Network capture and custom wordlists

The default container can scan targets on its Docker network but cannot capture host interface traffic. On a Linux host, the separate capture profile opts in to host networking plus NET_RAW and NET_ADMIN for tcpdump:

docker compose --profile capture run --build --rm -T pentest-mcp-capture

That profile can observe the host network namespace and should be used only when the engagement allows packet capture. Docker Desktop does not provide the same host interface access. To use private wordlists without adding them to the image, attach a read-only host directory to a one-off run:

docker compose run --rm -T --volume /absolute/wordlists:/app/custom-wordlists:ro pentest-mcp

To enable reviewed, signed Nuclei HTTP templates in Compose, set MCP_NUCLEI_TEMPLATES_HOST_DIR in .env to an absolute host directory and use the opt-in override file. It mounts that directory read-only at /reviewed-nuclei:

docker compose -f docker-compose.yml -f docker-compose.nuclei.yml run --build --rm -T pentest-mcp

The Docker image installs:

• nmap, john, hashcat, gobuster, nikto, ffuf, hydra, sqlmap, tcpdump
• subfinder, httpx + httpx-toolkit alias, nuclei