Run Claude Code on Kali Linux for AI Pentesting

There are a lot of "Kali + Claude" tutorials floating around now, and almost all of them describe the same setup: Claude Desktop running on your Mac or Windows box, an MCP server sitting on a separate Kali host, and the two talking over SSH. It works, but it is a three-part contraption, and it means the AI never actually lives on the machine with the tools.

This guide takes the simpler path. Claude Code is Anthropic's command-line agent, and it installs and runs directly on Kali. You type in the same terminal you already use, it plans and runs tools on the box itself, and there is no desktop app and no MCP server to stand up. If you have already got Kali running — whether that is the VirtualBox image, a bootable USB with persistence, or a Raspberry Pi box — you are ten minutes from an AI assistant that drives your tools.

It earns its place rather than being a gimmick, with two caveats I come back to below: it makes mistakes and reports them as fact, and a careless skill install can hand an attacker your machine. Both are manageable once you know they are there.

Claude Code vs Claude Desktop + MCP: which one do you want?

Before you install anything, it is worth understanding the two ways people wire Claude into Kali, because they solve different problems and most articles only show you one of them.

Neither is "correct" — they are different shapes. If you like a chat window and do not mind running a client machine and an MCP server, the Kali team has written up that route on the official Kali blog, and it is a solid reference. If you want the AI on the machine with the tools and nothing else to maintain, Claude Code is the leaner choice, and it is what the rest of this guide covers.

What you'll need

Nothing exotic. If you already pentest on Kali you probably have all of it:

• A working Kali install. Claude Code's own requirements are modest — Debian 10+ (Kali is Debian-based), 4 GB+ RAM, and an x64 or ARM64 processor — so it runs fine in a VM, on bare metal, or on a Pi. New to Kali? Start with the VirtualBox image or a persistent USB.
• A paid Claude account. Claude Code needs a Pro, Max, Team, Enterprise, or Console (API) account. The free Claude.ai plan does not include Claude Code. Pro is the usual starting point; heavier use is where Max earns its keep.
• A target you are allowed to attack. This is not optional. Use a deliberately vulnerable lab machine, never a system you do not own or have written permission to test. More on that below.

Setting up a safe practice lab

You need something to point the tools at, and it must be a machine that exists specifically to be broken. The standard choices are all free:

• Metasploitable 2 — a Linux VM built to be riddled with holes. Perfect first target for recon and exploitation practice.
• DVWA (Damn Vulnerable Web Application) — a web app with tunable difficulty, ideal for the web-testing workflow later in this guide.
• Hack The Box / TryHackMe — hosted labs with explicit permission to attack the boxes they give you.

Run your lab target on an isolated host-only or internal network so nothing you do can leak onto your real LAN or the internet. A misfired scan that stays inside a host-only network is a lesson; the same scan hitting your neighbor's router is a crime.

Installing Claude Code on Kali

The native installer is one line and pulls no Node.js dependency — it drops a self-contained binary and wires up auto-updates. Open a terminal on Kali and run:

If ~/.local/bin is not already on your PATH, open a new terminal (or re-source your shell) so the claude command is found. Then confirm the install:

A version number means you are good. If you would rather manage it through your package manager, Anthropic also publishes signed apt repositories and an npm package — both documented in the official setup docs — but the native installer above is the least-fuss route on Kali.

Now log in. Start Claude Code from any directory and follow the browser prompt to authenticate with your paid account:

That is the whole install. You now have an AI agent sitting in your terminal that can read files, run commands, and reason about the output — no desktop app, no MCP server, nothing else to babysit.

How agent skills actually work

Out of the box, Claude Code is a capable generalist but it does not know your methodology. That is what skills are for. A skill is just a folder with a SKILL.md file inside it — plain-language instructions, plus optional scripts and reference files — that teaches the agent how to do one class of task well. When your request matches a skill's description, Claude pulls that playbook into context and follows it.

For pentesting, a good skill turns "poke at this box" into a disciplined process: reconnaissance first, then enumeration, then targeted testing, with the tool commands and the reporting format baked in. Instead of you remembering every nmap flag and every follow-up, the skill encodes the workflow and Claude executes it consistently.

Skills live in a skills directory that Claude Code reads on startup, and because they are just text and scripts, anyone can write and share them. That openness is the whole appeal — and, as the next section explains, the whole risk.

Installing pentest skills

There is a healthy pile of open-source pentest skills now. A few worth knowing about:

• x-glacier/kali-pentest — a broad Kali skill covering a large slice of the toolset, with scenario playbooks and human approval gates on high-risk actions.
• transilienceai/communitytools — a larger suite of skills, agents, and slash commands aimed at the full recon-to-reporting lifecycle.
• frendysanusi/claude-pentest-skills — web-application-focused testing skills for Claude Code.

Most install the same way: clone the repo into your Claude Code skills directory (or the path the project's README specifies), restart Claude Code so it re-reads the skills, and confirm the new capability shows up. Follow each project's own instructions — they differ on exact paths and any extra setup.

Vetting a skill before you install it

A skill is not a passive config file. It can carry shell scripts and Python that run inside your environment, with access to your files, your shell history, and any API keys or tokens sitting in your environment. A malicious one can steal credentials, quietly exfiltrate source code, or install a backdoor — and this is a real, measured problem, not a hypothetical.

In July 2026, researchers published "Cloak and Detonate," describing a technique they call SkillCloak that hides malicious behavior from the scanners meant to catch it. Across eight scanners and 1,613 real-world malicious skills, their self-extracting packing method bypassed every scanner more than 90% of the time — for example by stashing the payload in a directory the scanner skips, like .git/, and rebuilding it only when the agent runs. You cannot outsource this to an automated scan. You have to read the skill yourself.

The good news is that skills are text, and you already have the tools to read them. Before installing anything, clone it somewhere harmless and go through this checklist by hand:

• Read the SKILL.md first. Does it do what it claims? Watch for instructions that tell Claude to ignore its own safety rules, to run commands "without asking," or to send output anywhere off your machine.
• List every file in the repo, not just the Markdown. Malicious payloads hide in bundled .sh and .py files, not the friendly descriptor. Open them.
• Grep for anything that phones home. Search the whole skill for outbound network calls and for reads of your secrets:

• Reject path-traversal tricks. If any file path in the archive contains .. or starts with /, it is trying to write outside its own folder. Do not install it.
• Prefer first-party and well-reviewed sources. Anthropic's own skills and skills vendored from a repo you maintain carry far less risk than a fresh account with three stars.
• When in doubt, build it yourself. A pentest skill is a workflow written in plain English. If a skill makes you uneasy, ask Claude Code to write you an equivalent one from your own methodology — no third-party trust required.

Your first agent-run recon

With Claude Code installed and a skill loaded, point it at your lab target. The interaction is plain English — you describe the goal, and Claude picks the tool, builds the command, runs it, and reads the results back to you.

Notice what happened: you never typed an nmap flag. Claude chose -sV -p-, ran it, parsed the output, and proposed a logical next step. If you want to understand what it actually did — and you should — my Nmap tutorial walks through those exact flags so the AI is teaching you, not replacing you.

Chaining a full workflow

The payoff is chaining. Because Claude keeps the results of one step in context, it can carry them into the next without you copy-pasting IP addresses and ports between tools. A single instruction can walk the early phases of an engagement:

That "ask me before anything intrusive" is doing real work — it keeps a human in the loop at the exact moment it matters. For the web-app phase specifically, pairing this with a proxy is powerful; my Burp Suite tutorial covers the manual side, and the top 10 Kali tools guide is a good map of everything Claude might reach for.

Permission gates and the flag you never use

By default, Claude Code asks before it runs commands that change your system or reach out to the network. That approval prompt is your safety rail, and on a pentest box it is doing double duty: it stops both a bad AI decision and a runaway automated attack.

You will eventually hear about --dangerously-skip-permissions (often called "YOLO mode"), which turns those prompts off. The name is a warning, not a joke. An agent running without gates can delete files, rewrite configs, or fire off intrusive tools with no chance for you to say no — and if a malicious skill is in the mix, it removes the last thing standing between that skill and your machine.

What it's genuinely bad at

The demos make this look magic. It is not, and knowing the failure modes is what separates using it well from getting burned:

• It hallucinates. Claude will occasionally invent a tool flag, misread output, or confidently report a "vulnerability" that is a false positive. You still need to know enough to check its work — which is the real argument for learning the underlying tools, not skipping them.
• It has no real sense of scope. The model does not truly understand your engagement's rules of engagement. It will happily scan whatever IP you name. Keeping targets in-scope is your job, every time.
• It costs tokens, and pentesting is verbose. Long scans and big tool outputs eat context and usage fast. Heavy sessions are where a Max plan starts to make sense over Pro.
• It is a force multiplier, not a replacement. It makes a competent tester faster and a beginner's lab time more productive. It does not turn someone with no security knowledge into a pentester, and it will lead you astray if you cannot tell when it is wrong.

Legal and authorization

One more time, because automation raises the stakes: only test what you are allowed to test. An AI that can autonomously chain reconnaissance into exploitation is a different liability profile than running one command by hand — it can do more, faster, with less deliberate thought from you.

• Get authorization in writing before you touch any system you do not personally own, with the scope and the target list spelled out.
• Stay inside scope. Do not let a convenient AI suggestion pull you onto an out-of-scope host because it looked interesting.
• Never point it at live production you do not own — no "just a quick scan" of a site you happen to use. Practice on the vulnerable labs above.

Used inside those lines, Claude Code on Kali is a real upgrade to how you learn and work. Used outside them, it is evidence. Keep it in the lab.