Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Hashcat MCP Server crack this hash: 482c811da5d5b4bc6d497ffa98491e38"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An AI-powered password hash auditing assistant that combines a local LLM with Hashcat through the Model Context Protocol (MCP).
Built for authorized security audits — the LLM autonomously identifies hash types, selects attack strategies, escalates through multiple approaches, and reports results in plain English. All processing is local — no data leaves your machine.
User (natural language)
↓
Local LLM — qwen2.5 via Ollama
(decides which tools to call and with what arguments)
↓
MCP Client — bridges LLM decisions to real tool execution
↓
MCP Server — exposes Hashcat as structured tools
↓
Hashcat — performs actual password recovery
↓
Results logged to results/session_log.jsonRelated MCP server: PentestMCP
Tool | Description |
| Identifies hash algorithm from format/length (MD5, NTLM, SHA-1, bcrypt etc.) |
| Lists available wordlists and rule files on the system |
| Cracks a single hash with configurable attack mode and wordlist |
| Cracks multiple hashes from a file with automatic escalation |
The LLM follows this sequence for every hash automatically:
Dictionary attack — 10k-common wordlist
Rule-based attack — 100k-ncsc + best66.rule
Hybrid attack — 100k-ncsc + 4-digit mask (?d?d?d?d)
Larger wordlist — 000webhost
Component | Version | Purpose |
Hashcat | v7.1.2 | Password recovery engine |
Ollama | latest | Local LLM runtime |
qwen2.5 | 7B | Tool-calling capable LLM |
FastMCP (Python) | latest | MCP server framework |
WSL2 Ubuntu | 24.x | Linux environment on Windows |
Windows with WSL2 + Ubuntu
Ollama installed (curl -fsSL https://ollama.com/install.sh | sh)
Hashcat installed (sudo apt install hashcat)
SecLists cloned (git clone --depth 1 https://github.com/danielmiessler/SecLists.git ~/SecLists)
git clone https://github.com/YOUR_USERNAME/hashcat-mcp.git
cd hashcat-mcp
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtollama pull qwen2.5:latestcd hashcat-mcp
source venv/bin/activate
python3 mcp_client.pyYou: crack this hash: 482c811da5d5b4bc6d497ffa98491e38
Assistant: [calls identify_hash → MD5 identified]
[calls run_hashcat → password123 found]
The password is: password123Create a file with one hash per line, or username:hash format:
admin:e90664c0af74160644d29e4d6147969b
user1:5f4dcc3b5aa765d61d8327deb882cf99
482c811da5d5b4bc6d497ffa98491e38Then ask:
You: crack all hashes in /home/user/hashes.txt — they are MD5Output:
==================================================
BATCH CRACK SUMMARY
==================================================
Total hashes: 3
Cracked: 3 (100.0%)
Not cracked: 0
==================================================
RESULTS:
✓ admin → Summer2024
✓ user1 → password
✓ (hash) → password123
==================================================
Full results saved to: results/session_log.jsonEvery crack attempt is automatically logged to results/session_log.json:
{
"timestamp": "2026-08-19T19:33:27.932857",
"username": "admin",
"hash": "e90664c0af74160644d29e4d6147969b",
"hash_mode": 0,
"cracked": true,
"password": "Summer2024",
"attack_used": "mode 6 wordlist=100k-ncsc mask=?d?d?d?d"
}Algorithm | Hashcat Mode | Example Format |
MD5 |
|
|
NTLM |
|
|
SHA-1 |
|
|
SHA-256 |
|
|
bcrypt |
|
|
sha512crypt |
|
|
This tool is designed exclusively for authorized password security audits:
Testing organizational password strength against real-world attack methods
Identifying weak passwords before attackers do
Generating evidence for security policy enforcement
Never use this tool on hashes you do not have explicit authorization to audit.
hashcat-mcp/
├── mcp_server.py # MCP server — exposes Hashcat as tools
├── mcp_client.py # MCP client — connects LLM to server
├── prompts/
│ └── system_prompt.txt # LLM behavior instructions
├── hashes/ # Hash files for testing
├── results/
│ └── session_log.json # Automatic audit log
└── requirements.txtThis server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Offline methodology engine for authorized penetration testing, CTF, and security research.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/chess960king/hashcat-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server