MCP bridges for security tools

When it applies

You're setting up an agent-driven workflow and need CLI tools (nmap, nuclei, sqlmap, hashcat, gobuster, Metasploit…) callable as MCP tools instead of raw shell. This is infrastructure, not authorization: registering a tool over MCP never widens scope — tradecraft-scope-roe and scope.txt still gate every call. For Burp specifically, see tools-burp-suite; for attacking MCP servers themselves, ai-mcp-security.

Why it works

MCP wraps a tool's CLI behind typed tool definitions, so the agent gets structured parameters and output instead of scraping terminal text. A generic terminal bridge (mcp-kali-server) covers everything but is unstructured; per-tool servers give safer, typed interfaces at the cost of setup.

Options (pick one per need)