About Cobalt Strike MCP
Cobalt Strike MCP is an MCP server published by FemaleGhost in the Other category.
Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/FemaleGhost/Cobalt-Strike-MCPThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (100)
beacon_change_directoryChange current directory on a beacon
Parameters not published.
beacon_copy_fileCopy a file on a beacon
Parameters not published.
beacon_create_directoryCreate a directory on a beacon
Parameters not published.
beacon_delete_fileDelete a file or directory on a beacon
Parameters not published.
beacon_download_fileDownload a file from a beacon
Parameters not published.
beacon_get_current_directoryGet current working directory on a beacon
Parameters not published.
beacon_list_directoryList directory contents on a beacon
Parameters not published.
beacon_list_drivesList available drives on a beacon
Parameters not published.
beacon_move_fileMove/rename a file on a beacon
Parameters not published.
beacon_upload_fileUpload a file to a beacon
Parameters not published.
Show all 100 tools
clear_beacon_command_queueClear beacon command queue
Parameters not published.
create_credentialCreate a new credential entry
Parameters not published.
create_listenerCreate a new listener (HTTP, HTTPS, DNS, SMB, etc.)
Parameters not published.
delete_credentialDelete a credential from the teamserver
Parameters not published.
delete_listenerDelete/remove a listener from the teamserver
Parameters not published.
download_payloadDownload a generated payload file
Parameters not published.
elevate_beaconElevate beacon privileges
Parameters not published.
elevate_commandElevate command privileges
Parameters not published.
execute_beacon_commandExecute a command on a beacon (e.g., "whoami", "ls", "shell", "powershell")
Parameters not published.
execute_beacon_infoGet beacon information
Parameters not published.
execute_bofExecute a BOF on a beacon
Parameters not published.
execute_bof_packExecute a BOF with packing
Parameters not published.
execute_bof_packedExecute a packed BOF
Parameters not published.
execute_browserpivot_stopStop browser pivot
Parameters not published.
execute_cancel_file_downloadCancel file download
Parameters not published.
execute_checkinForce beacon check-in
Parameters not published.
execute_clipboardGet clipboard contents
Parameters not published.
execute_exitExit beacon
Parameters not published.
execute_get_privsGet privileges
Parameters not published.
execute_get_systemGet SYSTEM privileges
Parameters not published.
execute_get_uidGet user ID
Parameters not published.
execute_job_stopStop a job
Parameters not published.
execute_kerberos_ticket_purgePurge Kerberos tickets
Parameters not published.
execute_kerberos_ticket_useUse Kerberos ticket
Parameters not published.
execute_kill_processKill a process
Parameters not published.
execute_link_smbLink to SMB beacon
Parameters not published.
execute_link_tcpLink to TCP beacon
Parameters not published.
execute_make_tokenMake a token using logon credentials
Parameters not published.
execute_make_token_upnMake a token using UPN (User Principal Name)
Parameters not published.
execute_net_domainGet domain information
Parameters not published.
execute_powershell_importImport PowerShell script
Parameters not published.
execute_reg_queryQuery registry key
Parameters not published.
execute_reg_queryvQuery registry value
Parameters not published.
execute_rev2selfRevert to self (drop impersonated token)
Parameters not published.
execute_rportfwd_startStart reverse port forward
Parameters not published.
execute_rportfwd_stopStop reverse port forward
Parameters not published.
execute_setenvSet environment variable
Parameters not published.
execute_socks4_startStart SOCKS4 proxy
Parameters not published.
execute_socks5_startStart SOCKS5 proxy
Parameters not published.
execute_socks_stopStop SOCKS proxy
Parameters not published.
execute_socks_stop_allStop all SOCKS proxies
Parameters not published.
execute_socks_stop_portStop SOCKS proxy on specific port
Parameters not published.
execute_steal_tokenSteal a token from a process
Parameters not published.
execute_timestompModify file timestamps
Parameters not published.
execute_tokenStore_removeRemove a token from the token store
Parameters not published.
execute_tokenStore_removeAllRemove all tokens from the token store
Parameters not published.
execute_tokenStore_stealSteal a token and add it to the token store
Parameters not published.
execute_tokenStore_stealAndUseSteal a token and immediately use it
Parameters not published.
execute_tokenStore_useUse a token from the token store
Parameters not published.
execute_unlinkUnlink from beacon
Parameters not published.
generate_stageless_payloadGenerate a stageless payload for a listener
Parameters not published.
generate_stager_payloadGenerate a stager payload for a listener
Parameters not published.
get_artifactsGet artifacts
Parameters not published.
get_beaconGet detailed information about a specific beacon by ID
Parameters not published.
get_beacon_active_downloadsGet active downloads for a beacon
Parameters not published.
get_beacon_c2_host_profilesGet available C2 profiles for beacon
Parameters not published.
get_beacon_command_helpGet help for a specific beacon command
Parameters not published.
get_beacon_helpGet beacon help
Parameters not published.
get_beacon_jobsGet jobs running on a beacon
Parameters not published.
get_beacon_keystrokesGet keystrokes for a beacon
Parameters not published.
get_beacon_outputGet the output from a beacon (console output)
Parameters not published.
get_beacon_taskGet the status and output of a specific beacon task
Parameters not published.
get_beacon_tasks_detailGet detailed task information for a specific beacon
Parameters not published.
get_beacon_tasks_summaryGet task summary for a specific beacon
Parameters not published.
get_beacon_tokenStoreGet token store state for beacon
Parameters not published.
get_credentialGet detailed information about a specific credential by ID
Parameters not published.
get_downloadGet download information by ID
Parameters not published.
get_keystrokesGet keystroke data by ID
Parameters not published.
get_killdateGet kill date
Parameters not published.
get_listenerGet listener by ID
Parameters not published.
get_profileGet C2 profile
Parameters not published.
get_screenshotGet a specific screenshot by ID
Parameters not published.
get_system_informationGet system information
Parameters not published.
get_taskGet detailed information about a specific task by ID
Parameters not published.
get_task_errorGet error information for a specific task
Parameters not published.
get_task_logGet log information for a specific task
Parameters not published.
get_teamserver_infoGet information about the Cobalt Strike teamserver (version, license, stats)
Parameters not published.
get_teamserver_ipGet teamserver IP
Parameters not published.
inject_beaconInject a beacon into a process
Parameters not published.
inject_browserpivotStartStart browser pivot
Parameters not published.
inject_chromedumpDump Chrome passwords
Parameters not published.
inject_dcsyncPerform DCSync attack to extract domain credentials
Parameters not published.
inject_dllInject a DLL into a process
Parameters not published.
inject_hashdumpDump password hashes (inject mode)
Parameters not published.
inject_keyloggerStart keylogger on a process
Parameters not published.
inject_loadDllLoad a DLL
Parameters not published.
inject_logonPasswordsDump logon passwords (inject mode)
Parameters not published.
inject_mimikatzRun Mimikatz
Parameters not published.
inject_net_computersEnumerate computers (inject mode)
Parameters not published.
inject_net_domain_controllersList domain controllers (inject mode)
Parameters not published.
Ask AI
Ask AI about Cobalt Strike MCP
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.