Cobalt Strike MCP Server

This is a PoC MCP server developed as part of some internal experiments during the development of CS 4.12 and the CS REST API. More information can be found here.

https://github.com/user-attachments/assets/92d15b5f-4744-41aa-a803-abe342db8075

[!NOTE] This tool is still in early development stage and subject to breaking changes. It has been heavily vibe-coded, so don't be too hard on the quality of the code 😉

Getting Started

This MCP server provides a bridge between large language models like Claude and the Cobalt Strike C2 framework. It allows AI assistants to dynamically access and control the Cobalt Strike functionality through standardized tools, enabling a natural language interface to adversary simulation workflows.

Prerequisites

• Python 3.8+ installed
• FastMCP 2.12.5 or higher
• The Cobalt Strike API Server should be running.
• Cobalt Strike should be installed and configured.
• Cobalt Strike should be properly licensed

Installation

1. Clone the repository

   git clone <repository-url>
   cd cobaltstrike-mcp-server
   

2. Create and activate a virtual environment

• Windows:

  setup.bat
  venv\Scripts\activate
  

• macOS/Linux:

  setup.sh
  source venv/bin/activate
  

3. Install dependencies

   pip install -r requirements.txt
   

4. Verify Installation

   python cs_mcp.py --help
   

Alternative: System-wide Installation

pip install -r requirements.txt

Configuration

Environment Variables

You can configure the server using environment variables:

# Cobalt Strike API Configuration
export CS_API_BASE_URL="https://your-teamserver:50443"
export CS_API_USERNAME="your_username"
export CS_API_PASSWORD="your_password"
export CS_API_VERIFY_TLS="false"  # Set to "true" for production
export CS_API_HTTP_TIMEOUT="30.0"

# MCP Server Configuration
export MCP_LISTEN_HOST="127.0.0.1"
export MCP_LISTEN_PORT="3000"
export MCP_TRANSPORT="http"
export MCP_SERVER_NAME="Cobalt Strike MCP"

# Logging
export LOG_LEVEL="INFO"  # DEBUG, INFO, WARNING, ERROR

.env File Support

The server automatically loads environment variables from a .env file in the current directory if it exists:

1. Copy the example file:

   cp .env.example .env
   

2. Edit the configuration:

   # Edit .env with your settings
   CS_API_USERNAME=rest_client
   CS_API_PASSWORD=SecurePassword123
   CS_API_VERIFY_TLS=false
   MCP_TRANSPORT=stdio
   

3. Run without command line arguments:

   python cs_mcp.py
   

Viewing Environment Variables

Use the --show-env option to see all supported environment variables and their current values:

python cs_mcp.py --show-env

This displays:

• All supported environment variables
• Current values (SET/NOT SET)
• Description and default values
• No authentication required

Command Line Arguments

The following parameters can be used while starting the MCP Server:

Cobalt Strike API

• --base-url: Base URL for the Cobalt Strike REST API (https://<CS_HOST>:50443)

Authentication

• --username: Cobalt Strike username (required)
• --password: Cobalt Strike password (required)
• --duration-ms: JWT session duration in milliseconds

HTTP Client

• --http-timeout: HTTP request timeout in seconds
• --insecure: Disable TLS certificate verification
• --verify-tls: Enable TLS certificate v

... View full README on GitHub