Log inSubmit server
Darkmoon logo

Darkmoon

Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Darkmoon

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "darkmoon": {
      "command": "npx",
      "args": [
        "-y",
        "@darkmoon_ai/mcp-server"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @darkmoon_ai/mcp-server

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 18d ago.

Overview

Tools4

What Darkmoon lets your agent do. Expand a tool for its parameters.

Self-reported~83 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

7/7 checks healthy over the last 23d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 10d ago via OSV.dev · @darkmoon_ai/mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads409Package downloads in the last 30 days.
Last commit8d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed4Callable tools this server registers over MCP.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

From the project README

@darkmoon_ai/mcp-server

A Model Context Protocol server that lets an MCP client (Claude Desktop, Goose, Continue, LibreChat, ...) drive Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform.

Requires Darkmoon Pro

The Darkmoon engine and CLI are open source. This server talks to the Darkmoon Dashboard API, which is part of Darkmoon Pro and always self-hosted: there is no public hosted endpoint, so you supply the base URL of your own instance. It does not work against the open source CLI alone.

Tools

ToolDescription
run_pentestStart an autonomous pentest against one authorized target and return the run_id
get_run_statusReport running, completed, error or unknown for a run, from its run log
list_campaignsList campaigns visible to the dashboard user (read only)
get_findingsVulnerabilities and severity statistics for a campaign (read only)

Only run assessments against systems you own or are explicitly authorized in writing to test. Findings can include false positives and must be reviewed by a qualified human.

Configuration

VariableDescription
DARKMOON_BASE_URLBase URL of your Darkmoon Pro Dashboard API (required)
DARKMOON_USERNAME, DARKMOON_PASSWORDDashboard credentials; a JWT is requested on each call and never cached
DARKMOON_TOKENAlternative to username/password: a pre-issued JWT
DARKMOON_TIMEOUT_MSOptional per-request timeout, default 60000

Client configuration

Claude Desktop (claude_desktop_config.json), Continue and LibreChat use the same mcpServers shape:

config.json
{
  "mcpServers": {
    "darkmoon": {
      "command": "npx",
      "args": ["-y", "@darkmoon_ai/mcp-server"],
      "env": {
        "DARKMOON_BASE_URL": "https://darkmoon.example.internal",
        "DARKMOON_USERNAME": "your-dashboard-user",
        "DARKMOON_PASSWORD": "your-dashboard-password"
      }
    }
  }
}

Goose (~/.config/goose/config.yaml):

yaml
extensions:
  darkmoon:
    type: stdio
    enabled: true
    name: darkmoon
    cmd: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    envs:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Continue (.continue/mcpServers/darkmoon.yaml):

yaml
name: Darkmoon
version: 0.1.0
schema: v1
mcpServers:
  - name: darkmoon
    command: npx
    args: ["-y", "@darkmoon_ai/mcp-server"]
    env:
      DARKMOON_BASE_URL: https://darkmoon.example.internal
      DARKMOON_USERNAME: your-dashboard-user
      DARKMOON_PASSWORD: your-dashboard-password

Develop

Terminal
npm install
npm run build
npm test      # mocked Dashboard API, in-memory MCP client and a real stdio process

License

GPL-3.0-only, same as Darkmoon.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Darkmoon

Darkmoon is an MCP server that lets MCP clients drive a self-hosted Darkmoon Pro AI penetration-testing instance through its Dashboard API. It can start an authorized-target pentest, check run status, list dashboard-visible campaigns, and retrieve campaign findings and severity statistics. It requires Darkmoon Pro, not the open-source CLI alone.

The server can start an autonomous pentest, report a run’s status, list campaigns visible to the dashboard user, and retrieve vulnerabilities and severity statistics for a campaign. Its tools are run_pentest, get_run_status, list_campaigns, and get_findings.

Configure DARKMOON_BASE_URL with the base URL of your self-hosted Darkmoon Pro Dashboard API, then authenticate with DARKMOON_USERNAME and DARKMOON_PASSWORD or a pre-issued DARKMOON_TOKEN. DARKMOON_TIMEOUT_MS optionally sets the per-request timeout; the default is 60000 milliseconds.

Darkmoon requires a self-hosted Darkmoon Pro Dashboard API and does not work against the open-source CLI alone. There is no public hosted endpoint, so you must provide the base URL of your own instance.

Yes, run assessments only against systems you own or are explicitly authorized in writing to test. Findings may include false positives and should be reviewed by a qualified human.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDarkmoon AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/darkmoon?style=directory)](https://allmcps.com/mcp/darkmoon)
HTML Embed
<a href="https://allmcps.com/mcp/darkmoon"><img src="https://allmcps.com/api/badge/darkmoon?style=directory" alt="Darkmoon on AllMCPs" /></a>