Viper
by FunnyWolf
Viper is an open-source adversary-simulation platform that runs its own MCP server so an LLM agent can drive red-team operations across Windows, Linux, and macOS targets.
Point Claude Code at a running Viper MCP server
Start Worker/mcpserver.py on the Viper host, then set VIPER_MCP_SSE_URL to the printed SSE URL before installing the viper-redteam plugin.
About
Viper bundles the tooling a red team typically assembles from several separate frameworks — over 100 post-exploitation modules mapped to MITRE ATT&CK phases, pivoting and session management, anti-forensics and defense-evasion helpers, and team collaboration features — into one platform, positioning itself as an open alternative to commercial red-team suites. What sets it apart from most of those tools is a built-in LLM agent and an MCP server that runs directly on the Viper host.
A companion Claude Code plugin, viper-redteam, connects to that MCP server over SSE rather than requiring Viper to run locally: you start Worker/mcpserver.py on the Viper host, point the VIPER_MCP_SSE_URL environment variable at the URL it prints, and Claude Code picks up two operational agents — redteam-operator for reconnaissance and session sequencing, and threat-simulation-planner for validating and planning Metasploit module execution.
Key features
- 100+ post-exploitation modules mapped to MITRE ATT&CK phases
- Multi-platform target support: Windows, Linux, macOS
- Built-in LLM agent plus a native MCP server on the Viper host
- SSE-based remote MCP connection via the viper-redteam Claude Code plugin
- Pivot graph visualization and session/team collaboration features
- Python-based custom module development for extending coverage
Use cases
- Running authorized adversary-simulation exercises without a commercial Cobalt Strike-style license
- Letting an LLM agent sequence reconnaissance and post-exploitation steps through the built-in MCP server
- Validating and planning Metasploit module usage via the threat-simulation-planner agent before execution
- Coordinating a distributed red team across a pivot graph with centralized session management
Available tools
MCP server (SSE)
Runs on the Viper host via Worker/mcpserver.py, exposing an SSE endpoint that remote MCP clients connect to.
redteam-operator
Claude Code agent that handles end-to-end reconnaissance and operational sequencing against the connected Viper instance.
threat-simulation-planner
Claude Code agent that validates and plans Metasploit module execution before it runs.
Frequently asked questions
Do I need to run Viper locally to use this with Claude Code?
No — the viper-redteam plugin connects to a remote Viper MCP server over SSE using the VIPER_MCP_SSE_URL you configure; it doesn't try to install or start Viper on the client machine.
Is Viper intended for unauthorized attacks?
No — it's built for authorized adversary simulation and red-team assessments, the same category as Cobalt Strike or Metasploit, and should only be run against systems you're authorized to test.