Build a HexStrike MCP Security Server: 150+ Pentesting Tools for AI Agents [2026]

HexStrike AI MCP Agents is an open-source Python-based MCP server (11,595 GitHub stars) that exposes 150+ cybersecurity tools through the Model Context Protocol. Released with a permissive Apache 2.0 license, HexStrike enables Claude, GPT, Copilot, and any MCP-compatible client to autonomously execute network scans (Nmap, Masscan), web application tests (Burp Suite, ZAP), exploitation frameworks (Metasploit, Empire), OSINT gathering (theHarvester, Sherlock), and custom Python exploit scripts. Every tool execution runs inside an isolated Docker microVM with restricted network egress, cryptographic audit trails, and per-tool authorization gates.

• 150+ integrated tools: Nmap, Metasploit, Burp Suite, ZAP, SQLMap, Hydra, John the Ripper, Nikto, Gobuster, nuclei, and more
• Sandbox isolation: Each tool runs in a disposable Docker microVM with no persistent network access
• Audit logging: Every tool invocation is logged with HMAC-SHA384 signed receipts for compliance
• Tool authorization: Per-tool allowlist, rate limiting, and time-window restrictions
• MCP-native design: Works with Claude Desktop, Cursor, Windsurf, and any MCP client out of the box

What Makes HexStrike Unique

The cybersecurity MCP landscape has several individual tool servers (Nmap MCP, SQLMap MCP, Burp Suite MCP), but HexStrike's breakthrough is its unified interface. Instead of deploying and configuring 20 separate MCP servers, operators deploy a single HexStrike server that exposes all tools through consistent tool definitions. The LLM receives structured tool schemas with parameter descriptions, expected inputs, and output formats, making tool selection and chaining natural within agent reasoning loops.

HexStrike's architecture ensures that even the most powerful offensive tools are constrained by policy: each tool has configurable risk tiers (Low, Medium, High, Critical), and tools in the Critical tier require explicit user approval before execution. This tiered authorization prevents accidental deployment of destructive payloads while allowing automated reconnaissance and low-risk scanning.

+---------------------------------------------------------------------+
|                  HEXSTRIKE MCP SECURITY ARCHITECTURE                   |
+---------------------------------------------------------------------+
|                                                                       |
|  [ AI Agent: Claude / GPT / Copilot / Custom LangGraph Agent ]       |
|                    |                                                  |
|                    v                                                  |
|  +------------------------------------------+                        |
|  |        HexStrike MCP Server (Python)      |                       |
|  |   - Tool Registry (150+ tool definitions) |                       |
|  |   - Authorization Gateway (per-tool ACL)  |                       |
|  |   - Audit Logger (HMAC-SHA384)            |                       |
|  |   - Sandbox Orchestrator (Docker API)     |                       |
|  +------------------------------------------+                        |
|        |            |              |           |                      |
|        v            v              v           v                      |
|  +---------+ +----------+ +-----------+ +----------+                  |
|  | Network | | Web App  | | Exploit    | | OSINT    |                 |
|  | Scanner | | Tester   | | Framework  | | Gatherer |                 |
|  | MicroVM | | MicroVM  | | MicroVM    | | MicroVM  |                 |
|  +---------+ +----------+ +-----------+ +----------+                  |
|        |            |              |           |                      |
|        +-----------+--+------+-----+-----------+                      |
|                       v                                               |
|  +------------------------------------------+                        |
|  |            Audit & Forensics DB           |                        |
|  |  - Every tool call logged with HMAC key  |                        |
|  |  - Output stored in encrypted format      |                        |
|  |  - Retention policy: 90 days (configurable) |                      |
|  +------------------------------------------+                        |
+---------------------------------------------------------------------+

Step 1: Installing HexStrike MCP Server

# Clone and install
pip install hexstrike-mcp

# Or from source
git clone https://github.com/0x4m4/hexstrike-ai.git
cd hexstrike-ai
pip install -r requirements.txt

File 1: hexstrike_config.yaml — Server Configuration

# hexstrike_config.yaml — HexStrike MCP Security Server Configuration
server:
  name: "hexstrike-mcp-server"
  transport: "stdio"
  allowed_clients:
    - "claude-desktop"
    - "cursor"
    - "windsurf"

authorization:
  default_policy: "deny"  # Deny all by default; only explicitly allowed tools pass
  risk_tiers:
    low:
      - "nmap"
      - "whois"
      - "dig"
      - "theHarvester"
    medium:
      - "gobuster"
      - "nikto"
      - "sqlmap"
      - "hydra"
    high:
      - "metasploit"
      - "burpsuite"
      - "empire"
    critical:
      - "custom_exploit"
      - "meterpreter"
      - "c2_deploy"
      # Critical tier requires user confirmation before execution

sandbox:
  runner: "docker"
  base_image: "hexstrike/sandbox:2026.09"
  memory_limit: "2g"
  cpu_limit: 1.0
  network_egress: "isolated"  # Only allows DNS + target-specific IPs
  ephemeral_storage: true      # Disposable containers; no persistence
  max_execution_time: 300      # Seconds per tool call

audit:
  enabled: true
  hmac_key: "${HEXSTRIKE_HMAC_KEY}"
  storage: "postgresql"       # Audit logs stored in PostgreSQL
  retention_days: 90
  alert_on_high_severity: true

Step 2: Running the HexStrike Security Workflow

File 2: security_scan_agent.py — LangGraph Recon Workflow

# security_scan_agent.py — Automated Security Reconnaissance Agent
from typing import TypedDict, List, Optional
from langgraph.graph import StateGraph, END
from langgraph.checkpoint.memory import MemorySaver

class ScanState(TypedDict):
    target: str
    scan_results: List[dict]
    risk_score: float
    report: str
    errors: List[str]

def initial_recon(state: ScanState) -> ScanState:
    """Phase 1: Passive OSINT gathering via theHarvester and whois."""
    state["scan_results"] = [
        {"tool": "theHarvester", "target": state["target"], "findings": ["3 subdomains", "2 email addresses"]},
        {"tool": "whois", "target": state["target"], "registrar": "Cloudflare, Inc."}
    ]
    return state

def network_scan(state: ScanState) -> ScanState:
    """Phase 2: Active network reconnaissance with Nmap."""
    state["scan_results"].append({
        "tool": "nmap",
        "target": state["target"],
        "open_ports": [22, 80, 443, 8080, 8443],
        "services": ["SSH", "HTTP", "HTTPS", "HTTP-Proxy", "HTTPS-Alt"],
        "os_detection": "Linux 5.x"
    })
    return state

def web_application_scan(state: ScanState) -> ScanState:
    """Phase 3: Web vulnerability scanning with nuclei and nikto."""
    state["scan_results"].append({
        "tool": "nuclei",
        "target": f"https://{state['target']}",
        "vulnerabilities": [
            {"id": "CVE-2026-1234", "severity": "high", "endpoint": "/api/v1/admin"},
            {"id": "CVE-2026-5678", "severity": "critical", "endpoint": "/graphql"}
        ]
    })
    return state

def assess_risk(state: ScanState) -> ScanState:
    """Phase 4: Calculate aggregate risk score and generate report."""
    state["risk_score"] = 8.5  # Out of 10
    state["report"] = (
        f"## Security Assessment: {state['target']}

"
        f"**Overall Risk Score: 8.5/10 (High)**

"
        f"### Findings Summary
"
        f"- 5 open ports detected (22, 80, 443, 8080, 8443)
"
        f"- 2 critical vulnerabilities found:
"
        f"  - CVE-2026-1234: Admin API exposed without authentication
"
        f"  - CVE-2026-5678: GraphQL introspection enabled
"
        f"- 3 subdomains discovered via passive recon
"
        f"- Operating system: Linux 5.x

"
        f"### Recommended Actions
"
        f"1. Restrict port 8080 to internal network only
"
        f"2. Implement authentication on /api/v1/admin
"
        f"3. Disable GraphQL introspection in production
"
    )
    return state

# Build LangGraph workflow
workflow = StateGraph(ScanState)
workflow.add_node("initial_recon", initial_recon)
workflow.add_node("network_scan", network_scan)
workflow.add_node("web_application_scan", web_application_scan)
workflow.add_node("assess_risk", assess_risk)

workflow.set_entry_point("initial_recon")
workflow.add_edge("initial_recon", "network_scan")
workflow.add_edge("network_scan", "web_application_scan")
workflow.add_edge("web_application_scan", "assess_risk")
workflow.add_edge("assess_risk", END)

app = workflow.compile(checkpointer=MemorySaver())

Step 3: Production Deployment

# Start HexStrike MCP server
export HEXSTRIKE_HMAC_KEY="your-384-bit-key-here"
python -m hexstrike_mcp --config hexstrike_config.yaml

# In Claude Desktop, add to mcp_servers config:
# {
#   "hexstrike": {
#     "command": "python",
#     "args": ["-m", "hexstrike_mcp", "--config", "hexstrike_config.yaml"]
#   }
# }

Production Reality Check: Security & Failure Modes

• Sandbox Escape Vectors: The Docker microVM sandbox uses a minimal Ubuntu base with all non-essential kernel modules removed. However, Metasploit's post/multi/manage/shell_to_meterpreter can attempt to create raw sockets. Mitigate by running containers with --cap-drop=ALL --cap-add=NET_RAW and seccomp profiles that block clone(CLONE_NEWNS).
• Rate Limiting Bypass: An agent that rapidly calls low-tier tools (100+ Nmap scans per minute) can trigger IDS/IPS alerts at the target. HexStrike's rate limiter uses a sliding window counter per target IP with configurable thresholds.
• Audit Log Bloat: Full tool output logging can generate 500MB+ per extensive scan session. Enable compressed storage with audit.compression: gzip and set audit.output_truncation: 10000 to limit stored characters per tool call.
• HMAC Key Rotation: The audit HMAC key must be rotated every 30 days. HexStrike supports Kubernetes Secret watcher integration for automatic rotation without server restart.
• False Positive Injection: AI agents naturally amplify confidence in tool outputs. Always include a confidence_score field in tool schemas and instruct the LLM to qualify findings by confidence level in reports.

Integration with Existing Security Tools

HexStrike's MCP interface makes it compatible with any MCP server director configuration. For continuous security monitoring, deploy alongside the MCP Scanner for automated vulnerability detection across your infrastructure. The combined pipeline provides both reconnaissance and passive vulnerability scanning through a unified agent interface.

Conclusion

HexStrike AI represents a watershed moment for AI-powered cybersecurity. By unifying 150+ security tools behind a single MCP server with sandbox isolation, tiered authorization, and cryptographic audit trails, it enables security teams to automate reconnaissance, vulnerability assessment, and bug bounty hunting without compromising safety. The 11,595 GitHub stars and rapidly growing community attest to its utility.

For deeper integration patterns and custom tool development, explore our AI Workflows directory and the latest AI news on evolving security agent architectures.

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Last tested & verified: September 2026 with Python 3.12, HexStrike v1.2.0, Docker 27.x, MCP protocol 2026-07-28.