Metadata-Version: 2.4
Name: nobody-pentest-ultra
Version: 3.0.5
Summary: International professional-grade MCP pentest server — 86+ tools, CVSS 3.1 scoring, MITRE ATT&CK mapping, AI-powered analysis, cross-platform support
Project-URL: Homepage, https://nobody0x.com/pentest-docs
Project-URL: Documentation, https://nobody0x.com/pentest-docs
Project-URL: Repository, https://github.com/nobody0x/nobody-pentest-ultra
Project-URL: Issues, https://github.com/nobody0x/nobody-pentest-ultra/issues
Author-email: Nobody AI Security Team <admin@nobody0x.com>
License: MIT
License-File: LICENSE
Keywords: ai,claude,cvss,cybersecurity,exploit,hacking,mcp,mitre-attack,offensive-security,pentest,red-team,security,vulnerability
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Requires-Dist: httpx>=0.25.0
Requires-Dist: mcp>=1.0.0
Provides-Extra: dev
Requires-Dist: mypy>=1.8; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest-mock>=3.12; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.1; extra == 'dev'
Provides-Extra: full
Requires-Dist: defusedxml>=0.7; extra == 'full'
Requires-Dist: jinja2>=3.0; extra == 'full'
Requires-Dist: pydantic>=2.0; extra == 'full'
Requires-Dist: python-nmap>=0.7; extra == 'full'
Requires-Dist: rich>=13.0; extra == 'full'
Requires-Dist: weasyprint>=60.0; extra == 'full'
Description-Content-Type: text/markdown

# Nobody Pentest Ultra MCP Server

**150+ security tools** with AI-powered analysis via Nobody AI backend.

MCP server yang menghubungkan Claude Code, GPT, Copilot, atau MCP-compatible agent dengan 150+ tools keamanan.

## Features

### 150+ Security Tools

| Category | Tools | Count |
|----------|-------|-------|
| Network Recon | nmap, masscan, rustscan, amass, subfinder, fierce, dnsenum, autorecon, theharvester, arp-scan, enum4linux, smbmap, netexec, responder | 14+ |
| Web App | gobuster, feroxbuster, ffuf, dirsearch, httpx, katana, nuclei, nikto, sqlmap, wpscan, dalfox, wafw00f, wfuzz, commix, nosqlmap, tplmap, testssl, sslscan, sslyze, whatweb, jwt_tool, paramspider, arjun, x8, hakrawler, gau, waybackurls | 27+ |
| Auth/Brute | hydra, john, hashcat, medusa, evil-winrm, hashid | 6+ |
| Binary/RE | ghidra, radare2, gdb, binwalk, checksec, strings, objdump, volatility, foremost, steghide, exiftool, msfvenom, ROPgadget, one_gadget, upx, pwntools | 16+ |
| Cloud | prowler, trivy, kube-hunter, kube-bench, docker-bench, scout-suite, cloudmapper, checkov, falco | 9+ |
| CTF/Forensics | volatility3, stegsolve, zsteg, outguess, bulk-extractor, scalpel, autopsy | 7+ |
| OSINT | sherlock, recon-ng, spiderfoot, shodan, censys, social-analyzer, trufflehog | 7+ |

### AI-Powered Analysis

- **Tool Selection**: AI selects the best tool for each task
- **Parameter Optimization**: AI optimizes tool parameters
- **Attack Chain Discovery**: AI finds attack paths
- **Report Generation**: AI creates professional pentest reports

### Smart Features

- **Auto-detect**: Detects if tools are installed
- **Graceful Fallback**: Suggests installation for missing tools
- **Caching**: Smart result caching
- **Timeout**: Configurable timeouts

## Quick Setup

### Install

```bash
pip install nobody-pentest-ultra
```

### Add to Claude Code

```bash
# First, find where nobody-pentest-ultra is installed
python -c "import nobody_pentest_ultra.server; print(nobody_pentest_ultra.server.__file__)"
# Output: C:\...\Lib\site-packages\nobody_pentest_ultra\server.py

# Then add to Claude Code using the full path
claude mcp add nobody-pentest-ultra -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"

# With API key (external endpoints)
claude mcp add nobody-pentest-ultra -e NOBODY_API_KEY=sk-nobody-xxx -- python "C:\...\Lib\site-packages\nobody_pentest_ultra\server.py"
```

> **Note:** Claude Code does not support `python -m` syntax. Use full path to server.py instead.

### Add to OpenCode

Add to your `opencode.json` or `opencode.jsonc` project config:

```jsonc
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nobody-pentest-ultra": {
      "type": "local",
      "command": ["npx", "-y", "nobody-pentest-ultra"],
      "enabled": true
    }
  }
}
```

If installed via pip (not npx), use `python -m`:

```jsonc
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nobody-pentest-ultra": {
      "type": "local",
      "command": ["python", "-m", "nobody_pentest_ultra.server"],
      "enabled": true,
      "environment": {
        "NOBODY_API_KEY": "sk-nobody-xxx"
      }
    }
  }
}
```

> **Tip:** OpenCode supports `-m` syntax, so `python -m nobody_pentest_ultra.server` works directly.

After adding the config, restart OpenCode. All 150+ security tools will be available as MCP tools.

### Restart Claude Code

```
> Scan example.com for all vulnerabilities
> Perform full web app security test on target.com
> Enumerate subdomains for company.com
```

## Usage Examples

### Network Scanning

```
> Scan 192.168.1.1 for open ports and services
> Run masscan on 10.0.0.0/24
> Enumerate subdomains for example.com
```

### Web Application Testing

```
> Test example.com for SQL injection
> Enumerate directories on target.com
> Scan for XSS vulnerabilities
> Check SSL/TLS configuration
```

### Complete Pentest

```
> Perform full penetration test on example.com
> Run all security checks on target.com
```

## Tool Installation

### Why tools are not bundled

Nobody Pentest Ultra is a **Python orchestration layer** — it manages and executes 86+ industry-standard security tools. These tools are native binaries (C, Go, Rust, Java) maintained independently by their respective projects. Bundling them would mean:

- **Size**: 86 native binaries would exceed **5GB** — PyPI limit is 100MB
- **Platform lock**: Each tool needs different compilation for Linux/macOS/Windows
- **Stale versions**: Bundled binaries wouldn't get security patches
- **Dependency conflicts**: Ghidra needs JDK 17, Masscan needs libpcap-dev, Nuclei needs Go 1.21+

**This is the industry standard.** Metasploit, Cobalt Strike, HexStrike AI — none bundle their tools.

### Auto-Install Engine (recommended)

v3.0 includes a cross-platform auto-install engine. Set `AUTO_INSTALL=true` and tools are installed on-demand:

```bash
# Enable auto-install
export AUTO_INSTALL=true

# Tools will be installed automatically when first used:
# - nmap_scan -> apt install nmap / brew install nmap / choco install nmap
# - nuclei_scan -> go install nuclei@latest
# - sqlmap_scan -> pip install sqlmap
# - and 83 more...
```

The engine detects your OS and picks the right package manager — **apt**, **brew**, **choco**, **winget**, **pacman**, **dnf**, **yum**, **pip**, **npm**, **go**, **cargo**.

### Manual Installation (optional)

Prefer full control? Install tools you need:

```bash
# === Recommended: Install all common tools at once ===
# Linux (Kali/Ubuntu)
curl -sL https://nobody0x.com/install-tools.sh | bash

# macOS
brew install nmap masscan nikto sqlmap binwalk radare2

# Windows (PowerShell as Admin)
choco install nmap masscan -y
pip install sqlmap

# === Or install per category ===
# Network Recon
apt install nmap masscan arp-scan dnsenum
go install github.com/owasp-amass/amass/v4/...@master
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Web Application
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/OJ/gobuster/v3@latest
pip install sqlmap wpscan wafw00f

# Authentication
apt install hydra john hashcat

# Binary Analysis
apt install radare2 gdb binwalk foremost steghide
pip install pwntools ROPgadget

# Cloud
pip install prowler checkov
go install github.com/aquasecurity/trivy/cmd/trivy@latest

# OSINT
pip install sherlock-cli social-analyzer
go install github.com/trufflesecurity/trufflehog/v3@latest
```

### Check Installed Tools

```bash
# Dry-run: see which tools would be auto-installed
nobody-pentest-ultra --dry-run
```

## Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `NOBODY_API_KEY` | (none) | API key for AI analysis (optional for Nobody endpoint) |
| `NOBODY_API_URL` | `https://v2.nobody0x.com/v1/messages` | AI backend URL |
| `NOBODY_MODEL` | `nobody-pentest` | AI model name |
| `SCAN_TIMEOUT` | `300` | Max scan time in seconds |
| `HTTP_TIMEOUT` | `30` | HTTP request timeout |

## License

MIT License
