# Caido MCP Server
A Model Context Protocol (MCP) server that acts as a bridge to [Caido](https://caido.io/), allowing AI Agents (like Claude, LangChain, etc.) to perform automated security testing and analysis.
## 🚀 Capabilities
This server connects to your local Caido instance (default port `8080`) and exposes tools to:
- **View Request History**: Analyze traffic captured by Caido proxy.
- **Send Requests**: Forge and send HTTP requests via Caido's engine.
- **Scan for Mitigation**: Run basic automated XSS/SQLi checks.
- **Get Findings**: Retrieve reported vulnerabilities.
See [MCP_CAPABILITIES.md](./MCP_CAPABILITIES.md) for a detailed power list.
## 🛠️ Setup
1. **Prerequisites**:
- Node.js installed.
- Caido running (usually on port 8080).
- Caido API Token (Settings -> API).
2. **Installation**:
```bash
git clone https://github.com/FazcomIA/mcp-caido.git
cd mcp-caido
npm install
```
3. **Configuration**:
Create a `.env` file in the root:
```env
CAIDO_URL=http://127.0.0.1:8080/graphql
CAIDO_API_TOKEN=your_token_here
MCP_PORT=3000
MCP_API_KEY=mcp-dev-key
```
## 🏃 Usage
Start the server:
```bash
node server.js
```
### Connect an AI Agent
The MCP server listens on `http://localhost:3000/mcp/call`.
Required Header: `X-API-Key: mcp-dev-key`
**Example Curl:**
```bash
curl -X POST http://localhost:3000/mcp/call \
-H "Content-Type: application/json" \
-H "X-API-Key: mcp-dev-key" \
-d '{"tool": "getStatus", "params": {}}'
```
## 🔒 Security
- **API Key**: Protected by `MCP_API_KEY`.
- **Local Only**: By default, runs locally. Be careful if exposing to a network.
