sec-mcp/docker-compose.yml

services:
  init-mcps:
    image: alpine/git:latest
    entrypoint: ["/bin/sh", "-lc"]
    command: >-
      set -e;
      mkdir -p /opt/mcps;
      if [ ! -d /opt/mcps/MCP-Kali-Server/.git ]; then
        git clone https://github.com/triv3/mcp-kali-server.git /opt/mcps/MCP-Kali-Server;
      else
        cd /opt/mcps/MCP-Kali-Server && git pull --ff-only;
      fi
      if [ ! -d /opt/mcps/markdownify-mcp/.git ]; then
        git clone https://github.com/zcaceres/markdownify-mcp.git /opt/mcps/markdownify-mcp;
      else
        cd /opt/mcps/markdownify-mcp && git pull --ff-only;
      fi
      if [ ! -d /opt/mcps/kali-mcp/.git ]; then
        git clone https://github.com/k3nn3dy-ai/kali-mcp.git /opt/mcps/kali-mcp;
      else
        cd /opt/mcps/kali-mcp && git pull --ff-only;
      fi
    volumes:
      - mcp_sources:/opt/mcps

  triv3-kali-api:
    image: python:3.12-slim
    depends_on:
      - init-mcps
    command: >-
      sh -lc "
      python -m pip install --no-cache-dir -r /opt/mcps/MCP-Kali-Server/requirements.kali.txt &&
      python /opt/mcps/MCP-Kali-Server/kali-server/kali_server.py --port 5000
      "
    volumes:
      - mcp_sources:/opt/mcps
    expose:
      - "5000"

  kali-mcp-sse:
    image: python:3.12-slim
    depends_on:
      - init-mcps
    command: >-
      sh -lc "
      python -m pip install --no-cache-dir /opt/mcps/kali-mcp &&
      python -m kali_mcp_server.server --transport sse --port 8000
      "
    volumes:
      - mcp_sources:/opt/mcps
    expose:
      - "8000"

  metasploit-rpc:
    image: kalilinux/kali-rolling:latest
    environment:
      - MSF_PASSWORD=${MSF_PASSWORD:-changeme}
    command: >-
      sh -lc "
      apt-get update && apt-get install -y --no-install-recommends metasploit-framework &&
      rm -rf /var/lib/apt/lists/* &&
      msfrpcd -P ${MSF_PASSWORD:-changeme} -S -a 0.0.0.0 -p 55553 -f
      "
    expose:
      - "55553"

  metasploit-mcp:
    image: python:3.12-slim
    depends_on:
      - metasploit-rpc
    environment:
      - MSF_PASSWORD=${MSF_PASSWORD:-changeme}
      - MSF_SERVER=metasploit-rpc
      - MSF_PORT=55553
      - MSF_SSL=false
    command: >-
      sh -lc "
      apt-get update && apt-get install -y --no-install-recommends git netcat-openbsd &&
      rm -rf /var/lib/apt/lists/* &&
      until nc -z metasploit-rpc 55553; do echo 'waiting for metasploit-rpc:55553...'; sleep 2; done &&
      git clone https://github.com/GH05TCREW/MetasploitMCP.git /opt/MetasploitMCP &&
      python -m pip install --no-cache-dir -r /opt/MetasploitMCP/requirements.txt &&
      python /opt/MetasploitMCP/MetasploitMCP.py --transport http --host 0.0.0.0 --port 8085
      "
    expose:
      - "8085"

  zap:
    image: zaproxy/zap-stable:latest
    environment:
      - ZAP_API_KEY=${ZAP_API_KEY:-changeme-zap-api-key}
    command: >-
      sh -lc "
      /zap/zap.sh -daemon -host 0.0.0.0 -port 8090
      -config api.addrs.addr.name=.*
      -config api.addrs.addr.regex=true
      -config api.key=${ZAP_API_KEY:-changeme-zap-api-key}
      "
    expose:
      - "8090"

  mcp-zap-server:
    image: ghcr.io/dtkmn/mcp-zap-server:latest
    depends_on:
      - zap
    environment:
      - MCP_SECURITY_MODE=api-key
      - MCP_API_KEY=${MCP_ZAP_API_KEY:-changeme-mcp-zap-api-key}
      - ZAP_API_KEY=${ZAP_API_KEY:-changeme-zap-api-key}
      - ZAP_SERVER_URL=zap
      - ZAP_SERVER_PORT=8090
      - ZAP_SERVER_API_KEY=${ZAP_API_KEY:-changeme-zap-api-key}
    expose:
      - "7456"

  ollama:
    image: ollama/ollama:rocm
    devices:
      - /dev/kfd
      - /dev/dri/renderD128
      - /dev/dri/renderD129
      - /dev/dri/card1
      - /dev/dri/card2
    ports:
      - "11434:11434"
    volumes:
      - ollama_data:/root/.ollama
    restart: unless-stopped

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    depends_on:
      - ollama
      - mcpo
    environment:
      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://ollama:11434}
    ports:
      - "3000:8080"
    volumes:
      - open_webui_data:/app/backend/data
    restart: unless-stopped

  mcpo:
    image: ghcr.io/open-webui/mcpo:main
    depends_on:
      - init-mcps
      - triv3-kali-api
      - kali-mcp-sse
      - metasploit-mcp
      - mcp-zap-server
    environment:
      - MCPO_API_KEY=${MCPO_API_KEY:-top-secret}
      - MCP_ZAP_API_KEY=${MCP_ZAP_API_KEY:-changeme-mcp-zap-api-key}
      - MD_SHARE_DIR=${MD_SHARE_DIR:-/opt/mcps/shared-markdown}
    command: >-
      sh -lc "
      apt-get update && apt-get install -y --no-install-recommends gettext-base python3 python3-pip curl bash &&
      rm -rf /var/lib/apt/lists/* &&
      python -m pip install --no-cache-dir -r /opt/mcps/MCP-Kali-Server/requirements.mcp.txt &&
      mkdir -p ${MD_SHARE_DIR:-/opt/mcps/shared-markdown} &&
      cd /opt/mcps/markdownify-mcp &&
      rm -f .python-version &&
      corepack enable &&
      pnpm install &&
      pnpm run build &&
      envsubst < /config/mcpo-config.template.json > /tmp/mcpo-config.json &&
      mcpo --host 0.0.0.0 --port 8000 --api-key \"${MCPO_API_KEY:-top-secret}\" --config /tmp/mcpo-config.json
      "
    volumes:
      - ./mcpo-config.template.json:/config/mcpo-config.template.json:ro
      - mcp_sources:/opt/mcps
    ports:
      - "8000:8000"

volumes:
  mcp_sources:
  ollama_data:
  open_webui_data: