How rislan-moh-tm/crp-project- works
This is an AI-assisted penetration-testing framework: an operator uses Claude through MCP to launch Kali security tools, collect scan evidence, enrich findings with local CVE intelligence, and produce a report. Reconnaissance, vulnerability scanning, exploitation validation, CVE enrichment, and report generation are distinct documented stages. The sampled code supports the MCP/API job flow, RAG search, analysis context preparation, and report generation; source for the README-described quantitative evaluation is not present in the sampled files, so that capability is shown as documented rather than wired into the runtime flow.
Main entry points: mcp_server.py MCP server · kali_server.py Async job queue · rag.py RAG engine · README.md Report evaluation
Components 20
MCP orchestration
- MCP server
mcp_server.py - Kali API
kali_server.py - Async job queue
kali_server.py
Security assessment
- Reconnaissance
kali_server.py - Vulnerability scans
kali_server.py - Exploitation validation
kali_server.py - Scan history
kali_server.py - Raw scan results
mcp_server.py - Payload guidance
payload_loader.py
CVE intelligence
- RAG engine
rag.py - CVE records
rag.py - Vector index
rag.py
Analysis and reporting
- Evidence analysis
ai_analysis.py - Report generation
mcp_server.py - HTML template
html_report_template.html - Generated reports
mcp_server.py - Report evaluation
README.md
Other components
- Security operator
- Claude AI
- DeepSeek evaluator
Connections 23
- Security operator → Claude AI: requests assessment
- Claude AI → MCP server: invokes tools
- MCP server → Kali API: submits scans
- Kali API → Async job queue: queues jobs
- Async job queue → Reconnaissance: runs tools
- Async job queue → Vulnerability scans: runs tools
- Async job queue → Exploitation validation: runs tools
- MCP server → Kali API: polls jobs
- Async job queue → Scan history: persists history
- MCP server → Raw scan results: saves outputs
- MCP server → RAG engine: queries CVEs
- RAG engine → CVE records: reads records
- RAG engine → Vector index: semantic search
- MCP server → Evidence analysis: prepares context
- Evidence analysis → Claude AI: provides evidence
- Claude AI → MCP server: returns report content
- MCP server → Report generation: builds report
- Report generation → HTML template: renders with
- Report generation → Generated reports: writes reports
- Raw scan results → Report evaluation: compares outputs
- Generated reports → Report evaluation: compares reports
- Report evaluation → DeepSeek evaluator: uses evaluation
- Payload guidance → MCP server: supplies guidance