diff --git a/scripts/setup.ps1 b/scripts/setup.ps1
index d9579d3..4ea127c 100644
--- a/scripts/setup.ps1
+++ b/scripts/setup.ps1
@@ -106,6 +106,38 @@ if (Test-Path -Path $hexReq) {
     }
 }
 
+# Attempt to vendor MetasploitMCP via bundled script if not already present
+$msDir = Join-Path -Path (Get-Location) -ChildPath "third_party/MetasploitMCP"
+$addScript = Join-Path -Path (Get-Location) -ChildPath "scripts/add_metasploit_subtree.sh"
+if (-not (Test-Path -Path $msDir) -and (Test-Path -Path $addScript)) {
+    Write-Host "Vendoring MetasploitMCP into third_party (requires bash)..."
+    if (Get-Command bash -ErrorAction SilentlyContinue) {
+        try {
+            & bash -c "scripts/add_metasploit_subtree.sh"
+        } catch {
+            Write-Host "Warning: Failed to vendor MetasploitMCP via bash: $($_.Exception.Message)" -ForegroundColor Yellow
+        }
+    } else {
+        Write-Host "Warning: 'bash' not available; please run scripts/add_metasploit_subtree.sh manually." -ForegroundColor Yellow
+    }
+}
+
+# Install vendored MetasploitMCP dependencies automatically if present
+$msReq = Join-Path -Path (Get-Location) -ChildPath "third_party/MetasploitMCP/requirements.txt"
+$installMsScript = Join-Path -Path (Get-Location) -ChildPath "scripts/install_metasploit_deps.sh"
+if (Test-Path -Path $msReq) {
+    Write-Host "Installing vendored MetasploitMCP dependencies..."
+    if (Test-Path -Path $installMsScript -and (Get-Command bash -ErrorAction SilentlyContinue)) {
+        try {
+            & bash -c "scripts/install_metasploit_deps.sh"
+        } catch {
+            Write-Host "Warning: Failed to install MetasploitMCP deps via bash: $($_.Exception.Message)" -ForegroundColor Yellow
+        }
+    } else {
+        Write-Host "Warning: Could not run install script automatically; run scripts/install_metasploit_deps.sh manually." -ForegroundColor Yellow
+    }
+}
+
 Write-Host ""
 Write-Host "Setup complete!"
 Write-Host ""
diff --git a/scripts/setup.sh b/scripts/setup.sh
index 8db4414..c0c4091 100644
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -104,10 +104,16 @@ if [ -f "third_party/hexstrike/requirements.txt" ]; then
     bash scripts/install_hexstrike_deps.sh
 fi
 
+# Vendor MetasploitMCP via git-subtree if not already vendored
+if [ ! -d "third_party/MetasploitMCP" ] && [ -f "scripts/add_metasploit_subtree.sh" ]; then
+    echo "Vendoring MetasploitMCP into third_party..."
+    bash scripts/add_metasploit_subtree.sh || echo "Warning: failed to vendor MetasploitMCP; you can run scripts/add_metasploit_subtree.sh manually."
+fi
+
 # Install vendored MetasploitMCP dependencies automatically if present
 if [ -f "third_party/MetasploitMCP/requirements.txt" ]; then
     echo "Installing vendored MetasploitMCP dependencies..."
-    bash scripts/install_metasploit_deps.sh
+    bash scripts/install_metasploit_deps.sh || echo "Warning: failed to install MetasploitMCP dependencies."
 fi
 
 echo ""