Rapid7 released Metasploit Framework 6.5 on July 30, 2026, after nearly two years of development and 422 new modules. The update’s standout feature is an MCP server that lets AI tools like Claude or Cursor query pentest data—but by default, the AI can’t execute exploits, stop sessions, or write to interactive shells. Operators must flip a deliberate switch to hand over the keys.

The release also brings Malleable C2 profile support to Meterpreter payloads, new NTLM relay tricks, and expanded payload-delivery options. For the first time, AI assistants can help sift through reconnaissance results, enumerate services, and summarize engagement context—without being able to alter anything on the target network.

What’s New in Metasploit 6.5

The new msfmcpd service is a middleware layer that speaks the Model Context Protocol (MCP)—an emerging standard for connecting AI models to external tools. Rapid7’s implementation exposes 16 tools, divided into two classes:

  • Read-only (always on): Query modules, hosts, services, vulnerabilities, notes, credentials, loot, jobs, and sessions. An AI assistant can search for relevant exploit modules, pull up discovered assets, or summarize findings without touching the target.
  • Dangerous (gated, off by default): Execute modules, run vulnerability checks, stop sessions, and write data to interactive sessions. These four tools require the operator to enable “dangerous actions mode” via a CLI flag, environment variable, or config file.

Rapid7’s documentation currently describes only eight read-only tools, while the release announcement details all 16. Teams evaluating 6.5 should validate exactly what their build exposes before trusting the AI assistant with recon tasks.

Beyond the AI connector, Metasploit 6.5 adds:

  • Malleable C2 for Meterpreter payloads. Windows, Linux, Java, Python, and PHP Meterpreter stagers can now adopt Malleable C2 profiles—configuration files that reshape HTTP(S) traffic to mimic legitimate applications. That changes URI paths, headers, user agents, and other network fingerprints, making signature-based detection far less reliable.
  • HTTP(S) NTLM relaying. The framework gets an HTTP front end for NTLM relay attacks, plus an automated NTLMRelay2Self workflow that can coerce a machine account authentication and pivot to LDAP for privilege escalation using resource-based constrained delegation or shadow credentials.
  • Payload delivery refinements. New Fetch payloads support fileless Linux execution, a pipe option shortens command stagers, and a multi-architecture handler selects the right payload after the target reports its CPU type.
  • API hash randomization and ATT&CK metadata. 32-bit Windows API hashes used in Metasploit’s block API shellcode are now randomized per build, and modules are being tagged with MITRE ATT&CK technique IDs—helpful for defenders mapping framework activity to threat models.

Who This Matters To—And Why

The MCP server is a huge productivity boost for red teams that already use AI assistants during engagements. Imagine asking your assistant, “Show me all hosts with port 445 open that aren’t in the domain controller subnet,” or “Summarize the credentials we’ve dumped so far.” The assistant can comb through the Metasploit database without touching the target or risking an accidental exploit run. But that safety net depends entirely on the dangerous-actions gate remaining closed. If an operator enables it—perhaps to let the AI run a reconnection script or clean up sessions—they must trust the AI’s prompt exactly as they’d trust a junior team member with a shell.

For blue teams, the immediate concern is Malleable C2. A Meterpreter beacon that can change its HTTP signature on the fly breaks many network-detection rules. Defenders should lean on endpoint telemetry—process ancestry, unusual outbound connections, memory protections—rather than assuming a known URI pattern or user agent string means safety. The NTLM relay improvements are equally serious: if your organization still has NTLM enabled (and most do), an attacker who coerces a single machine authentication can often pivot to domain admin privileges. SMB signing, LDAP signing, and a hard look at which accounts can initiate outbound authentication should move up the priority list.

Administrators running Metasploit in-house for continuous security testing will need to treat msfmcpd like any other privileged service. Rate limiting is on by default (60 requests per minute, burstable to 10), and logging is off—so you’ll want to enable it with redaction of sensitive fields. The server runs over stdio by default but can switch to HTTP with a bearer token for remote access; if you disable authentication, any client on the network can query your pentest data.

The Road to AI-Assisted Pentesting

Metasploit’s MCP server lands at a moment when AI coding assistants have become routine for developers, but the security community has been cautious. Other red-team tools have experimented with natural-language query interfaces, but Rapid7 is the first major framework vendor to ship a production-grade MCP integration with an explicit safety model. The two-year gap since the previous major Metasploit release suggests the team spent significant time on that model—and on input validation, which strictly checks parameters before any RPC call reaches the framework.

This release also reflects a broader shift toward modular C2 evasion. Malleable C2 was pioneered by Cobalt Strike; Metasploit’s adoption means every Meterpreter operator now has access to the same traffic-shaping tricks. Combined with API hash randomization, it signals that Metasploit is actively making its payloads harder to fingerprint.

Your Move: Practical Steps for Operators and Defenders

If you’re running a penetration test with Metasploit 6.5:

  1. Start the MCP server only with read-only tools enabled. Use the default setup: ./msfmcpd, possibly with a config file and explicit credentials. Do not add --enable-dangerous-actions unless you have a concrete, scripted workflow where you trust the AI’s reasoning.
  2. Validate the exposed toolset. Check the actual list of tools your AI client sees against the documentation. If only the older eight-tool set appears, you may need a build update or explicit configuration.
  3. Test Malleable C2 profiles in isolation. Generate a profile that uses common legitimate CDN-like URIs and headers, then verify that your own detection stack misses it before you rely on it in an engagement.
  4. For NTLM relaying, stick to authorized targets. The NTLMRelay2Self technique is powerful but can easily cross the line from approved testing to unintended domain admin. Pair it with explicit, written authorization.

If you’re defending a network:

  1. Audit NTLM usage immediately. Identify where NTLM is still accepted—especially on domain controllers and high-value servers. Enforce SMB signing and LDAP signing, and consider disabling NTLM where Kerberos is viable.
  2. Monitor for anomalous authentication. A workstation that suddenly performs LDAP administration or initiates outbound SMB connections to multiple hosts deserves a second look. The new relay workflows make that behavior more common.
  3. Update network detection to focus on behavior, not signatures. With Malleable C2, looking for specific URI patterns or user agents is a losing game. Instead, alert on processes making outbound connections to the internet for the first time, especially if those processes are scripting engines or tools like PowerShell.
  4. Integrate ATT&CK metadata. Metasploit modules now carry ATT&CK IDs. Feed those into your SIEM or detection engineering pipeline to automatically map test activity to known techniques and refine your detection coverage.

What Comes Next

Expect other security frameworks to follow with their own MCP servers; the protocol is open and gaining traction. For Metasploit, the immediate question is how quickly the dangerous-actions toolset will mature and whether Rapid7 will add guardrails like a pre-execution approval prompt or session-scoped permissions. Defenders should also watch for AI-powered blue-team tooling that uses the same MCP interface to query threat intelligence or automate incident response—potentially from Rapid7 itself. For now, the 6.5 release gives operators a powerful new assistant, provided they keep it on a short leash.