High-risk tools in Kali Security MCP

High severity Kali Security MCP MCP Server 129 of 194 tools

129 of the 194 tools in Kali Security MCP are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

adaptive_cmdi_test Execute

自适应命令注入测试
adaptive_create_execution_context Execute

创建自适应执行上下文
adaptive_execute_strategy Execute

执行自适应策略
adaptive_intelligent_orchestration Execute

智能编排多目标自适应攻击
adaptive_network_penetration Execute

自适应网络渗透测试 - 智能化网络攻击。
adaptive_sqli_test Execute

自适应SQL注入测试 - 智能检测和利用
adaptive_web_penetration Execute

自适应Web渗透测试 - 智能化Web应用攻击。
adaptive_xss_test Execute

自适应XSS测试 - 上下文感知的XSS检测
add_chain_step Execute

add_chain_step
agent_run Execute

agent_run
aircrack_attack Execute

aircrack_attack
apt_comprehensive_attack Execute

执行APT综合攻击链 - 全面的多向量并发攻击。
apt_network_penetration Execute

执行APT网络渗透攻击链 - 自动化多阶段网络渗透测试。
apt_web_application_attack Execute

执行APT Web应用攻击链 - 自动化多阶段Web应用渗透。
arp_scan Execute

Execute arp-scan for network discovery.
auth_bypass_test Execute

认证绕过测试 - 内置工作流
authorized_comprehensive_security_assessment Execute

Run authorized full-chain assessment using neutral external naming.
authorized_controlled_validation Execute

Run controlled validation phase only when allowed_actions permits it.
authorized_credential_assessment Execute

Run authorized credential audit phase only when allowed_actions permits it.
authorized_environment_review Execute

Run environment review phase only when allowed_actions permits it.
authorized_injection_verification Execute

Run non-destructive injection verification only (no dump/exfiltration).
authorized_network_exposure_assessment Execute

Run authorized network exposure assessment with phase-level output.
authorized_template_validation Execute

Run template-based security validation with constrained severity scope.
authorized_web_application_assessment Execute

Run authorized web assessment with exposure review and vuln validation.
auto_reverse_analyze Execute

自动选择可用工具进行逆向分析 - 智能工具选择
bandit_scan Execute

bandit_scan
bettercap_attack Execute

bettercap_attack
browser_click Execute

模拟人工点击页面元素（带随机延迟和鼠标移动模拟）
browser_close_session Execute

关闭浏览器会话并保存状态（cookies/storage持久化到磁盘）
browser_execute_js Execute

在浏览器上下文中执行JavaScript代码
browser_intercept_request Execute

browser_intercept_request
browser_navigate Execute

在已有会话中导航到新页面
browser_start_session Execute

browser_start_session
browser_type_text Execute

browser_type_text
brutespray_attack Execute

brutespray_attack
bully_attack Execute

Execute bully for WPS attacks.
code_audit_comprehensive Execute

code_audit_comprehensive
compile_task_handoff Execute

Compile handoff/progress for resume (do-not-rescan + next_actions).
comprehensive_recon Execute

comprehensive_recon
continue_from_handoff Execute

Resume plan from last handoff without forcing full rescan.
create_attack_chain Execute

创建攻击链。
cross_validate_vulns Execute

交叉验证黑盒和白盒发现的漏洞，提升置信度。
crowbar_attack Execute

crowbar_attack
ctf_pwn_solver Execute

ctf_pwn_solver
ctf_quick_scan Execute

CTF快速扫描 - 针对CTF环境优化的快速漏洞发现。
ctf_web_attack Execute

CTF Web攻击链 - 专门针对CTF Web题目的攻击。
detect_blind_vulnerability Execute

盲注漏洞检测 - 基于响应差异
dirb_scan Execute

使用 Dirb 执行目录枚举。
dnsenum_scan Execute

使用 Dnsenum 执行 DNS 枚举。
dnsrecon_scan Execute

dnsrecon_scan
enum4linux_scan Execute

Execute Enum4linux Windows/Samba enumeration tool.
execute_command Execute

Execute an arbitrary command on the Kali server.
fast_reconnaissance Execute

执行快速侦察工作流。
feroxbuster_scan Execute

使用 Feroxbuster 执行目录与资源爆破。
ffuf_scan Execute

ffuf_scan
fierce_scan Execute

使用 Fierce 执行 DNS 侦察。
flawfinder_scan Execute

flawfinder_scan
fping_scan Execute

Execute fping for fast ping sweeps.
fuzz_all_params Execute

全参数模糊测试 - 自动识别并测试所有参数
fuzz_parameter Execute

fuzz_parameter
generate_attack_paths Execute

生成针对目标的APT攻击路径。
generate_poc_from_current_session Execute

从当前活跃会话生成PoC - 无需指定会话ID，直接从当前会话生成。
generate_poc_from_session Execute

从指定攻击会话生成PoC - 自动分析攻击链并生成多种格式的PoC。
ghidra_analyze_binary Execute

使用Ghidra分析二进制文件 - NSA开源逆向分析工具
gobuster_scan Execute

gobuster_scan
grpc_call Execute

grpc_call
hashcat_crack Execute

hashcat_crack
http_compare Execute

比较两个HTTP响应的差异 - 用于盲注检测
http_replay Execute

重放历史HTTP请求，可修改参数
http_send Execute

http_send
http_send_raw Execute

发送原始HTTP请求 - 完全控制请求格式
http_session_manage Execute

http_session_manage
httpx_probe Execute

httpx_probe
hydra_attack Execute

hydra_attack
intelligent_apt_campaign Execute

智能APT攻击活动 - 最高级别的自适应攻击。
issue_vulnerability Execute

issue_vulnerability
john_crack Execute

john_crack
joomscan_scan Execute

Execute joomscan for Joomla security testing.
kali_run Execute

kali_run
llm_auto_pentest Execute

llm_auto_pentest
masscan_fast_scan Execute

masscan_fast_scan
medusa_attack Execute

使用 Medusa 执行口令验证测试。
metasploit_run Execute

Execute a Metasploit module.
multi_target_execute_batch Execute

批量执行多目标攻击任务
multi_target_orchestrate Execute

执行多目标攻击编排
ncrack_attack Execute

使用 Ncrack 执行网络服务凭据验证。
netdiscover_scan Execute

netdiscover_scan
nikto_scan Execute

Execute Nikto web server scanner.
nmap_scan Execute

nmap_scan
nuclei_cve_scan Execute

Execute Nuclei CVE vulnerability scan.
nuclei_network_scan Execute

Execute Nuclei network security scan.
nuclei_scan Execute

nuclei_scan
nuclei_technology_detection Execute

Execute Nuclei technology detection scan.
nuclei_web_scan Execute

Execute Nuclei web application security scan.
parallel_directory_scanning Execute

并行执行多个目标的目录扫描。
parallel_port_scanning Execute

并行执行多个目标的端口扫描。
patator_attack Execute

patator_attack
pixiewps_attack Execute

pixiewps_attack
proxy_start Execute

启动代理服务器 - 用于流量拦截
pwn_comprehensive_attack Execute

pwn_comprehensive_attack
quick_pwn_check Execute

quick_pwn_check
radare2_analyze_binary Execute

使用Radare2分析二进制文件 - 开源逆向分析工具
reaver_attack Execute

Execute Reaver for WPS PIN attacks.
recon_ng_run Execute

Execute recon-ng for reconnaissance.
run_playbook Execute

Run a named playbook (web_surface | api_surface | auth_surface | svc_surface).
run_surface_chain Execute

run_surface_chain
run_surface_chain_multi Execute

run_surface_chain_multi
scan_start Execute

Start a heavy scan in background; returns job_id immediately.
scan_wait Execute

Block until an async scan job finishes or timeout_s elapses.
semgrep_scan Execute

semgrep_scan
sqlmap_scan Execute

Execute SQLmap SQL injection scanner.
start_adaptive_apt_attack Execute

start_adaptive_apt_attack
start_attack_session Execute

开始新的攻击会话 - 启动自动日志记录和PoC生成。
start_task Execute

Create/open a task workspace and seed target graph nodes.
subfinder_scan Execute

Execute Subfinder for fast subdomain discovery.
submit_apt_attack_chain Execute

提交APT攻击链工作流 - 基于知识图谱的智能化并发攻击。
submit_concurrent_task Execute

提交并发任务。
submit_workflow Execute

submit_workflow
trigger_next_attack_phase Execute

手动触发下一攻击阶段 - 强制进入下一轮攻击。
verify_finding Execute

Verify a candidate finding by replaying command and matching expected_signal.
verify_vulnerability Execute

验证候选漏洞 (candidate → verified/failed)。
wfuzz_scan Execute

使用 Wfuzz 执行参数与路径模糊测试。
whatweb_scan Execute

whatweb_scan
workflow_execute Execute

执行测试工作流
wpscan_scan Execute

wpscan_scan
ws_connect Execute

建立WebSocket连接
ws_fuzz Execute

WebSocket模糊测试
ws_send Execute

ws_send
yersinia_attack Execute

yersinia_attack

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Runaway Tool Loops
Prompt Injection via Tool Results

High-risk tools in Kali Security MCP

Tools at high risk

Attacks that target this class

More on Kali Security MCP

Enforce policy on every Kali Security MCP tool call.