whit3rabbit0/project_astro

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

46 stars 20 forks 质量 70 趋势 20

Repository Install

MCP Server 和 Kali API 服务器 - 配合 Claude Desktop Integ

概览

用于大型语言模型驱动渗透测试的智能层。作为MCP服务器发布，包含38个Kali工具封装器、参与跟踪、范围强制执行及结构化输出，支持任何兼容MCP客户端。只对你拥有或有明确授权测试的目标使用。 V1是一个Flask代理，在Claude Desktop和kali_api_server.py进程之间传递JSON。它能用，但架构脆弱——两台服务器，没有状态，没有安全栏，10个工具硬接到HTTP端点。侦察：amass、subfinder、ffuf、whatweb、dnsrecon、theharvester、nuclei 利用方式：searchsploit、crackmapexec、hashcat、responder、smbclient、evil-winrm Impacket suite： secretsdump， psexec， wmiexec， kerberoast， getnpusers， getst， ticketer 后开发：亚麻、冬豌豆、血猎犬、凿子、网猫、鼻蛇隧道/C2：Burp（代理集成）、certipy（AD CS攻击）

概述（AI 翻译）

用于大型语言模型驱动渗透测试的智能层。作为MCP服务器发布，包含38个Kali工具封装器、参与跟踪、范围强制执行及结构化输出，支持任何兼容MCP客户端。

这是一个开发套件。 仅对你拥有或明确授权测试的目标使用。

V1发生了什么变化

V1 是一个 Flask 代理，在 Claude Desktop 和 kali_api_server.py 进程之间传递 JSON。它能用，但架构很脆弱——两台服务器，没有状态，没有安全栏杆，10 个工具硬接线到 HTTP 端点。

V2是从零开始重写的：

	V1	V2
架构Flask API + MCP shim（2个进程）	单一FastMCP服务器（`mcp` SDK）
传输	仅限HTTP	Streamable-HTTP 或 stdio
工具	10个，一个文件内联	38个封装器（+ 自定义脚本执行器），每个在`src/astro/tools/`中
工具验证	无 — 原始字符串到shell	基于pydantic的验证，shell元字符阻挡，blocked-flag列表
范围强制执行	无	通过 YAML 配置实现 CIDR + 域允许列表;每个工具调用都被检查
速率限制	无	每工具异步信号量
认证无	API密钥 + OIDC支持

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

Project Astro V2 - Disclaimer - This is DEVKIT

Intelligence layer for LLM-driven penetration testing. Ships as an MCP server with 38 Kali tool wrappers, engagement tracking, scope enforcement, and structured output for any MCP-compatible client.

This is a devkit. Use only against targets you own or have explicit authorization to test.

What changed from V1

V1 was a Flask proxy that shuttled JSON between Claude Desktop and a kali_api_server.py process. It worked, but the architecture was fragile — two servers, no state, no safety rails, 10 tools hard-wired to HTTP endpoints.

V2 is a ground-up rewrite:

	V1	V2
Architecture	Flask API + MCP shim (2 processes)	Single FastMCP server (`mcp` SDK)
Transport	HTTP only	Streamable-HTTP or stdio
Tools	10, inline in one file	38 wrappers (+ custom script executor), each in `src/astro/tools/`
Tool validation	None — raw strings to shell	Pydantic-based validation, shell metacharacter blocking, blocked-flag list
Scope enforcement	None	CIDR + domain allowlists via YAML config; every tool call is checked
Rate limiting	None	Per-tool async semaphores
Auth	None	API key + OIDC support
Engagement tracking	None	SQLite-backed finding recorder with per-engagement isolation
Output parsing	Raw stdout	Structured parsers for nmap, sqlmap, wpscan, nuclei, subfinder, etc.
Reporting	None	SARIF, HTML, Obsidian vault export, remediation mapping
Intelligence	None	CVE correlator (NVD API), attack graph builder (NetworkX), methodology tracker
CLI	`run.py` (starts 2 servers)	`astro serve`, `astro ollama`, `astro tui`, `astro version`
Packaging	`requirements.txt` + `venv`	`pyproject.toml`, installable via `pip install .`
Container	None	Multi-stage Kali Linux Dockerfile, docker-compose for lab environments
LLM support	Claude Desktop only	Any MCP client, plus native Ollama bridge and OpenAI-compatible bridge
Tests	None	pytest suite (unit + integration), ruff, mypy strict

New tools (V2 additions)

Recon: amass, subfinder, ffuf, whatweb, dnsrecon, theharvester, nuclei

Exploitation: searchsploit, crackmapexec, hashcat, responder, smbclient, evil-winrm

Impacket suite: secretsdump, psexec, wmiexec, kerberoast, getnpusers, getst, ticketer

Post-exploitation: linpeas, winpeas, bloodhound, chisel, netcat, msfvenom

Tunneling/C2: burp (proxy integration), certipy (AD CS attacks)

Flex: custom_script (arbitrary bash/python with timeout + sandbox)

Removed

kali_api_server.py — no longer needed; tools execute directly
run.py — replaced by astro CLI
requirements.txt — replaced by pyproject.toml
setup.sh — replaced by pip install . or Docker

Quick start

Docker (recommended)

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "astro": {
      "command": "astro",
      "args": ["serve", "--transport", "stdio"]
    }
  }
}