hexstrike-ai MCP — 使用場景, 安裝 & 即時演示

為什麼要用

核心特性

150+ integrated security tools across network, web, binary, cloud, OSINT, and forensics
12+ autonomous AI agents for intelligent decision-making and workflow management
Real-time dashboard with live monitoring and vulnerability reporting
Smart result caching with LRU eviction for performance
Headless Chrome integration for dynamic web application testing

即時演示

實際使用效果

hexstrike-ai.replay ▶ 就緒

0/0

安裝

選擇你的客戶端

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/0x4m4/hexstrike-ai"
      ]
    }
  }
}

開啟 Claude Desktop → Settings → Developer → Edit Config。儲存後重啟應用。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/0x4m4/hexstrike-ai"
      ]
    }
  }
}

Cursor 使用與 Claude Desktop 相同的 mcpServers 格式。專案級設定優先於全域。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/0x4m4/hexstrike-ai"
      ]
    }
  }
}

點擊 Cline 側欄中的 MCP Servers 圖示，然後選 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/0x4m4/hexstrike-ai"
      ]
    }
  }
}

格式與 Claude Desktop 相同。重啟 Windsurf 生效。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "hexstrike-ai",
      "command": "TODO",
      "args": [
        "See README: https://github.com/0x4m4/hexstrike-ai"
      ]
    }
  ]
}

Continue 使用伺服器物件陣列，而非映射。

~/.config/zed/settings.json

{
  "context_servers": {
    "hexstrike-ai": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/0x4m4/hexstrike-ai"
        ]
      }
    }
  }
}

加入 context_servers。Zed 儲存後熱重載。

claude mcp add hexstrike-ai -- TODO 'See README: https://github.com/0x4m4/hexstrike-ai'

一行命令搞定。用 claude mcp list 驗證，claude mcp remove 移除。

使用場景

實戰用法： hexstrike-ai

How to solve a multi-stage CTF challenge with HexStrike AI

👤 CTF participants working on security challenges ⏱ ~60 min intermediate

何時使用： You have a CTF target and need to enumerate, scan, and exploit in a structured way.

前置條件

HexStrike AI installed in a sandboxed environment — Clone and pip install in a VM or container
Target is a CTF challenge you are authorized to test — Only use on CTF platforms or labs you have permission to test

步驟

Reconnaissance

Run an Nmap scan on the CTF target at 10.10.10.1. Identify open ports and services.✓ 已複製

→ Port scan results with service versions
Web enumeration

The target has a web server on port 80. Run Gobuster for directory enumeration and Nikto for vulnerability scanning.✓ 已複製

→ Discovered directories and potential vulnerabilities
Exploitation assistance

Found a login page at /admin. Run Hydra with the top-1000 passwords list against it.✓ 已複製

→ Login attempt results

結果： Systematic enumeration and exploitation path for the CTF challenge.

注意事項

Running aggressive scans that crash the CTF target — Use moderate scan speeds and timing options (Nmap -T3 instead of -T5)

搭配使用： filesystem

Perform an authorized web application security assessment

👤 Security professionals with written authorization to test a web application ⏱ ~120 min advanced

何時使用： You have a signed agreement to test a client's web application.

前置條件

Written authorization for the target — Signed penetration testing agreement from the target owner
HexStrike AI configured — Install and configure in an isolated environment

步驟

Vulnerability scanning

Run Nuclei against https://target.example.com with default templates. Focus on critical and high severity findings.✓ 已複製

→ List of discovered vulnerabilities with severity ratings
SQL injection testing

Test the login endpoint for SQL injection using SQLMap.✓ 已複製

→ SQLMap results showing injectable parameters or confirming the endpoint is secure

結果： A documented list of vulnerabilities found during authorized testing.

注意事項

Testing outside the agreed scope — Always reference your authorization document. Only test explicitly listed assets.

搭配使用： filesystem

組合

與其他 MCP 搭配，撬動十倍槓桿

hexstrike-ai + filesystem

Save scan results and generate a penetration testing report

Run a full assessment on the target, save all results, and generate a professional pentest report as a markdown file.✓ 已複製

工具

此 MCP 暴露的能力

工具	輸入參數	何時呼叫
nmap_scan	target: str, options?: str	Network port scanning and service detection
nuclei_scan	target: str, templates?: str	Automated vulnerability scanning with templates
sqlmap_test	url: str, params?: str	SQL injection detection and exploitation testing
gobuster_dir	url: str, wordlist?: str	Directory and file brute-force enumeration
hydra_attack	target: str, service: str, userlist?: str, passlist?: str	Password brute-force testing on services

成本與限制

運行它的成本

API 配額: N/A — all tools run locally
每次呼叫 Token 數: 500–3000 tokens per scan result
費用: Free — all tools are open source. Some tools (Shodan) need their own API keys.
提示: Run targeted scans instead of full-spectrum sweeps to reduce noise and time.

安全

權限、密鑰、影響範圍

憑證儲存： Individual tool API keys (Shodan, etc.) in environment variables

資料出站： Network scans connect to target systems. OSINT tools call their respective APIs.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
These are real offensive security tools — unauthorized use is illegal in most jurisdictions.
Always run in an isolated environment (VM, Docker) to prevent accidental exposure.
Some tools (Hydra, Hashcat) perform brute-force attacks — only use on systems you're authorized to test.

故障排查

常見錯誤與修復

Tool not found / command not available

Many tools must be installed separately on your system. Install them via your package manager (apt, brew) or from source.

驗證： which nmap && which nuclei && which sqlmap

Scan timeout

Reduce scan scope or increase timeout. Use -T3 for Nmap instead of default timing.

驗證： Try a simple ping or single-port scan first

Permission denied on scan

Some scans (SYN scan) require root. Run with sudo or switch to a less privileged scan type.

驗證： sudo nmap -sS target

替代方案

hexstrike-ai 對比其他方案

替代方案	何時用它替代	權衡
mcp-security-hub	You want Dockerized security tools with better isolation and CI/CD integration	Better containerization but may require more setup
mcp-kali-server	You want a lightweight API bridge to a full Kali Linux installation	Full Kali toolkit but less AI agent specialization

hexstrike-ai

為什麼要用

核心特性

即時演示

實際使用效果

安裝

選擇你的客戶端

使用場景

實戰用法： hexstrike-ai

How to solve a multi-stage CTF challenge with HexStrike AI

前置條件

步驟

注意事項

Perform an authorized web application security assessment

前置條件

步驟

注意事項

組合

與其他 MCP 搭配，撬動十倍槓桿

工具

此 MCP 暴露的能力

成本與限制

運行它的成本

安全

權限、密鑰、影響範圍

故障排查

常見錯誤與修復

替代方案

hexstrike-ai 對比其他方案

更多

資源