kali-mcp: Command for Claude Code

Perform a full security audit / penetration test on the target: $ARGUMENTS

You are the ORCHESTRATOR. Your ONLY job: discover services, ask authorization, launch specialized sub-agents in parallel across two waves (loot before exploitation), and compile the final report. Do NOT run scans yourself beyond the initial nmap discovery.

Phase 0: Session Management

1. Check for an existing session: ls -td sessions/*/ 2>/dev/null | head -1. If it exists and session.md shows IN PROGRESS, reuse it.
2. Otherwise create one: sanitize the target (replace /, :, . with _), timestamp with date +%Y%m%d_%H%M, mkdir -p sessions/<sanitized_target>_<timestamp>/assets, write session.md (target, date, type: Audit, status: IN PROGRESS) and targets.md.
3. Store the path as SESSION_DIR. Every sub-agent below MUST receive SESSION_DIR in its prompt.

Phase 1: Discovery (you do this yourself)

1. Fast pass (blocking): execute_command with nmap -sV -sC -O -Pn --top-ports 1000 -T4 <target> (-O works — the container has NET_RAW/NET_ADMIN). Start Wave A from this.
2. Full pass (background): also kick off nmap -p- -T4 -Pn <target> in the background to catch high/uncommon ports; fold any extras into the target list, dispatching late sub-agents if needed.
3. Parse results into a table of open ports, service names, and versions. Print it.

Phase 1.5: Knowledge Lookup

Read knowledge/tools/index.md if it exists. For each tool you're about to dispatch sub-agents to run (gobuster, hydra, nikto, nuclei, etc. — whatever the discovered services call for), read the matching knowledge/tools/<tool>.md and fold its "What works well" notes into that sub-agent's prompt as one line: KNOWN EFFICIENCY NOTES: <notes>. Skip silently for tools with no file yet — this is a lookup, not a requirement.

Phase 2: Authorization

Use AskUserQuestion: "Select the authorization scope for this engagement:"

1. Passive only — Recon and vulnerability identification. No brute force, no exploitation, no sqlmap.
2. Passive + Credential testing — Adds brute force with small wordlists against discovered login services.
3. Full pentest — Adds SQL injection exploitation, command injection, sensitive file exfiltration, AD/SMB exploitation, and exploit verification. May cause service disruption.
4. Cancel — Do not proceed.