NEW

Start with the pressure: sales, launch, abuse, agents, data, or guardrails

Use the engagement router
aisecurityllc
Sign inScope a Launch Review
aisecurityllc
Scope a Launch Review
All integrations

Connectors · Security Tools

MSF

Evidence Connector for Metasploit

Fingerprint AI infrastructure from within Metasploit.

Local firstRegistry mappingmetasploit moduleattackevidence
Start No-Cost ScopingBack to integrations

Screenshots coming soon

Visual walkthrough of Evidence Connector for Metasploit in progress

Overview

The SecEng Evidence Connector for Metasploit provides auxiliary scanner modules that detect and fingerprint AI services on a network — Ollama endpoints, OpenAI-compatible APIs, MCP servers, and similar infrastructure. Findings are reported to the SecEng sidecar and can be attached to your AI asset inventory and risk program. Modules are pure Ruby and drop into the standard Metasploit module path.

Features

  1. 01.

    AI service fingerprinting

    Scans target networks for known AI API signatures — Ollama, LiteLLM, OpenAI-compatible servers, and MCP endpoints.

  2. 02.

    Standard module path install

    Copy modules to `~/.msf4/modules/auxiliary/scanner/ai/` — no Metasploit patches or rebuilds required.

  3. 03.

    Evidence reporting

    Discovered services are reported to the SecEng sidecar with IP, port, service type, and version for inclusion in AI asset inventories.

  4. 04.

    RHOSTS-compatible

    Accepts standard Metasploit RHOSTS, RPORT, and THREADS options for bulk network scanning.

Install steps

  1. Step 01

    Copy modules: `cp -r apps/metasploit-evidence-connector/modules/auxiliary/scanner/ai ~/.msf4/modules/auxiliary/scanner/`.

  2. Step 02

    Launch msfconsole: `msfconsole`.

  3. Step 03

    Load a module: `use auxiliary/scanner/ai/ollama_info`, then `set RHOSTS <target>` and `run`.

  4. Step 04

    Ensure the SecEng sidecar is running on `http://127.0.0.1:17371` to receive findings.

Capabilities

discover servicereport findingattach evidenceexport json

Surfaces

auxiliary modulepanel

Scan modes

service_discoveryfile

Privacy architecture

Local first

Designed to keep the supported flow in the local or customer-controlled environment. What leaves the device or workspace depends on the feature and configuration.

Target manifest format:metasploit moduleMapped, not yet built.

Platform vendor

Rapid7

Rapid7's metasploit module format is mapped in the registry. The connector itself is not yet built.

WebsiteDeveloper docsMarketplaceGitHubTwitter / X

Early access

Get the integration on the roadmap

Tell us which platform matters most and we'll prioritize it where it fits the current product surface.

Start No-Cost ScopingBrowse all integrations