Rapid7 has released Metasploit Framework 6.5, adding an MCP server intended to connect AI assistants to Metasploit data and workflows while placing explicit controls around actions that could alter a target environment. The release also brings Malleable C2 support to current Meterpreter payloads, expanded NTLM relaying, and new payload-delivery options.
As detailed in Rapid7’s release announcement, Framework 6.5 contains 422 new modules accumulated over roughly two years of development. For Windows administrators and penetration-testing teams, the practical change is that Metasploit can now expose reconnaissance results, module metadata, sessions, and other framework context to MCP-compatible AI clients such as Claude or Cursor.
The new
That split matters. Read-only access can let an AI assistant search modules, inspect discovered services, enumerate stored credentials, and summarize an existing engagement without granting it the ability to launch an exploit. Rapid7 says the four more consequential actions are disabled by default and require an operator to enable dangerous actions deliberately.
There is an early documentation wrinkle worth watching: Rapid7’s current MCP setup guide describes an eight-tool, read-only implementation and says active actions will arrive later. Organizations evaluating 6.5 should therefore validate the capabilities exposed by their exact Framework build rather than assuming every tool described in the release post is present or enabled.
For defenders, this makes superficial network signatures less reliable. A profile can change URI patterns, headers, user agents, and related HTTP behavior, so detections should lean more heavily on endpoint telemetry, unusual process ancestry, unexpected outbound connections, proxy logs, and behavioral correlation rather than a narrow list of known Meterpreter request patterns.
Rapid7 notes that staged payloads use the profile only after their second-stage code is loaded, while stageless payloads use the configuration immediately.
That is a notable enterprise risk because NTLM remains widely deployed despite its legacy status. Windows teams should review where NTLM is still permitted, enforce SMB signing where feasible, reduce unnecessary inbound authentication paths, and monitor LDAP and SMB authentication activity from workstations that normally would not administer directory services.
The release additionally randomizes 32-bit Windows API hashes used by Metasploit’s block API shellcode and begins tagging modules with MITRE ATT&CK metadata. The former further reduces the usefulness of static payload signatures; the latter should make it easier for defenders and authorized testers to map Framework modules to ATT&CK techniques.
For enterprises, Metasploit 6.5’s MCP server is the headline feature—but its safety model will matter more than its AI integration. Treat it as a local, access-controlled testing component, confirm its enabled toolset in the deployed build, and keep exploitation authority with an accountable operator.
The MCP server puts a gate in front of AI-driven testing
The new msfmcpd service is a middleware layer using the Model Context Protocol, a standard for giving AI applications structured access to external tools. Rapid7 says its release implementation exposes 16 tools, separating read-only functions from actions such as module execution, session interaction, and writing to an active Meterpreter session.That split matters. Read-only access can let an AI assistant search modules, inspect discovered services, enumerate stored credentials, and summarize an existing engagement without granting it the ability to launch an exploit. Rapid7 says the four more consequential actions are disabled by default and require an operator to enable dangerous actions deliberately.
There is an early documentation wrinkle worth watching: Rapid7’s current MCP setup guide describes an eight-tool, read-only implementation and says active actions will arrive later. Organizations evaluating 6.5 should therefore validate the capabilities exposed by their exact Framework build rather than assuming every tool described in the release post is present or enabled.
Meterpreter traffic can adopt Malleable C2 profiles
Metasploit 6.5 adds Malleable C2 profile support to current Windows, Java, Python, PHP, and Linux Meterpreter payloads. The feature lets authorized red teams alter the appearance of Meterpreter HTTP(S) traffic using a profile format already familiar to operators of other security tools.For defenders, this makes superficial network signatures less reliable. A profile can change URI patterns, headers, user agents, and related HTTP behavior, so detections should lean more heavily on endpoint telemetry, unusual process ancestry, unexpected outbound connections, proxy logs, and behavioral correlation rather than a narrow list of known Meterpreter request patterns.
Rapid7 notes that staged payloads use the profile only after their second-stage code is loaded, while stageless payloads use the configuration immediately.
NTLM relaying gains an HTTP front end
The release adds HTTP(S) as a second NTLM relay server option, alongside new modules that relay captured authentication to SMB or LDAP services. Rapid7 also introduced an automated NTLMRelay2Self workflow that can use a coerced machine authentication event to obtain an LDAP session in the machine account’s context, then pursue local privilege escalation through techniques such as resource-based constrained delegation or shadow credentials.That is a notable enterprise risk because NTLM remains widely deployed despite its legacy status. Windows teams should review where NTLM is still permitted, enforce SMB signing where feasible, reduce unnecessary inbound authentication paths, and monitor LDAP and SMB authentication activity from workstations that normally would not administer directory services.
Payload work targets constrained Linux footholds
Framework 6.5 also extends Fetch payloads with fileless Linux execution techniques, a pipe option that dramatically shortens initial command stagers, and a multi-architecture handler that can select an appropriate payload after a Linux target reports its architecture. Those changes are primarily relevant to command-injection testing, but they also reinforce the need for Linux monitoring that catches suspicious shell-to-network activity and memory-backed execution.The release additionally randomizes 32-bit Windows API hashes used by Metasploit’s block API shellcode and begins tagging modules with MITRE ATT&CK metadata. The former further reduces the usefulness of static payload signatures; the latter should make it easier for defenders and authorized testers to map Framework modules to ATT&CK techniques.
For enterprises, Metasploit 6.5’s MCP server is the headline feature—but its safety model will matter more than its AI integration. Treat it as a local, access-controlled testing component, confirm its enabled toolset in the deployed build, and keep exploitation authority with an accountable operator.
References
- Primary source: Rapid7
Published: 2026-07-30T14:30:55.749000+00:00
Metasploit Framework 6.5 Released
Metasploit Framework 6.5 launches with Malleable C2 profile support, new MCP server integration support for AI-tooling, NTLM relaying upgrades, and MITRE ATT&CK tagging to streamline threat emulationwww.rapid7.com - Related coverage: docs.metasploit.com
How to use Metasploit MCP Server | Metasploit Documentation Penetration Testing Software, Pen Testing Security
View Metasploit Framework Documentation
docs.metasploit.com
