Rapid7 Releases Metasploit Framework 6.5
Rapid7 released Metasploit Framework 6.5 on July 30 with 422 modules added over two years, Malleable C2 profiles for current Meterpreter payloads and a Model Context Protocol server. Rapid7's release and versioned documentation say the server exposes 16 tools: 12 read-only by default and four state-changing tools disabled unless an operator explicitly enables dangerous actions.
Rapid7 released Metasploit Framework 6.5 on July 30, adding 422 modules developed over two years, Malleable C2 support for current Meterpreter payloads and a Model Context Protocol server for AI-assisted security workflows.
According to Rapid7's release post, Malleable C2 profiles alter the shape of Meterpreter HTTP(S) traffic. Current Windows, Java, Python, PHP and Linux Meterpreter payloads support the feature. Operators select a profile through the MALLEABLEC2 option; staged payloads apply it after the stage loads, while stageless payloads use it immediately. Rapid7 demonstrates a profile configured to resemble Amazon browsing traffic.
MCP access and action controls
Metasploit 6.5 introduces msfmcpd, a middleware service that exposes framework data and actions to MCP-compatible clients such as Claude, Cursor or custom agents. Rapid7's release and its documentation at the 6.5.0 tag describe 16 standardized tools.
Twelve tools are read-only by default. They let a client search modules and query hosts, services, vulnerabilities, notes, credentials, loot, running jobs and sessions without changing a target environment. Four higher-consequence tools are gated and disabled by default: module execution, module checks, stopping sessions and writing to interactive sessions such as Meterpreter. An operator must deliberately enable those actions through a command-line flag, environment variable or configuration setting.
That distinction is operationally important. An assistant that retrieves module information or summarizes an engagement has a different risk profile from one authorized to execute a module or interact with a live session. Teams evaluating the integration should validate the enabled tool set, database access and dangerous-action configuration in their deployed build.
Defender implications
Malleable C2 support gives authorized penetration testers a way to make Meterpreter HTTP(S) communications follow selected traffic profiles. In adversary-emulation environments, traffic shaping can reduce the value of simple network signatures and increase the importance of endpoint telemetry, proxy analysis, behavioral detections and correlation between process and network activity.
The framework remains an open-source penetration-testing tool used for authorized security assessment. Its 6.5 additions are therefore relevant to both red-team operations and defensive validation. Security teams can use the release to test whether controls distinguish benign-looking HTTP(S) traffic from suspicious endpoint behavior and whether AI integrations preserve accountable approval gates before actions change a target environment.
Key Points
- 1Metasploit Framework 6.5 adds 422 modules and Malleable C2 support across current Meterpreter payloads.
- 2Rapid7 documents 16 MCP tools: 12 read-only tools enabled by default and four state-changing tools behind an explicit dangerous-actions gate.
- 3Traffic shaping and AI-assisted operation increase the importance of behavioral telemetry, build-specific configuration checks and accountable execution approval.
Scoring Rationale
Metasploit is widely used for penetration testing and security validation, making its new payload and traffic-shaping capabilities operationally relevant. The MCP integration also gives practitioners a concrete, documented example of separating read-only AI access from explicitly gated state-changing actions.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
