b75a) Squashed 'third_party/hexstrike/' content from commit 3326704 - [`734f1d3`](https://github.com/GH05TCREW/pentestagent/commit/734f1d3bdb588760c47beca50b8a0a9fdb7b9c6b) Merge commit '93611722c0501d8e1794849bdc4329911284b75a' as 'third_party/hexstrike' - [`a3822e2`](https://github.com/GH05TCREW/pentestagent/commit/a3822e2cb8606c9d0bcb7530240c946fb47c86a2) docs: add HexStrike credit and note TUI fixes - [`704b505`](https://github.com/GH05TCREW/pentestagent/commit/704b5056ea650ee821f139f4cb9cf1d308697d4a) ui: open interactive ToolsScreen on /tools; fallback to list if push fails - [`57a0e6e`](https://github.com/GH05TCREW/pentestagent/commit/57a0e6e7c805fcfd306a8e7c74dd90e883e5a88a) chore: add PowerShell installer for vendored HexStrike deps; call from setup.ps1 - [`97df933`](https://github.com/GH05TCREW/pentestagent/commit/97df933f42828ab1f6c8db1d2d89b9053d01211e) mcp: add MetasploitMCP adapter, installer, and config; add LAUNCH_METASPLOIT_MCP env var - [`abaaca1`](https://github.com/GH05TCREW/pentestagent/commit/abaaca184e82ab5933fc9512d0fb0b55994132b4) setup: add MetasploitMCP env flag and auto-install step - [`8415d9f`](https://github.com/GH05TCREW/pentestagent/commit/8415d9fcbdb60aca8d6a8d5c94086fa6cce65731) scripts: vendor/install MetasploitMCP during setup (setup.sh, setup.ps1) - [`19bdff8`](https://github.com/GH05TCREW/pentestagent/commit/19bdff87b96164f43ef45dbad648504f338d3abf) mcp: launch MetasploitMCP in stdio transport for manager compatibility ### 📊 Changes **31 files changed** (+25455 additions, -59 deletions) <details> <summary>View changed files</summary> 📝 `.env.example` (+66 -1) 📝 `README.md` (+11 -0) 📝 `pentestagent/interface/main.py` (+24 -0) 📝 `pentestagent/interface/tui.py` (+168 -48) ➕ `pentestagent/mcp/hexstrike_adapter.py` (+244 -0) 📝 `pentestagent/mcp/manager.py` (+306 -4) 📝 `pentestagent/mcp/mcp_servers.json` (+27 -1) ➕ `pentestagent/mcp/metasploit_adapter.py` (+341 -0) 📝 `pentestagent/mcp/transport.py` (+210 -5) 📝 `pyproject.toml` (+14 -0) ➕ `pyrightconfig.json` (+4 -0) ➕ `requirements-hexstrike.txt` (+3 -0) ➕ `scripts/add_hexstrike_subtree.sh` (+32 -0) ➕ `scripts/add_metasploit_subtree.sh` (+84 -0) ➕ `scripts/install_hexstrike_deps.ps1` (+45 -0) ➕ `scripts/install_hexstrike_deps.sh` (+42 -0) ➕ `scripts/install_metasploit_deps.sh` (+40 -0) 📝 `scripts/setup.ps1` (+100 -0) 📝 `scripts/setup.sh` (+79 -0) ➕ `third_party/hexstrike/README.md` (+757 -0) _...and 11 more files_ </details> ### 📄 Description # MCP: Add Metasploit integration, HexStrike parity, auto-start flags and SSETransport improvements ## Summary This PR adds a vendored Metasploit MCP integration and brings it to parity with the existing HexStrike MCP integration. It also improves the MCP transport layer (SSE) to reliably handle HTTP/SSE MCP servers that return 202/async responses. ## Key changes - Add Metasploit MCP support via a `MetasploitAdapter` that can start/stop the vendored `MetasploitMCP` server and optionally start `msfrpcd` for local testing. - Make MCP tool registration automatic: MCP tools are discovered and registered at startup so they appear in the TUI `/tools` view. - Add environment flags to control vendored servers and subtree updates: - `LAUNCH_HEXTRIKE` / `LAUNCH_HEXSTRIKE` — control HexStrike vendored server auto-start behavior - `LAUNCH_METASPLOIT_MCP` — control Metasploit vendored server auto-start behavior - `FORCE_SUBTREE_PULL` — helper for scripts that add/update vendored `third_party` subtrees - Improve HTTP/SSE transport (`SSETransport`) to: - Discover the server's POST endpoint announced over `/sse` - Maintain a persistent SSE listener instead of transient GETs - Correlate pending requests with SSE-delivered responses (supporting 202 Accepted flows) - Wait for endpoint discovery on connect to avoid writer races - Add/update helper scripts (`scripts/add_metasploit_subtree.sh`, `scripts/setup.sh`) to vendor/update the Metasploit subtree and provide optional msfrpcd auto-start during setup. ## Files touched (high level) - `pentestagent/mcp/metasploit_adapter.py` — new adapter to manage vendored Metasploit MCP and optional msfrpcd. - `pentestagent/mcp/transport.py` — SSETransport enhancements and robustness fixes. - `pentestagent/mcp/manager.py` — LAUNCH env handling, auto-start wiring and connection logic (fixes applied so LAUNCH_* works as expected). - `pentestagent/mcp/mcp_servers.json` — added/updated `metasploit-local` entry in HexStrike-style (`--server http://...`). - `.env.example` — grouped MCP settings; documents `FORCE_SUBTREE_PULL` and LAUNCH flags. - `scripts/add_metasploit_subtree.sh`, `scripts/setup.sh` — vendoring helpers and optional msfrpcd startup. (See the full commit set on this branch for exact diffs and additional smaller edits.) ## Behavior / Usage - Default: vendored MCP entries are present in `pentestagent/mcp/mcp_servers.json` but not started unless configured. - To allow PentestAgent to auto-start vendored MCPs at runtime, set the corresponding `LAUNCH_*` environment variable to a truthy value (e.g. `true`, `1`, `yes`): \`\`\`bash export LAUNCH_METASPLOIT_MCP=true export LAUNCH_HEXTRIKE=true pentestagent \`\`\` When `LAUNCH_METASPLOIT_MCP` is truthy and the manager is started, the manager will attempt to auto-start the vendored Metasploit adapter and connect to it so its tools are registered automatically. If you prefer to run the vendored MCP server manually (recommended for debugging), start it separately and then run PentestAgent/TUI. Example: \`\`\`bash python third_party/MetasploitMCP/MetasploitMCP.py --server http://127.0.0.1:7777 \ > loot/artifacts/metasploit_mcp.log 2>&1 & disown pentestagent mcp test metasploit-local \`\`\` ## How to test 1. Pull this branch and install dependencies (see `scripts/setup.sh`). 2. Manual test: - Start msfrpcd (or configure `MSF_*` envs to point to an existing Metasploit RPC) - Start the vendored MCP server: \`\`\`bash python third_party/MetasploitMCP/MetasploitMCP.py --server http://127.0.0.1:7777 \`\`\` - Run the manager test: \`\`\`bash pentestagent mcp test metasploit-local \`\`\` - Expected: `+ Connected successfully!` and a list of available Metasploit tools. 3. Auto-start test: - Export `LAUNCH_METASPLOIT_MCP=true` and run `pentestagent` (or the TUI). The manager should auto-start the adapter and register tools so they appear in `/tools`. ## Security / Notes - Do not commit real passwords or API keys. Use a local `.env` (never committed) to provide secrets like `MSF_PASSWORD`. - The setup helper that may start `msfrpcd` will never invoke `sudo` — it only starts a local msfrpcd process if credentials are present and auto-start is enabled. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-27 13:59:23 -05:00
yindo closed this issue 2026-02-27 13:59:25 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: yindo/pentestagent#21
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?