About RedTeam Agent
RedTeam Agent is an MCP server in the Blockchain category: redTeam-MCP: AI-Powered Autonomous Red Team Framework via Model Context Protocol. AI红队与内网渗透自动化框架，支持 gogo, fscan, httpx, nuclei, impacket, playwright 等 15+ 渗透工具，让 LLM 直接化身安全审计黑客。.
Install
git clone https://github.com/ktol1/RedTeam-AgentThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (15)
1gogo
Parameters not published.
10ldapdomaindump
Parameters not published.
11responder
Parameters not published.
12wmiexec
Parameters not published.
13psexec
Parameters not published.
14secretsdump
Parameters not published.
15ntlmrelayx
Parameters not published.
2fscan
Parameters not published.
3httpx
Parameters not published.
4nuclei
Parameters not published.
Show all 15 tools
5ffuf
Parameters not published.
6nxc
Parameters not published.
7kerbrute
Parameters not published.
8SharpHound
Parameters not published.
9pywerview
Parameters not published.
Ask AI
Ask AI about RedTeam Agent
Powered by Claude · Grounded in docs
Security checks
- ✓README presentThe repository ships documentation.
5 checks have not been run yet.
README
RedTeam-Agent
AI-Powered Autonomous Red Team Framework
Let AI become your security audit hacker
English | 简体中文 | Documentation | Quick Start
Overview
RedTeam-Agent is an AI-powered red team framework using a skill-first terminal workflow. AI reads project skills, discovers tools, executes commands in terminal, and summarizes high-signal findings.
Core philosophy: no manual tool-by-tool operation. Let AI orchestrate the workflow end-to-end.
Key Features
- Plug and play: 15+ tools with automated setup
- AI-driven workflow: Skill + terminal execution
- Token optimized: output filtering and file-first strategy
- AD coverage: BloodHound + impacket + Responder chain
- Multi-client support: Cursor, Claude Desktop, VS Code/Cline
Tool Matrix
Network
- gogo: fast asset discovery
- fscan: comprehensive host/service scan
Web
- httpx: HTTP probing and fingerprinting
- nuclei: template-based vulnerability validation
- ffuf: directory and parameter fuzzing
Active Directory
- SharpHound / bloodhound-python
- impacket (GetNPUsers, GetUserSPNs, secretsdump, ntlmrelayx, etc.)
- pywerview, ldapdomaindump
Lateral Movement
- nxc (NetExec)
- impacket-wmiexec
- impacket-psexec
Quick Start
1. Requirements
Python 3.8+
Windows 10/11 or Linux/macOS
8GB+ RAM recommended
2. Installation
git clone https://github.com/ktol1/RedTeam-Agent.git
cd RedTeam-Agent
python -m venv venv
# Windows PowerShell
.\venv\Scripts\Activate.ps1
# Linux/macOS
source venv/bin/activate
# Windows
python scripts/install_tools.py
# Linux/macOS
python scripts/install_tools_linux.py
3. Enable Skills Terminal Mode
No extra server setup is required.
cd RedTeam-Agent
dir .\tools
AI will read the repository skill and .github/copilot-instructions.md, then execute terminal commands directly.
4. Example Prompts
First load the redteam skill, then scan 192.168.1.0/24 in terminal,
write output to scan.txt, and summarize high-value findings.
Use SharpHound to collect corp.local data and summarize attack paths.
Set up a chisel proxy and provide upload/run commands.
AD Attack Flow
- Recon: gogo / fscan / kerbrute / pywerview
- Collection: SharpHound or bloodhound-python
- Analysis: BloodHound GUI or scripts/bloodhound_analysis.py
- Attack: Kerberoast / AS-REP Roast / secretsdump / relay
- Lateral: nxc / wmiexec / psexec / getST
Terminal Commands (Skill-driven)
| # | Tool | Function | Command |
|---|---|---|---|
| 1 | gogo | Fast asset probe | gogo -t 100 -l hosts.txt -q -f gogo.txt |
| 2 | fscan | Network scanner | fscan -h 192.168.1.0/24 -np -silent -nocolor -o fscan.txt |
| 3 | httpx | Web fingerprinting | httpx -l urls.txt -sc -title -server -td -silent -o httpx.txt |
| 4 | nuclei | POC scanner | nuclei -l urls.txt -tags cve,rce -s high,critical -nc -o nuclei.txt |
| 5 | ffuf | Directory fuzzing | ffuf -u http://target/FUZZ -w wordlist.txt -mc 200,301,302 -s -o ffuf.txt |
| 6 | nxc | Lateral movement | nxc smb 192.168.1.0/24 -u user -p pass --shares |
| 7 | kerbrute | Kerberos enum | kerbrute userenum -d corp.local --dc 192.168.1.10 users.txt -o valid_users.txt |
| 8 | SharpHound | Data collection | SharpHound.exe -c Default -d corp.local |
| 9 | pywerview | Domain enum | pywerview.py get-domain-user -d corp.local --dc-ip 192.168.1.10 -u user -p pass |
| 10 | ldapdomaindump | LDAP dump | ldapdomaindump ldap://192.168.1.10 -u 'corp\\user' -p 'password' -o .\\ldapdump |
| 11 | responder | LLMNR spoofing | responder -I eth0 -v |
| 12 | wmiexec | WMI exec | impacket-wmiexec domain/user:pass@target 'whoami' |
| 13 | psexec | Service exec | impacket-psexec domain/user:pass@target cmd.exe |
| 14 | secretsdump | Credential dump | impacket-secretsdump corp.local/user:pass@dc -just-dc |
| 15 | ntlmrelayx | NTLM relay | impacket-ntlmrelayx -t ldap://dc --smb2support |
Output Optimization
- Remove ANSI colors
- Compress blank lines
- Truncate excessive output
- Prefer file-first output for large scans
- Summarize only high-signal findings
Documentation
Contributing
Issues and pull requests are welcome.
MIT License - Copyright (c) 2024-2026 ktol1
README copy captured when this server was indexed; it may lag the repository. The original is authoritative.