Darkmoon

io.github.ASCIT31v0.1.0更新於 Oct 5, 2026

Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.

已驗證STDIO僅桌面Developer ToolsSecurity & Monitoring

概覽

AI 產生的概覽

讓助理操作自架的 Darkmoon Pro AI 滲透測試儀表板：啟動測試、查看狀態、列出行動並讀取發現。

功能
此 MCP 伺服器將助理連接到自架 Darkmoon Pro 執行個體的 Darkmoon Dashboard API。它提供四個工具：run_pentest 針對一個已授權目標啟動自主滲透測試並回傳 run_id；get_run_status 依執行日誌回報 running、completed、error 或 unknown；list_campaigns 列出儀表板使用者可見的行動；get_findings 回傳某個行動的弱點與嚴重性統計。兩個列表工具為唯讀。
適用情境
當你已經運行自架的 Darkmoon Pro 執行個體，並希望助理在聊天用戶端內發起已授權的滲透測試並檢視行動結果時使用。僅使用開源 Darkmoon CLI 時沒有用處，因為它只與 Pro Dashboard API 通訊。
執行需求
透過 stdio 在本機執行，通常使用 npx @darkmoon_ai/mcp-server，因此需要 Node.js。需要將自己的 Darkmoon Pro Dashboard API 基礎網址填入 DARKMOON_BASE_URL，並提供 DARKMOON_USERNAME 與 DARKMOON_PASSWORD，或在 DARKMOON_TOKEN 中提供預先簽發的 JWT。DARKMOON_TIMEOUT_MS 為選用項目。需要能連線到該自架端點；沒有公開的託管端點。
安裝前請注意
伺服器會在環境變數中保存儀表板認證或 JWT（DARKMOON_PASSWORD、DARKMOON_TOKEN），請保護好用戶端設定檔。run_pentest 會針對目標主動發起自主滲透測試，屬於侵入性操作：只能測試你擁有或已取得書面明確授權的系統。發現結果可能包含誤報，應由合格人員複核。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Darkmoon，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@darkmoon_ai/mcp-server

A Model Context Protocol server that lets an MCP client (Claude Desktop, Goose, Continue, LibreChat, ...) drive Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform.

Requires Darkmoon Pro

The Darkmoon engine and CLI are open source. This server talks to the Darkmoon Dashboard API, which is part of Darkmoon Pro and always self-hosted: there is no public hosted endpoint, so you supply the base URL of your own instance. It does not work against the open source CLI alone.

Tools

ToolDescription
run_pentestStart an autonomous pentest against one authorized target and return the run_id
get_run_statusReport running, completed, error or unknown for a run, from its run log
list_campaignsList campaigns visible to the dashboard user (read only)
get_findingsVulnerabilities and severity statistics for a campaign (read only)

Only run assessments against systems you own or are explicitly authorized in writing to test. Findings can include false positives and must be reviewed by a qualified human.

Configuration

VariableDescription
DARKMOON_BASE_URLBase URL of your Darkmoon Pro Dashboard API (required)
DARKMOON_USERNAME, DARKMOON_PASSWORDDashboard credentials; a JWT is requested on each call and never cached
DARKMOON_TOKENAlternative to username/password: a pre-issued JWT
DARKMOON_TIMEOUT_MSOptional per-request timeout, default 60000

Client configuration

Claude Desktop (claude_desktop_config.json), Continue and LibreChat use the same mcpServers shape:

json
{  "mcpServers": {    "darkmoon": {      "command": "npx",      "args": ["-y", "@darkmoon_ai/mcp-server"],      "env": {        "DARKMOON_BASE_URL": "https://darkmoon.example.internal",        "DARKMOON_USERNAME": "your-dashboard-user",        "DARKMOON_PASSWORD": "your-dashboard-password"      }    }  }}

Goose (~/.config/goose/config.yaml):

yaml
extensions:  darkmoon:    type: stdio    enabled: true    name: darkmoon    cmd: npx    args: ["-y", "@darkmoon_ai/mcp-server"]    envs:      DARKMOON_BASE_URL: https://darkmoon.example.internal      DARKMOON_USERNAME: your-dashboard-user      DARKMOON_PASSWORD: your-dashboard-password

Continue (.continue/mcpServers/darkmoon.yaml):

yaml
name: Darkmoonversion: 0.1.0schema: v1mcpServers:  - name: darkmoon    command: npx    args: ["-y", "@darkmoon_ai/mcp-server"]    env:      DARKMOON_BASE_URL: https://darkmoon.example.internal      DARKMOON_USERNAME: your-dashboard-user      DARKMOON_PASSWORD: your-dashboard-password

Develop

bash
npm installnpm run buildnpm test      # mocked Dashboard API, in-memory MCP client and a real stdio process

License

GPL-3.0-only, same as Darkmoon.

來源：README.md，提交 7d660cb

工具

0
工具後設資料尚未被收錄。

版本歷史

1
  1. v0.1.0最新Oct 5, 2026