Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@wifi-security-mcp-server Audit the WPA2-Enterprise security of our office network"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Wireless security assessment is one of the most fragmented disciplines in offensive security. WiFi auditing requires one set of tools, Bluetooth another, RF/SDR a third, IoT protocols yet another — and each domain has its own attack surface, its own vulnerabilities, its own compliance requirements. Today you run aircrack-ng for WPA, use Bettercap for BLE, fire up HackRF for SDR, consult different CVE databases for each chipset, reference NIST and PCI-DSS separately, and then spend hours manually correlating findings into a coherent assessment.
Traditional wireless security workflow:
audit WiFi networks -> aircrack-ng / Wireshark / Kismet
test Bluetooth security -> Bettercap / btlejack / Ubertooth
analyze RF signals -> HackRF / GNU Radio / GQRX
check NFC/RFID -> Proxmark3 / libnfc
assess cellular security -> srsRAN / OpenBTS
test IoT protocols -> Zigbee sniffer / Z-Wave tools / MQTT clients
look up wireless CVEs -> NVD / vendor advisories (manual search)
check compliance -> NIST / PCI-DSS / HIPAA docs (manual)
map to MITRE ATT&CK -> ATT&CK Navigator (manual mapping)
correlate everything -> copy-paste into a report
────────────────────────────────
Total: hours per assessment, most of it context-switching between toolswifi-security-mcp-server gives your AI agent 34 composite tools backed by 9 knowledge bases covering 139 individual capabilities via the Model Context Protocol. The agent analyzes networks, identifies vulnerabilities, maps attacks to MITRE ATT&CK, checks compliance, and generates actionable reports — in a single conversation.
With wifi-security-mcp-server:
You: "Audit the wireless security of our office network running WPA2-Enterprise"
Agent: -> scan_wifi_networks {encryption: "WPA2"}
-> analyze_wifi_security {encryption: "WPA2-Enterprise", authentication: "EAP-PEAP"}
-> find_wifi_attacks {target_type: "WPA2-Enterprise"}
-> detect_wireless_attack {attack_indicators: "deauth frames"}
-> audit_wireless_compliance {standard: "PCI-DSS", network_type: "WPA2-Enterprise"}
-> "Your WPA2-Enterprise network has 3 critical findings:
1. EAP-PEAP without certificate pinning — vulnerable to evil twin
with hostapd-mana (MITRE T1557.002)
2. No 802.11w (PMF) — susceptible to deauthentication attacks
(MITRE T1498.001)
3. PMKID hash extractable without client interaction — offline
cracking possible with hashcat mode 22000
PCI-DSS 4.0: 2 controls non-compliant (4.2.1, 11.2.1).
Recommended: migrate to WPA3-Enterprise with SAE, enable PMF,
deploy WIDS for rogue AP detection."Related MCP server: Wireshark MCP Server
Existing tools give you raw packet captures and protocol-specific analysis. wifi-security-mcp-server gives your AI agent the ability to reason across all wireless domains simultaneously with deep knowledge-base backing.
npx wifi-security-mcp-serverAll 34 tools work immediately. No API keys required — core functionality is knowledge-base driven.
git clone https://github.com/badchars/wifi-security-mcp-server.git
cd wifi-security-mcp-server
bun install# WiGLE — wardriving database for real-world WiFi network lookups
export WIGLE_API_KEY=your-key
# Kismet — live wireless intrusion detection
export KISMET_HOST=127.0.0.1 # Default: 127.0.0.1
export KISMET_PORT=2501 # Default: 2501
export KISMET_API_KEY=your-keyAll API keys are optional. Without them, you still get full access to all 34 tools powered by 9 built-in knowledge bases covering WiFi attacks, Bluetooth attacks, RF/SDR, NFC/RFID, cellular, IoT, hardware databases, CVE intelligence, and compliance frameworks.
# With npx
claude mcp add wifi-security-mcp-server -- npx wifi-security-mcp-server
# With local clone
claude mcp add wifi-security-mcp-server -- bun run /path/to/wifi-security-mcp-server/src/index.tsAdd to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"wifi-security": {
"command": "npx",
"args": ["-y", "wifi-security-mcp-server"],
"env": {
"WIGLE_API_KEY": "optional",
"KISMET_HOST": "optional",
"KISMET_PORT": "optional",
"KISMET_API_KEY": "optional"
}
}
}
}Same JSON config format. Point the command to npx wifi-security-mcp-server or your local installation path.
You: "What attacks are possible against a WPA3-SAE network and how do I test for them?"That's it. The agent looks up attacks, maps them to MITRE ATT&CK, recommends tools, and provides step-by-step methodology — all from built-in knowledge bases.
You: "Analyze the security of a WPA2-PSK network with WPS enabled"
Agent: -> analyze_wifi_security {encryption: "WPA2-PSK", features: ["WPS"]}
-> crack_wps {method: "pixie_dust"}
-> analyze_pmkid {capture_method: "hcxdumptool"}
-> find_wifi_attacks {target_type: "WPA2-PSK"}
-> "Critical vulnerabilities found in WPA2-PSK + WPS configuration:
1. WPS Pixie Dust Attack — PIN recoverable in seconds via
offline brute-force of E-S1/E-S2 nonces (Reaver + PixieWPS).
Gives full PSK recovery without client interaction.
2. PMKID Attack — first packet of 4-way handshake contains
PMKID hash, crackable offline with hashcat -m 22000.
No deauth needed, no client needed.
3. 4-Way Handshake Capture — EAPOL frames capturable with
airodump-ng + deauth, then offline dictionary attack.
Priority: Disable WPS immediately (highest risk), enforce
strong 20+ char PSK, consider migration to WPA3-SAE."You: "What are the security risks of our BLE-based access control system?"
Agent: -> scan_bluetooth {scan_type: "BLE"}
-> find_bluetooth_attacks {target_type: "BLE"}
-> analyze_ble {feature: "GATT", pairing_method: "JustWorks"}
-> "BLE access control system — 4 critical risks identified:
1. JustWorks Pairing — no MITM protection. Attacker can
intercept pairing with Ubertooth One (MITRE T1040).
2. GATT Characteristic Sniffing — unlock commands sent in
cleartext, replayable with gatttool (MITRE T1212).
3. BLE Relay/Replay Attack — relay legitimate unlock signal
using two devices + btlejack (MITRE T1557).
4. MAC Address Tracking — static BLE MAC enables occupant
tracking (MITRE T1592.002).
Recommended: enforce LE Secure Connections (LESC) with
Numeric Comparison, encrypt GATT characteristics, implement
rolling nonces for replay protection."You: "Assess the wireless security of our smart building IoT deployment"
Agent: -> scan_iot_wireless {protocols: ["Zigbee", "Z-Wave", "MQTT"]}
-> analyze_zigbee {network_key_type: "default"}
-> find_mousejack {vendor: "Logitech"}
-> analyze_wifi_security {encryption: "WPA2-PSK"}
-> "Smart building IoT wireless assessment — 5 findings:
1. Zigbee: Default trust center link key (ZigBeeAlliance09)
allows network join interception with KillerBee (CRITICAL)
2. MQTT: Broker on port 1883 without TLS — credentials
and sensor data transmitted in cleartext
3. Z-Wave: S0 security with known key exchange vulnerability
— recommend S2 upgrade
4. MouseJack: 3 Logitech Unifying receivers vulnerable to
keystroke injection (CVE-2016-10761)
5. WiFi: IoT devices on same VLAN as corporate — no
network segmentation
Priority remediation: MQTT TLS, Zigbee install codes,
IoT VLAN isolation, replace vulnerable Logitech receivers."You: "Check our hospital WiFi against HIPAA wireless requirements"
Agent: -> audit_wireless_compliance {standard: "HIPAA", network_type: "WPA2-Enterprise"}
-> analyze_medical_wireless {device_types: ["infusion_pump", "patient_monitor"]}
-> detect_wireless_attack {attack_indicators: "rogue_ap"}
-> "HIPAA Wireless Compliance Audit — 6 findings:
3 NON-COMPLIANT controls:
- 164.312(a)(1): No wireless IDS deployed for rogue AP detection
- 164.312(e)(1): Medical devices using WPA2-PSK (not Enterprise)
- 164.312(e)(2): No wireless traffic encryption audit logging
3 COMPLIANT controls:
- 164.310(a)(1): Physical AP locations documented
- 164.312(a)(2): 802.1X with RADIUS authentication
- 164.312(d): Certificate-based EAP-TLS for staff devices
Remediation plan: deploy WIDS (Kismet/AirMagnet), migrate
medical devices to WPA2-Enterprise with MAB, enable wireless
audit logging on WLAN controller."Tool | Description |
| Scan and analyze WiFi networks — discover SSIDs, channels, encryption types, signal strength, and security misconfigurations |
| Deep analysis of WiFi security configuration — encryption strength, authentication method, known weaknesses, attack surface |
| Find applicable attacks for a WiFi target — returns attack methodology, required tools, MITRE ATT&CK mapping, mitigations |
| Simulate and analyze evil twin AP attack scenarios — hostapd-mana configuration, captive portal, credential capture methodology |
| Analyze deauthentication attack vectors — 802.11w PMF status, deauth detection, countermeasures, WIDS integration |
| Analyze WPS cracking attack vectors — Pixie Dust, brute force, null PIN, default PIN generation, Reaver/Bully methodology |
| Analyze PMKID-based attack vectors — clientless WPA/WPA2 cracking via hcxdumptool + hashcat mode 22000 |
| Audit WiFi 6 (802.11ax) and WiFi 7 (802.11be) specific security features — OWE, SAE, Enhanced Open, Multi-Link Operation |
Tool | Description |
| Scan and analyze Bluetooth devices — BR/EDR classic and BLE discovery, service enumeration, pairing analysis |
| Find applicable Bluetooth attacks — BlueBorne, KNOB, BIAS, BLE relay, MITM, with tools and mitigations |
| Deep analysis of BLE security — GATT services, pairing methods, LE Secure Connections, characteristic encryption |
Tool | Description |
| Analyze RF signal security — frequency analysis, modulation identification, replay attack feasibility, SDR tool recommendations |
Tool | Description |
| Analyze NFC/RFID security — card type identification, access control weaknesses, cloning feasibility, Proxmark3 methodology |
Tool | Description |
| Analyze cellular network security — 2G/3G/4G/5G protocol weaknesses, IMSI catcher detection, fake base station analysis |
Tool | Description |
| Analyze Zigbee network security — trust center policy, network key management, KillerBee attack methodology |
| Scan IoT wireless protocols — Zigbee, Z-Wave, MQTT, LoRaWAN, CoAP discovery and vulnerability analysis |
| Analyze MouseJack wireless keyboard/mouse vulnerabilities — keystroke injection, unencrypted HID, vendor-specific bypasses |
Tool | Description |
| Analyze air-gap exfiltration techniques — electromagnetic, acoustic, thermal, optical covert channels and countermeasures |
| Analyze Ultra-Wideband (UWB) security — ranging manipulation, relay attacks on car key fobs and AirTags, distance fraud |
| Analyze WiFi Channel State Information (CSI) security — passive sensing, activity recognition, keystroke inference risks |
| Analyze Miracast/WiFi Display security — WFD session hijacking, screen capture, unauthorized display access |
| Analyze WiFi Direct (P2P) security — group owner negotiation attacks, WPS vulnerabilities in P2P, rogue group formation |
| Analyze drone RF security — control link hijacking, GPS spoofing, video downlink interception, counter-UAS techniques |
Tool | Description |
| Audit WLAN controller configuration — Cisco WLC, Aruba, Meraki security settings, rogue AP policies, RF management |
| Analyze captive portal security — bypass techniques, credential harvesting risks, network isolation, guest VLAN security |
| Analyze MAC address randomization — iOS/Android/Windows implementation differences, tracking resistance, fingerprinting bypasses |
| Analyze Hotspot 2.0 (Passpoint) security — ANQP, OSU, automatic network selection risks, EAP method analysis |
Tool | Description |
| Look up wireless-specific CVEs — WiFi chipset vulnerabilities, Bluetooth stack CVEs, driver exploits, firmware bugs |
| Look up wireless security hardware — WiFi adapters, Bluetooth sniffers, SDR devices, capabilities, chipset compatibility |
| Map wireless attacks to MITRE ATT&CK framework — technique IDs, tactic categories, detection strategies |
| Analyze medical device wireless security — infusion pumps, pacemakers, patient monitors, FDA guidance, HIPAA requirements |
Tool | Description |
| Detect wireless attacks in progress — deauth floods, evil twin, KARMA, rogue AP, BLE spoofing, RF jamming indicators |
| Audit wireless network against compliance frameworks — PCI-DSS 4.0, HIPAA, NIST 800-153, FedRAMP, ISO 27001 wireless controls |
Tool | Description |
| Export wireless security assessment report — findings, risk ratings, compliance status, remediation roadmap, executive summary |
# List all available tools
npx wifi-security-mcp-server --list
# Run any tool directly
npx wifi-security-mcp-server --tool scan_wifi_networks '{"encryption":"WPA2"}'
npx wifi-security-mcp-server --tool find_wifi_attacks '{"target_type":"WPA3-SAE"}'
npx wifi-security-mcp-server --tool analyze_ble '{"pairing_method":"JustWorks"}'
npx wifi-security-mcp-server --tool lookup_wireless_cve '{"keyword":"Broadcom WiFi"}'
npx wifi-security-mcp-server --tool audit_wireless_compliance '{"standard":"PCI-DSS"}'
npx wifi-security-mcp-server --tool analyze_zigbee '{"network_key_type":"default"}'
npx wifi-security-mcp-server --tool export_report '{"format":"json"}'The server ships with 9 built-in knowledge bases — no API keys, no external dependencies, no rate limits. Every tool query is enriched with structured intelligence from these databases.
Knowledge Base | Entries | What it provides |
WiFi Attacks | 47 attacks | WPA/WPA2/WPA3 attack techniques, evil twin variants, PMKID, KRACK, FragAttacks, deauth, WPS exploits — each with tools, mitigations, MITRE ATT&CK mapping |
Bluetooth Attacks | 8 attacks | BlueBorne, KNOB, BIAS, BLE relay, MITM, BLE fuzzing, Bluetooth impersonation — with CVEs and detection strategies |
RF/SDR Attacks | 6 attacks | Replay attacks, jamming, signal injection, SDR-based interception, RF fingerprinting bypass, spectrum analysis techniques |
NFC/RFID Attacks | 6 attacks | Card cloning, relay attacks, MIFARE Classic cracking, NFC skimming, RFID fuzzing, access control bypass with Proxmark3 |
Cellular Attacks | 6 attacks | IMSI catching, fake base station (Stingray), SS7 exploitation, 5G NAS vulnerabilities, downgrade attacks, VoLTE interception |
IoT Attacks | 6 attacks | Zigbee network key sniffing, Z-Wave S0 downgrade, MQTT credential harvesting, LoRaWAN ABP replay, MouseJack, BLE IoT relay |
Hardware Database | 12 devices | WiFi adapters (Alfa, TP-Link), Bluetooth sniffers (Ubertooth), SDR (HackRF, RTL-SDR), NFC (Proxmark3) — chipsets, capabilities, monitor mode support |
CVE Database | 17 CVEs | Wireless-specific CVEs for WiFi chipsets (Broadcom, Qualcomm, Intel), Bluetooth stacks, IoT firmware — severity, affected versions, exploit availability |
Compliance Frameworks | 5 frameworks | PCI-DSS 4.0, HIPAA, NIST SP 800-153, FedRAMP, ISO 27001 — wireless-specific controls, audit checklists, gap analysis |
src/
index.ts # CLI entrypoint (--help, --list, stdio server)
protocol/
mcp-server.ts # MCP server setup (stdio transport)
tools.ts # Tool registry — all 34 composite tools assembled here
types/
index.ts # Shared types (ToolDef, ToolContext, ToolResult)
knowledge/ # 9 built-in knowledge bases
wifi-attacks.ts # 47 WiFi attack definitions
bluetooth-attacks.ts # 8 Bluetooth attack definitions
rf-attacks.ts # 6 RF/SDR attack definitions
nfc-attacks.ts # 6 NFC/RFID attack definitions
cellular-attacks.ts # 6 Cellular/5G attack definitions
iot-attacks.ts # 6 IoT attack definitions
hardware.ts # 12 hardware device profiles
cve-database.ts # 17 wireless CVEs
compliance.ts # 5 compliance frameworks
wifi/ # WiFi Core tools (8)
bluetooth/ # Bluetooth tools (3)
rf/ # RF/SDR tools (1)
nfc/ # NFC/RFID tools (1)
cellular/ # Cellular/5G tools (1)
iot/ # IoT Wireless tools (3)
advanced/ # Advanced Wireless tools (6)
infrastructure/ # Infrastructure tools (4)
intelligence/ # Intelligence tools (4)
detection/ # Detection tools (2)
reporting/ # Reporting tools (1)Design decisions:
Knowledge-base driven — Unlike API-dependent tools, core functionality runs entirely offline from 9 built-in databases. No API keys, no rate limits, no external dependencies for the primary workflow.
34 composite tools, 139 individual capabilities — Each tool is a composite that bundles related analyses. find_wifi_attacks doesn't just list attacks — it returns methodology, required hardware, MITRE ATT&CK mapping, detection strategies, and countermeasures.
2 runtime dependencies — @modelcontextprotocol/sdk and zod. Nothing else. No native modules, no binary dependencies, no platform-specific code.
Optional live integration — WiGLE API for real-world network data, Kismet for live wireless IDS. Core analysis works without either.
Compliance-aware — Every finding is automatically mapped to relevant compliance frameworks (PCI-DSS, HIPAA, NIST, FedRAMP, ISO 27001) when applicable.
MITRE ATT&CK mapped — Attack techniques include ATT&CK technique IDs, tactic categories, and detection data sources for SOC integration.
Knowledge bases are point-in-time snapshots — new attacks/CVEs require package updates
WiGLE integration requires a free API key for network lookups
Kismet live WIDS requires a running Kismet instance with API access
No active wireless transmission — the server provides intelligence and methodology, not packet injection
Hardware database covers the most common security research devices, not exhaustive
Compliance frameworks focus on wireless-specific controls, not full framework coverage
macOS / Linux tested (Windows not tested)
Project | Domain | Tools |
Browser-based security testing | 39 tools, Firefox, injection testing | |
Cloud security (AWS/Azure/GCP) | 38 tools, 60+ checks | |
GitHub security posture | 39 tools, 45 checks | |
Vulnerability intelligence | 23 tools, 5 sources | |
OSINT & reconnaissance | 37 tools, 12 sources | |
Dark web & threat intelligence | 66 tools, 16 sources | |
wifi-security-mcp-server | Wireless security intelligence | 34 tools, 9 knowledge bases |
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/badchars/wifi-security-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server