Rapid7

What it is

Metasploit Framework 6.5 (Rapid7) adds two operationally distinct capabilities: Malleable C2 profile support for all current Meterpreter payloads, and the Metasploit MCP Server (msfmcpd), a middleware layer exposing 16 Model Context Protocol tools to AI clients like Claude or Cursor. The summary states these exist; what follows is the configuration and safety detail an operator needs before enabling either.

How it works

Malleable C2: Select a compatible Meterpreter payload, then point the MALLEABLEC2 option at a profile file on disk (e.g. set MALLEABLEC2 amazon.profile). Profile syntax matches other tools, so publicly available profiles load directly — though the page notes "not all of the directives are currently in use."

MCP tools split into two classes:

• 12 read-only tools — enabled by default; module search, host/service queries, stored-credential retrieval, job/session monitoring. State-non-modifying, intended for locked-down environments where AI autonomy is barred.
• 4 dangerous tools — disabled by default; module execution (msf_module_execute), module checks (msf_module_check), stopping sessions, and writing to interactive sessions (msf_session_write).

Preconditions / Affected

Timing matters for Malleable C2: staged payloads only apply the profile after the stage loads (size restrictions); stageless payloads apply it immediately. If you need the initial download shaped, use a stageless payload.

The dangerous MCP tools do nothing until an operator explicitly turns them on.

What to do

Start the MCP server inside msfconsole:

msf > load mcp
msf > mcp --help
msf > mcp start

Or run the msfmcpd binary directly.

To permit AI-driven exploitation, dangerous tools must be enabled by one of three means: the CLI flag --enable-dangerous-actions, an environment variable, or a config key. Conversely, to keep an AI agent read-only, do nothing — the default posture blocks all four offensive tools. This is the setting to verify before pointing an LLM at production infrastructure.

Caveats

The "human-in-the-loop" gate is a configuration default, not an enforced control: any operator with the flag/env/config option can grant an LLM full msf_module_execute and msf_session_write access. Treat the dangerous-tools toggle as a real privilege boundary and audit who can set it. Note also that not all Malleable C2 profile directives are honored yet, so imported profiles may not shape traffic exactly as they do in the tools they were written for.