GHOSTCREW

What is GHOSTCREW?

GHOSTCREW is an AI red team assistant that uses large language models with MCP and RAG architecture. It runs on the command line (Python) and helps users perform penetration testing tasks, query security information, and analyze network traffic through natural language interaction.

How to use GHOSTCREW?

Clone the repository, create a Python virtual environment, install dependencies with pip install -r requirements.txt, and run python main.py. During startup, configure MCP servers via an interactive menu and optionally load a knowledge base. Then choose between interactive chat mode or automated penetration testing workflows.

Key features of GHOSTCREW

• Natural language interaction for queries and instructions
• MCP server integration via mcp.json configuration
• Interactive tool management with connect/clear options
• Automated pentesting workflows with structured phases
• Markdown report generation with findings and recommendations
• Multi-turn conversation history with streaming output
• Optional knowledge base enhancement (RAG)

Use cases of GHOSTCREW

• Perform penetration testing tasks using natural language commands
• Run automated reconnaissance, scanning, and exploitation workflows
• Analyze network traffic and security vulnerabilities
• Conduct web application security assessments
• Generate professional penetration test reports

FAQ from GHOSTCREW

What MCP servers does GHOSTCREW support?

GHOSTCREW supports integration with 18 security tools via MCP, including Nmap, Metasploit, FFUF, Nuclei, SQLMap, Hydra, and others, all configurable through the interactive menu.

Can I use GHOSTCREW without MCP servers?

Yes, GHOSTCREW can operate in chat mode without MCP tools, but automated pentesting workflows and tool invocation will not be available.

What are the prerequisites for MCP tools?

Most MCP security tools require Node.js and npm. For Metasploit, Python uv is also needed. Without these dependencies, automated workflows cannot function.

How do I configure MCP servers?

Select “Configure or connect MCP tools” during startup, then use the interactive menu to add, connect, or clear tools. Configurations are stored in the mcp.json file.

Are there any known limits?

Automated workflows require at least one configured and connected MCP security tool; the system blocks execution without proper tools to avoid simulated results.