mcp server

darkmoon-mcp-server

Standalone MCP server for Darkmoon (@darkmoon_ai/mcp-server): run_pentest/get_run_status/list_campaigns/get_findings over stdio. Requires a Darkmoon Pro endpoint; engine+CLI are OSS (GPL-3.0).

ASCIT31/darkmoon-mcp-servercommunitylistedunreviewed

Use tool

Set up

Runs on your computer. Pick your agent and operating system.

Before you start

Node.js 20 or newer

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "darkmoon-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@darkmoon_ai/mcp-server"
      ],
      "env": {
        "DARKMOON_BASE_URL": "<your DARKMOON_BASE_URL>"
      }
    }
  }
}

same format Cursor, GitHub Copilot CLI, Junie, JetBrains AI Assistant, Augment (Auggie CLI), Factory Droid, Kiro, Devin CLI +12

Values in angle brackets are placeholders. Restart Claude Desktop after editing its config.Claude Desktop docs

README

synced Oct 17, 2026

@darkmoon_ai/mcp-server

A Model Context Protocol server that lets an MCP client (Claude Desktop, Goose, Continue, LibreChat, ...) drive Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform.

Requires Darkmoon Pro

The Darkmoon engine and CLI are open source. This server talks to the Darkmoon Dashboard API, which is part of Darkmoon Pro and always self-hosted: there is no public hosted endpoint, so you supply the base URL of your own instance. It does not work against the open source CLI alone.

Tools

Tool	Description
`run_pentest`	Start an autonomous pentest against one authorized target and return the `run_id`
`get_run_status`	Report `running`, `completed`, `error` or `unknown` for a run, from its run log
`list_campaigns`	List campaigns visible to the dashboard user (read only)
`get_findings`	Vulnerabilities and severity statistics for a campaign (read only)

Only run assessments against systems you own or are explicitly authorized in writing to test. Findings can include false positives and must be reviewed by a qualified human.

Configuration

Variable	Description
`DARKMOON_BASE_URL`	Base URL of your Darkmoon Pro Dashboard API (required)
`DARKMOON_USERNAME`, `DARKMOON_PASSWORD`	Dashboard credentials; a JWT is requested on each call and never cached
`DARKMOON_TOKEN`	Alternative to username/password: a pre-issued JWT
`DARKMOON_TIMEOUT_MS`	Optional per-request timeout, default 60000

Client configuration

Claude Desktop (claude_desktop_config.json), Continue and LibreChat use the same mcpServers shape:

{
  "mcpServers": {
    "darkmoon": {
      "command": "npx",
      "args": ["-y", "@darkmoon_ai/mcp-server"],
      "env": {
        "DARKMOON_BASE_URL": "https://darkmoon.example.internal",
        "DARKMOON_USERNAME": "your-dashboard-user",
        "DARKMOON_PASSWORD": "your-dashboard-password"
      }
    }
  }
}

Goose (~/.config/goose/config.yaml):

extensions:
  darkmoon:
    type: stdio
    enabled: true
    name: darkmoon
    cmd: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    envs:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Continue (.continue/mcpServers/darkmoon.yaml):

name: Darkmoon
version: 0.1.0
schema: v1
mcpServers:
  - name: darkmoon
    command: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    env:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Develop

npm install
npm run build
npm test      # mocked Dashboard API, in-memory MCP client and a real stdio process

License

GPL-3.0-only, same as Darkmoon.