RedAmon MCP
Self-hosted AI pentesting framework: attack surface graph, Kali sandbox, human approval gates and an MCP server you can drive from Claude Code
- 3,170 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The autonomous agent runs Metasploit, Hydra, scanners and other attack tools in a Kali container; dangerous steps need manual approval, but the tool exists to exploit vulnerabilities
- It stores discovered data about target infrastructure, third-party service keys and model provider tokens
- An MCP token acts as you, and command execution in Kali, when all three switches are on, runs with no target check
Install
- Works in
Manual install
git clone https://github.com/samugit83/redamon.git && cd redamon && ./redamon.sh installDocker Engine 28 or newer and Compose v2 are required. `--gvm` adds OpenVAS and `--kbase` adds the local knowledge base.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The autonomous agent runs Metasploit, Hydra, scanners and other attack tools in a Kali container; dangerous steps need manual approval, but the tool exists to exploit vulnerabilities
- It stores discovered data about target infrastructure, third-party service keys and model provider tokens
- An MCP token acts as you, and command execution in Kali, when all three switches are on, runs with no target check
This is third-party code. Review the repository files before installing.
What it does
RedAmon runs in your Docker and carries a pentest through the chain: recon, exploitation, post-exploitation. The recon pipeline collects subdomains, live hosts, open ports, web services and likely vulnerabilities and stores them in a Neo4j graph. An autonomous LangGraph agent follows the ReAct pattern and calls tools in a Kali Linux container through MCP servers. Dangerous actions run only after manual confirmation. Further agents then rank the findings, clone the target repository, write fixes and open a pull request. A built-in MCP server works the other way round: your Claude Code, Codex or another MCP client connects with a token and drives RedAmon. The server exposes 48 tools behind 17 permissions: listing projects, scan status, graph queries in plain language or Cypher, reading findings and evidence, starting and stopping recon, triage verdicts. Running a command in Kali is off by default and sits behind three separate switches. Settings can also generate a `SKILL.md` pack for one of 14 working profiles (bug bounty, penetration testing, attack surface monitoring and others) so the agent knows which tools to call and in what order.
Who it is for. For security engineers and bug bounty hunters who run authorized testing of their own or client systems and want to drive the platform from Claude Code.
Good fit when
- You run an authorized pentest and want recon and the attack surface graph built automatically
- You want to connect Claude Code to the platform and ask the graph in plain language which hosts and technologies are exposed
- Findings need ranking and review against evidence, with decisions recorded as verdicts through MCP
- A bug bounty program needs its own agent profile with a toolset and a call order
- A fix for a found vulnerability has to be prepared automatically and delivered as a pull request
Not a fit when
- You have no written permission from the system owner: the author forbids scanning or attacking systems you do not own
- You want a one-command scanner: RedAmon deploys seven or more containers and needs 80 GB of disk
- The machine has under 4 GB of memory for Docker: that minimum is barely enough even for the light install
- You only need a quick code review without network recon
Example request
Show an attack surface overview for the shop-staging project through RedAmon: hosts, services and findings by severity, then the most dangerous technology and CVE pairsMCP
- Transport
- http
- Authentication
- API key
Environment variables
MCP_SERVER_ENABLEDrequired- Turns on RedAmon's built-in MCP server; it is off after a normal install
Limitations
- The tool is for authorized testing, education and research. The author requires explicit written permission for every system tested and disclaims responsibility for any other use.
- Docker Engine 28.0.0 or newer and Docker Compose v2 are required. Minimum 4 GB of memory and 80 GB of disk, with 8 GB and 110 GB recommended. A permanent server running real engagements needs about 100 GB more for data.
- The OpenVAS install (`--gvm`) takes about 30 minutes on first run and needs more memory.
- The MCP server is off after a normal install (`MCP_SERVER_ENABLED`) and is refused over plain HTTP on a server deploy. A token is created in settings and acts as you inside your own projects.
- Some tools depend on third-party keys (Shodan, Tavily and others) and on model provider keys.
- WPScan has its own license: free for pentesting and personal use, with a separate license for commercial use.
How to disable. Stop the stack with `./redamon.sh down`; data is kept. `./redamon.sh clean` removes containers and images and keeps data, and `./redamon.sh purge` wipes everything. To only close access to agents, revoke the token in the MCP Server section of Global Settings or leave `MCP_SERVER_ENABLED` off.
FAQ
How do I install RedAmon?
Clone the repository and run `./redamon.sh install`. Add `--gvm` for the full stack with OpenVAS or `--kbase` for the local knowledge base. The script builds the images, starts the services and then offers to create an admin.
How do I connect RedAmon to Claude Code?
Mint a token in the MCP Server section of Global Settings, then run `claude mcp add --transport http redamon https://<host>/api/mcp-server --header "Authorization: Bearer <token>"`. Client support for a static authorization header varies; see the server documentation for details.
Which tools does the agent get over MCP?
48 tools behind 17 permissions: projects, scan status, the graph in plain language and Cypher, findings, evidence, verdicts, starting recon, setting presets. The list is read from the live `tools/list`, and shell execution in Kali is off by default.
Can I scan any website with it?
No. The documentation allows testing only systems you own or have explicit written permission to test. Unauthorized access is illegal and punishable, and responsibility is yours.
What is Agent Onboarding?
A feature that takes one of 14 profiles (bug bounty, pentest, SOC, DevSecOps and others), ticks the token permissions that job needs and generates a pack with a `SKILL.md` and reference files. Clients that load no skill files, such as Cursor or Cline, get the same guidance when they connect.
Discussion
No questions or reviews yet.
Related
MCP serversA bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Open-source deception framework: decoy SSH, HTTP, database and MCP services in YAML, optional LLM responses, attacker activity logged as evidence
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
MCP server for the ARL-Next platform: returns ports, fingerprints, certificates, vulnerabilities and leaks for a domain, IP or URL from your asset database
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| RedAmon (this entry) | yes | API key | 3,170 | |
| Strix | no | 70,608 | another autonomous pentest agent, while RedAmon adds an attack surface graph, triage and its own MCP server for outside agents | |
| MCP Kali Server | no | not required | 856 | gives an agent a Kali shell over MCP and nothing more, with no recon, graph or triage |
| HexStrike AI MCP Agents | no | not required | 12,979 | a set of MCP security tools, while RedAmon adds its own recon pipeline and findings graph |
README in short
The README opens with a legal disclaimer about authorized testing, then covers requirements, installation through `redamon.sh`, creating an admin and the stack control commands. Tables of recon modules follow, then the agent with its tools and the MCP servers in the sandbox. Separate sections cover plugging in external MCP servers as plugins, the built-in MCP server, the triage pipeline and automated fixes with pull requests.