Skip to content

CHANGELOG.md

Latest commit

 

History

History
99 lines (80 loc) · 4.34 KB

CHANGELOG.md

File metadata and controls

99 lines (80 loc) · 4.34 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[3.1.0] - 2026-07-31

Feature parity with the official Rapid7 MCP server, plus modern MCP-protocol capabilities. See docs/MCP_API.md for the full tool/resource reference and MCP specification conformance.

Added

  • Workspace database intelligence (read-only): list_hosts, list_services, list_vulnerabilities, list_notes, list_credentials, list_loot — expose the Metasploit workspace database, scoped by workspace, degrading gracefully to a structured error when no database is attached.
  • check_vulnerability: runs a module's non-destructive check (never fires the exploit, delivers a payload, or opens a session), mapping the outcome to a structured state (vulnerable / safe / unsupported / unknown).
  • get_module_results: retrieves status/output for an asynchronously launched module by its execution UUID.
  • Tool annotations: every tool advertises MCP hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint).
  • MCP resources: msf://server/info (identity, safety posture, tool taxonomy) and msf://module/{module} (module documentation).
  • Elicitation confirmation (opt-in): --confirm-dangerous / MSF_MCP_CONFIRM_DANGEROUS asks the client to confirm destructive actions, falling back to the safety gate when the client cannot elicit.

Security / Safety

  • Opt-in safe mode (dangerous actions ENABLED by default): state-changing tools (exploit/module execution, payload generation, session control, listeners/jobs) remain available by default so existing users are not regressed. Harden a deployment with --safe-mode / MSF_MCP_ALLOW_DANGEROUS=false to expose read-only tools only. This intentionally inverts the official Rapid7 server's default-off posture.
  • Optional rate limiting: off by default; enable with --rate-limit / MSF_MCP_RATE_LIMIT. health_check reports the safety posture.
  • Optional elicitation confirmation: --confirm-dangerous.

Changed

  • health_check now reports database_connected and the safety posture.
  • Evaluated the FastMCP 3.x upgrade: cap retained at <3.4.0 (3.4.x fails to import; 3.3.x is used and verified). Fixed the stale in-package __version__.

[3.0.1] - 2026-07-31

First release published to PyPI (pip install metasploit-mcp).

Security

  • Guard against console command injection via module options (CVE-2026-5463 / GHSA-qpc3-8vqg-8g6w in pymetasploit3, unpatched upstream): reject newline, carriage-return, and NUL characters in module/payload option names and values across both the RPC and console execution paths, so a value like RHOSTS=10.0.0.1\nsessions -K can no longer inject extra console commands.
  • Bump mcp to >=1.28.1 to clear three high-severity advisories (GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, GHSA-hvrp-rf83-w775).

Added

  • CI quality gates (packaging build + twine check, black --check, advisory mypy) and an SBOM freshness check; the release now attaches sbom.json.

Changed

  • Marked the package unofficial with an explicit no-affiliation-with-Rapid7 notice; credited upstream author GH05TCREW; owner references updated to setuidloot.

[3.0.0] - 2026-04-29

Highlights

  • Modern src layout - Proper Python package structure with src/metasploit_mcp/
  • Improved CLI - New metasploit-mcp command-line entry point
  • Public release - Documentation and project structure finalized

Breaking Changes

  • Package restructured to src/metasploit_mcp/
  • Entry point: use metasploit-mcp CLI command or from metasploit_mcp import ...
  • Scripts consolidated in scripts/ directory

[2.0.0]

Major rewrite:

  • Poetry dependency management (replaced requirements.txt)
  • FastMCP HTTP transport (replaced SSE)
  • Intelligent payload/module option detection
  • Port availability checking
  • Comprehensive test suite (92+ tests)
  • Metasploitable 3 test harness
  • Per-session locking for concurrent access safety

[1.0.0]

Initial MCP server implementation:

  • Core Metasploit RPC integration
  • Exploit, payload, and session management
  • Console command execution
  • Background job management