这个项目是一款以"PentestGPT"论文为原作的高级穿透测试工具. 它通过与"模型背景协议"服务器(MCP)相融合来扩展核心能力,以进行自动化,LLM驱动的安全评估.

它基于PentestGPT项目.

• 原始 GitHub 仓库 : https://github.com/GreyDGL/PentestGPT
• 原研究文件(USENIX Security ’ 24):https://www.usenix.org/conference/usenixsecurity24/presentation/deng

请用韩语读这个

□ 特性

• ** Dynamic MCP 服务器集成**:通过灵活的mcp_servers.json配置文件连接到本地或远程运行的各种工具服务器.
• ** 自动任务执行([[T3]模式)**: 使用连接的 MCP 服务器提供的工具自动执行 LLM 推荐的任务 。
• ** 交互式“人与人”模式**: 支持每个工具执行前的用户确认,加强自动扫描时的安全性和控制.
• 灵活模型支持:与包括OpenAI(GPT系列)和Google(Gemini系列)在内的多种LLM供应商合作.

□ 安装

1. 仓库和建立虚拟环境

2. 安装附属物

PentestGPT-MCP

This project is an advanced penetration testing tool based on the original “PentestGPT” paper. It extends the core capabilities by integrating with Model Context Protocol servers (MCPs) to perform automated, LLM-driven security assessments.

It is based on the PentestGPT project.

• Original GitHub Repository: https://github.com/GreyDGL/PentestGPT
• Original Research Paper (USENIX Security '24): https://www.usenix.org/conference/usenixsecurity24/presentation/deng

🇰🇷 Read this in Korean

Features

• Dynamic MCP Server Integration: Connects to various tool servers running locally or remotely via a flexible mcp_servers.json configuration file.
• Automated Task Execution (auto mode): Automatically executes LLM-suggested tasks using tools provided by a connected MCP server.
• Interactive “Human-in-the-Loop” Mode: Supports user confirmation before each tool execution, enhancing safety and control during automated scans.
• Flexible Model Support: Works with a wide range of LLM providers, including OpenAI (GPT series) and Google (Gemini series).

Installation

1. Clone the Repository and Set Up a Virtual Environment

git clone https://github.com/your-username/PentestGPT-MCP.git
cd PentestGPT-MCP
python -m venv venv
source venv/bin/activate  # On Windows, use `venv\Scripts\activate`

2. Install Dependencies

Install the required Python packages from requirements.txt.

pip install -r requirements.txt

3. Configure API Keys

PentestGPT-MCP requires API keys to interact with Large Language Models. Set the appropriate environment variables for the model you wish to use.

For OpenAI (e.g., gpt-4o):

export OPENAI_API_KEY="your-openai-api-key"

For Google (e.g., Gemini):

export GOOGLE_API_KEY="your-google-api-key"

4. Set Up MCP Servers

The tool manages connections to MCP servers through a central JSON configuration file.

1. Copy the Example Configuration

Copy the example file from the config/ directory to the project root.

cp config/mcp_servers.json.example ./mcp_servers.json

2. Edit the Configuration File

Open mcp_servers.json and customize it to match your environment.

Configuration Example:

{
    "mcpServers": {
        "pentest-tools": {
            "command": "python",
            "args": [
                "mcp_servers/pentest_tools_server.py"
            ]
        },
        "kali_mcp": {
            "command": "python3",
            "args": [
                "/absolute/path/to/mcp_server.py",
                "http://LINUX_IP:5000/"
            ]
        }
    }
}

Configuration Structure:

• mcpServers: The root object containing all server configurations.
• "server-name": A unique, user-defined name for each server (e.g., "pentest-tools").
• command: The command to execute the server (e.g., python, python3, node).