About Xshell MCP
Xshell MCP is an MCP server published by lyonzin in the AI category: mCP client bridge for X-SHELL C2 — SSE-to-Stdio + Multi-LLM adapters (OpenAI, Claude Code, Cursor).
The repository has 3 stars and 1 forks, with the last commit 6 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/lyonzin/xshell-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (20)
ad_enumActive Directory enumeration (users/computers/groups)
Parameters not published.
background_execExecute as non-blocking background job
Parameters not published.
bof_executeExecute Beacon Object File (BOF) in-process
Parameters not published.
clipboard_monitorMonitor clipboard for credentials (max 300s)
Parameters not published.
collect_fileExfiltrate file from target
Parameters not published.
collect_jobRetrieve background job output by job ID
Parameters not published.
exec_commandExecute PowerShell command and wait for output (120s timeout)
Parameters not published.
exfil_ddExfiltrate locked files (NTDS.dit, SAM, LSASS)
Parameters not published.
get_c2_statusGet C2 server status (verified, channel, headless)
Parameters not published.
get_security_contextEDR drivers, AMSI status, PS/.NET versions
Parameters not published.
Show all 20 tools
list_jobsList all background jobs and status
Parameters not published.
list_sessionsList all active C2 sessions
Parameters not published.
persistEstablish persistence (registry/startup/task)
Parameters not published.
port_scanInternal port scan from target host
Parameters not published.
regen_stagingRegenerate Stage2B/Stage2C OTP endpoints
Parameters not published.
rev_portfwdReverse port forward (C2:lport → target → rhost:rport)
Parameters not published.
run_assembly.NET assembly in-memory (Rubeus, Seatbelt, SharpHound)
Parameters not published.
screenshotCapture target desktop screenshot
Parameters not published.
socks_proxyStart SOCKS5 tunnel through beacon
Parameters not published.
switch_sessionSwitch active beacon (4-char ID or 'all' for broadcast)
Parameters not published.
Ask AI
Ask AI about Xshell MCP
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.