About Darkmoon
Darkmoon is an MCP server that lets clients operate a self-hosted Darkmoon Pro dashboard for autonomous penetration testing. It supports authorized test runs and read-only access to campaign and finding data; it requires Darkmoon Pro, not just the open-source CLI.
Key features
- 01Start a penetration-test run
- 02Check run status
- 03List dashboard campaigns
- 04Read campaign findings and severity statistics
Use cases
- 01Start an authorized assessment of a target
- 02Check whether a test run has completed
- 03Review campaigns visible in the dashboard
- 04Inspect findings and severity statistics
MCP support
The MCP server exposes tools for starting and checking penetration tests and reading campaign and finding data. It connects to a user-supplied, self-hosted Darkmoon Pro Dashboard API.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y @darkmoon_ai/mcp-serverDARKMOON_BASE_URLBase URL of your self-hosted Darkmoon Pro Dashboard APIDARKMOON_USERNAMEDashboard userDARKMOON_PASSWORDSecretDashboard passwordDARKMOON_TOKENSecretPre-issued JWT, alternative to username/passwordLocal servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project README@darkmoon_ai/mcp-server
A Model Context Protocol server that lets an MCP client (Claude Desktop, Goose, Continue, LibreChat, ...) drive Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform.
Requires Darkmoon Pro
The Darkmoon engine and CLI are open source. This server talks to the Darkmoon Dashboard API, which is part of Darkmoon Pro and always self-hosted: there is no public hosted endpoint, so you supply the base URL of your own instance. It does not work against the open source CLI alone.
Tools
| Tool | Description |
|---|---|
run_pentest | Start an autonomous pentest against one authorized target and return the run_id |
get_run_status | Report running, completed, error or unknown for a run, from its run log |
list_campaigns | List campaigns visible to the dashboard user (read only) |
get_findings | Vulnerabilities and severity statistics for a campaign (read only) |
Only run assessments against systems you own or are explicitly authorized in writing to test. Findings can include false positives and must be reviewed by a qualified human.
Configuration
| Variable | Description |
|---|---|
DARKMOON_BASE_URL | Base URL of your Darkmoon Pro Dashboard API (required) |
DARKMOON_USERNAME, DARKMOON_PASSWORD | Dashboard credentials; a JWT is requested on each call and never cached |
DARKMOON_TOKEN | Alternative to username/password: a pre-issued JWT |
DARKMOON_TIMEOUT_MS | Optional per-request timeout, default 60000 |
Client configuration
Claude Desktop (claude_desktop_config.json), Continue and LibreChat use the same mcpServers shape:
{
"mcpServers": {
"darkmoon": {
"command": "npx",
"args": ["-y", "@darkmoon_ai/mcp-server"],
"env": {
"DARKMOON_BASE_URL": "https://darkmoon.example.internal",
"DARKMOON_USERNAME": "your-dashboard-user",
"DARKMOON_PASSWORD": "your-dashboard-password"
}
}
}
}
Goose (~/.config/goose/config.yaml):
extensions:
darkmoon:
type: stdio
enabled: true
name: darkmoon
cmd: npx
args: ["-y", "@darkmoon_ai/mcp-server"]
envs:
DARKMOON_BASE_URL: https://darkmoon.example.internal
DARKMOON_USERNAME: your-dashboard-user
DARKMOON_PASSWORD: your-dashboard-password
Continue (.continue/mcpServers/darkmoon.yaml):
name: Darkmoon
version: 0.1.0
schema: v1
mcpServers:
- name: darkmoon
command: npx
args: ["-y", "@darkmoon_ai/mcp-server"]
env:
DARKMOON_BASE_URL: https://darkmoon.example.internal
DARKMOON_USERNAME: your-dashboard-user
DARKMOON_PASSWORD: your-dashboard-password
Develop
npm install
npm run build
npm test # mocked Dashboard API, in-memory MCP client and a real stdio process
License
GPL-3.0-only, same as Darkmoon.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.