Imagine that instead of assembling the next commands in a terminal you write to an assistant: “Recon this network, check open ports and suggest next steps.” The system picks the tools, reads the output and proposes what to do next.
That setup — Kali Linux, a language model and MCP — has stopped being a future fantasy. You can assemble it locally or on a controlled VPS. You can also assemble it badly: no scope, no consent, a model that launches a scanner because “the user said so”.
This note covers the architecture, what it actually buys you, and when you are allowed to use it. It is not an attack tutorial. There are no payloads, ready-made exploit chains, or instructions for “how to bypass someone else’s host”.
Did you know? An assistant that “runs nmap” with no scope and no consent is not recon. It is illegal scanning of someone else’s network — whether a human typed the command or a model did.
What this stack does not do
The title is a lie if you read it literally.
The model has no authorization. It does not understand your contract. It will not tell a lab from production unless you tell it. It will not carry criminal liability. The operator will.
Without skill you get: a noisy scan, fake “findings”, tools fired outside scope. With skill you get: shorter enumeration, less fighting with syntax, more time to decide whether the result means anything.
AI does not replace pentesting. It speeds up stages. It moves the bottleneck that is the human.
What the stack is
Three layers:
- Kali Linux — locally or on a VPS. The usual test toolkit (scanning, enumeration, exploit frameworks, among others). The OS itself does not “hack”. It ships binaries.
- An AI model — locally or on a rented GPU (e.g. Vast.ai by the hour). Some people pick weaker-censored variants because hard-safety models refuse even questions about an authorized test. That is not proof the model is better. It is less willing to say “no”. Refusal is sometimes a brake, not a bug.
- MCP (Model Context Protocol) — the layer that attaches specific tools to the model. The assistant does not “have Kali”. It has a list of calls someone exposed earlier, and it gets the result back for analysis.
Without MCP you still have a chat: you can paste output by hand. With MCP the model can run an agreed tool and come back with a log. The difference is operational, not magical.
Did you know? MCP does not open the model “to the whole root”. It opens as much as the operator attached. If you wire a scanner and Hydra to the public internet with no approval step — that is not the protocol’s fault. That is your scope.
What that means in practice
Inside a legal scope the setup can be useful because it:
- shortens routine work: recon, enumeration, a first pass over logs;
- takes some of the syntax off your hands, if you know which question to ask;
- can stay fully local or on your own VPS — that matters for material that must not land in a chat vendor’s cloud;
- model compute and the VRAM the model needs can be “bolted on” by the hour by renting a GPU, instead of buying a card “for keeps”.
It does not follow that a junior with a prompt will do a red team. It follows that someone who can read nmap and knows what not to touch spends less time rewriting flags.
If the result has to go into a report, the operator still has to: confirm the fact, separate the hypothesis, check that the tool was in scope. The model will happily write “critical RCE” when it got a timeout.
When a penetration test is legal
This is not a closing paragraph. Without it the rest of the text is an advert for a crime.
It is allowed when one of these holds:
- you have written consent from the owner of the system or network (a contract, a scope of work, a mail with an unambiguous range — not “a friend said you could”);
- you are testing your own infrastructure: your servers, applications, home or company network that you have the right to touch;
- you are in an authorized bug bounty and you stay inside the rules (hosts, test types, hours, data);
- you work on official labs and training platforms: Hack The Box, TryHackMe, PortSwigger Academy, your own labs, an isolated range;
- you have a red team / pentest contract with a written scope, exclusions, escalation rules and a time window.
In every other case, launching offensive tools against systems you are not authorized to touch is illegal. “It was only a scan” is not a defence. “The AI did it by itself” is not either.
If you are not sure the plan fits the law — stop. Better to clear the scope early than to explain logs later.
Did you know? Consent to “check the site” usually does not cover scanning a whole IP class, brute-forcing customer accounts, or testing production at peak hours. A scope that is not on paper does not exist.
How it is assembled (no attack recipe)
The usual variants:
- A local Kali box + the model on the same machine or on a rented GPU.
- A VPS with Kali + the model on a side you reach through a tunnel, not a public chat with history.
- A mix — tools on the VPS, inference on a GPU, the operator approves calls from their desk.
The piece that keeps this in check is the MCP server: it exposes selected tools to the model, logs the calls, and can require acceptance before anything starts. The operator stays in the loop. Autopilot with no approval is a conscious decision, not “how AI works”.
What this note will not include: concrete flags, a ready mcp.json for an offensive stack, a list of “run this on someone else’s host”. Architecture and a variant for a given environment is a conversation about hardware, scope, and what must not be wired in.
Summary
Kali + a model + MCP is a real direction: less syntax grinding, faster enumeration, the same duty to think.
This is not hacking without skill. It is a tool that burns skill faster — in both directions. With a scope it speeds up the work. Without a scope it speeds up a legal problem.
Technology is a layer. Legality and ethics are not an MCP plugin.
If you want to talk through a variant for your labs or a formal test (hardware, model, what the operator must approve, what not to expose) — write via contact. Describe the environment and the constraints. Without that there is no sensible architecture, only another prompt.