operant-mcp is a security testing MCP server with 51 tools covering penetration testing, network forensics, memory analysis, and vulnerability assessment.
SQL Injection — WHERE clause bypasses, login form bypasses, UNION-based extraction, boolean/time-based blind SQLi, and file reading via LOAD_FILE().
XSS — Reflected XSS testing with 10 payloads; context-aware payload generation (html_body, attribute, javascript, url, css) with filter evasion.
Command Injection — OS command injection with multiple shell operators; blind detection via time delays and OOB callbacks.
Path Traversal — Directory traversal with plain, URL-encoded, double-encoded, and null-byte variants at multiple depths.
SSRF — Localhost bypass variants (10+); cloud metadata endpoint access (AWS, GCP, Azure).
PCAP / Network Forensics — Protocol hierarchy and endpoint stats, credential extraction (FTP/HTTP/SMTP), DNS analysis, HTTP object export, port scan detection, TCP/UDP/HTTP stream following, TLS/SNI analysis, LLMNR poisoning detection, and NTLM credential extraction.
Reconnaissance — Quick recon (robots.txt, headers, common dirs), full DNS enumeration, vhost discovery, TLS SAN extraction, directory brute-force, git secret scanning, and S3 bucket permission testing.
Memory Forensics — Volatility 2 Linux and Volatility 3 Windows plugin execution; Linux rootkit detection via syscall table and hidden module analysis.
Malware Analysis — Full OLE document analysis (streams, VBA macros, IOCs) and raw VBA macro extraction.
Cloud Security — AWS CloudTrail log parsing and anomaly detection (unusual IPs, API calls, role assumptions).
Authentication — CSRF token extraction, username enumeration, credential brute-force, and cookie tampering for privilege escalation.
Access Control — IDOR testing via ID/GUID iteration; cookie/parameter-based privilege escalation.
Business Logic — Client-side price/quantity manipulation; coupon stacking and alternation abuse.
Clickjacking — X-Frame-Options/CSP header checks with PoC iframe HTML; sandbox attribute bypass for JS frame busters.
CORS — Misconfiguration testing (origin reflection, null origin trust, subdomain wildcards).
File Upload — Web shell upload via Content-Type and extension bypass techniques.
NoSQL Injection — MongoDB auth bypass via operator injection; injection point detection in query params and JSON bodies.
Deserialization — Detection and manipulation of serialized objects in cookies (PHP, Java, .NET ViewState, JSON).
GraphQL — Full schema introspection (types, fields, mutations); hidden field discovery via suggestion errors.
Methodology Guides — 8 structured prompts covering web app pentesting, PCAP forensics, memory forensics, recon, malware analysis, cloud security, SQLi, and XSS.
Searches Git repositories for exposed secrets and credentials during the reconnaissance phase of a security assessment.
Performs full GraphQL schema introspection and discovery of hidden fields to identify potential security vulnerabilities.
Provides tools for Linux-specific security tasks, including memory forensics and rootkit detection.
Tests for MongoDB-specific vulnerabilities, including authentication bypass and NoSQL injection detection.
Performs deep packet inspection and network forensics on PCAP files, including protocol analysis and credential extraction using TShark.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@operant-mcp analyze this network capture and extract any found credentials"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment.
npx operant-mcpOr install globally:
npm install -g operant-mcp
operant-mcpRelated MCP server: pentestMCP
Add to your MCP config:
{
"mcpServers": {
"operant": {
"command": "npx",
"args": ["-y", "operant-mcp"]
}
}
}sqli_where_bypass — Test OR-based WHERE clause bypass
sqli_login_bypass — Test login form SQL injection
sqli_union_extract — UNION-based data extraction
sqli_blind_boolean — Boolean-based blind SQLi
sqli_blind_time — Time-based blind SQLi
sqli_file_read — Read files via LOAD_FILE()
xss_reflected_test — Test reflected XSS with 10 payloads
xss_payload_generate — Generate context-aware XSS payloads
cmdi_test — Test OS command injection
cmdi_blind_detect — Blind command injection via sleep timing
path_traversal_test — Test directory traversal with encoding variants
ssrf_test — Test SSRF with localhost bypass variants
ssrf_cloud_metadata — Test cloud metadata access via SSRF
pcap_overview — Protocol hierarchy and endpoint stats
pcap_extract_credentials — Extract FTP/HTTP/SMTP credentials
pcap_dns_analysis — DNS query analysis
pcap_http_objects — Export HTTP objects
pcap_detect_scan — Detect port scanning
pcap_follow_stream — Follow TCP/UDP streams
pcap_tls_analysis — TLS/SNI analysis
pcap_llmnr_ntlm — Detect LLMNR/NTLM attacks
recon_quick — Quick recon (robots.txt, headers, common dirs)
recon_dns — Full DNS enumeration
recon_vhost — Virtual host discovery
recon_tls_sans — Extract SANs from TLS certificates
recon_directory_bruteforce — Directory brute-force
recon_git_secrets — Search git repos for secrets
recon_s3_bucket — Test S3 bucket permissions
volatility_linux — Linux memory analysis (Volatility 2)
volatility_windows — Windows memory analysis (Volatility 3)
memory_detect_rootkit — Linux rootkit detection
maldoc_analyze — Full OLE document analysis pipeline
maldoc_extract_macros — Extract VBA macros
cloudtrail_analyze — CloudTrail log analysis
cloudtrail_find_anomalies — Detect anomalous CloudTrail events
auth_csrf_extract — Extract CSRF tokens
auth_bruteforce — Username enumeration + credential brute-force
auth_cookie_tamper — Cookie tampering test
idor_test — Test for IDOR vulnerabilities
role_escalation_test — Test privilege escalation
price_manipulation_test — Test price/quantity manipulation
coupon_abuse_test — Test coupon stacking/reuse
clickjacking_test — Test X-Frame-Options/CSP
frame_buster_bypass — Test frame-busting bypass
cors_test — Test CORS misconfigurations
file_upload_test — Test file upload bypasses
nosqli_auth_bypass — MongoDB auth bypass
nosqli_detect — NoSQL injection detection
deserialization_test — Test insecure deserialization
graphql_introspect — Full schema introspection
graphql_find_hidden — Discover hidden fields
Methodology guides for structured security assessments:
web_app_pentest — Full web app pentest methodology
pcap_forensics — PCAP analysis workflow
memory_forensics — Memory dump analysis (Linux/Windows)
recon_methodology — Reconnaissance checklist
malware_analysis — Malware document analysis
cloud_security_audit — CloudTrail analysis workflow
sqli_methodology — SQL injection testing guide
xss_methodology — XSS testing guide
Tools require various CLI utilities depending on the module:
Most tools: curl
PCAP analysis: tshark (Wireshark CLI)
DNS recon: dig, host
Memory forensics: volatility / vol.py / vol3
Malware analysis: olevba, oledump.py
Cloud analysis: jq
Secrets scanning: git
MIT
Username enumeration and credential brute-force.
First enumerates valid usernames (if failure messages differ), then brute-forces passwords against confirmed usernames.
Returns: {"username_enumeration": [{"username": str, "exists": bool}], "valid_credentials": [{"username": str, "password": str}], "requests_sent": int}.
Side effects: Sends login requests. May trigger account lockout.
Errors: Rate limiting may block requests. Use realistic credentials to avoid WAF detection.
Inputs: url (required), usernames (required), passwords (required), username_field, +6 more.
Test cookie manipulation for privilege escalation.
Sends requests with tampered cookie values and checks for access.
Returns: {"results": [{"cookies": dict, "status": int, "length": int, "response_snippet": str}]}.
Side effects: Sends GET requests with manipulated cookies.
Inputs: url (required), cookies (required).
Extract CSRF tokens from HTML forms.
Searches for the token in hidden input fields, meta tags, and script blocks.
Returns: {"tokens_found": [{"source": str, "value": str}], "cookies": [str]}.
Side effects: Single GET request.
Inputs: url (required), token_name.
Check X-Frame-Options and CSP frame-ancestors headers; generate PoC iframe HTML. Fetches response headers and checks for framing protections. If protections are missing, generates a ready-to-use PoC HTML page that embeds the target in a transparent iframe with a decoy button overlay. Returns: {headers, x_frame_options, csp_frame_ancestors, vulnerable, poc_html}. Side effects: Single HEAD/GET request.
Inputs: target_url (required).
Parse and analyze AWS CloudTrail logs.
Extracts event timeline, unique users, event types, and source IPs.
Returns: {"event_count": int, "unique_users": [str], "event_types": [str], "source_ips": [str], "timeline": str}.
Side effects: Read-only file analysis. Requires jq.
Inputs: log_dir (required).
Find anomalies in CloudTrail logs: non-AWS IPs, unusual API calls, role assumptions.
Returns: {"non_aws_ips": [str], "unusual_events": [str], "role_assumptions": [str], "data_exfil_indicators": [str]}.
Side effects: Read-only file analysis.
Inputs: log_dir (required).
Detect blind command injection via time delay and OOB callbacks. Tests sleep-based delay detection and optional out-of-band (curl/nslookup to callback). Returns time_based results array and oob_payloads list. Side effects: Executes sleep on target if vulnerable. OOB payloads call back to callback_url.
Inputs: url (required), parameter (required), base_value, method, +2 more.
Test command injection using various shell operators. Tests ;, &&, ||, |, backtick, $(), and %0a (newline) operators with 'id' and 'whoami' as detection commands. Returns results array with operator, payload, status, output_snippet, likely_vulnerable. Side effects: Read-only detection commands (id, whoami). Sends ~14 requests.
Inputs: url (required), parameter (required), base_value, method, +1 more.
Test CORS misconfigurations: origin reflection, null origin trust, subdomain wildcards. Sends requests with various Origin headers and checks Access-Control-Allow-Origin and Access-Control-Allow-Credentials in the response. Misconfigurations allow attacker sites to read authenticated API responses. Returns: {results: [{test, origin_sent, acao, acac, vulnerable}], exploit_html}. Side effects: Read-only requests with custom Origin headers. Sends ~8 requests.
Inputs: url (required), api_endpoint (required), auth_cookie.
Test coupon stacking and alternation bypass.
Tests each coupon individually, then alternates between coupons to see if discounts compound past the intended limit.
Returns: {"individual_results": [...], "stacking_results": [...], "stacking_possible": bool}.
Side effects: Applies coupons to the cart. May modify cart totals.
Inputs: url (required), coupon_endpoint (required), coupons (required), coupon_param, +2 more.
Detect and manipulate serialized objects in cookies. Analyzes cookie values for serialization patterns (PHP serialize, Java, .NET ViewState, base64-encoded JSON). If a serialized format is detected, attempts privilege escalation by modifying fields (admin=1, role=admin). Returns: {detection: {format, decoded, fields}, manipulation_results: [...]}. Side effects: Sends requests with modified cookies. May escalate privileges if successful.
Inputs: url (required), cookie_name (required), cookie_value, auth_cookie.
Test web shell upload with Content-Type bypass variants. Attempts to upload a PHP web shell using various techniques: 1) Direct .php upload 2) .php with image/jpeg Content-Type (Content-Type bypass) 3) Alternative extensions (.php5, .phtml, .phar, .php7, .phps) 4) Double extension (.php.jpg) 5) Null byte (.php%00.jpg). After each upload, attempts to access the uploaded file to check execution. Returns: {results: [{technique, upload_status, execution_status, output, successful}]}. Side effects: Uploads files to the server. May achieve remote code execution.
Inputs: url (required), upload_endpoint (required), upload_field, upload_path_prefix, +3 more.
Test sandbox attribute bypass for JavaScript frame busters. Generates PoC HTML that uses iframe sandbox='allow-forms' to disable JavaScript execution (neutralizing frame-busting code) while still allowing form submission for clickjacking. Also checks if the target page contains common frame-busting patterns. Returns: {frame_buster_detected, patterns_found, sandbox_poc_html}. Side effects: Single GET request to detect frame-busting code.
Inputs: target_url (required).
Run introspection query to enumerate all types, fields, and mutations. Sends the standard GraphQL introspection query (__schema) to discover the full API schema including hidden/undocumented fields, mutations, and types. Returns: {introspection_enabled, types: [{name, kind, fields: [str]}], mutations: [str], queries: [str]}. Side effects: Single POST request. Read-only.
Inputs: url (required), auth_header, auth_cookie.
Test Insecure Direct Object References by iterating through IDs/GUIDs.
Sends requests with each ID and compares response status codes and lengths. Differing responses suggest IDOR — the server returns data for other users' objects without proper authorization checks.
Returns: {"baseline": dict, "results": [{"id": str, "status": int, "length": int, "different": bool, "snippet": str}], "idor_candidates": [str]}.
Side effects: Read-only requests. Sends len(id_list) + 1 requests.
Errors: ConnectionError if target unreachable.
Inputs: url (required), parameter (required), id_list (required), auth_cookie, +1 more.
Full malware document analysis pipeline.
oledump.py — list OLE streams, identify macro-containing streams (marked 'M')
olevba — extract VBA macro code
Identify auto-execution triggers (Document_open, AutoOpen, Workbook_Open)
Look for obfuscation patterns and base64 payloads
Search for PowerShell, WMI, and shell execution indicators
Returns: {"ole_streams": str, "vba_macros": str, "auto_exec_triggers": [str], "suspicious_strings": [str], "iocs": [str]}.
Side effects: Read-only file analysis. Does NOT execute any payloads.
Errors: Requires oledump.py and olevba (pip install oletools).
Inputs: file_path (required).
Extract raw VBA macros from an OLE document.
Returns: {"macros": str, "stream_count": int, "macro_streams": [str]}.
Side effects: Read-only file analysis.
Inputs: file_path (required).
Check for rootkits via syscall table tampering and hidden kernel modules. Runs linux_check_syscall and linux_hidden_modules plugins. Returns syscall_check, hidden_modules, rootkit_indicators, and likely_compromised. Read-only analysis.
Inputs: dump_path (required), profile (required).
Test NoSQL operator injection ($ne, $gt, $regex) for authentication bypass. Sends payloads that abuse MongoDB query operators to bypass password checks. E.g., {"username":"admin","password":{"$ne":""}} matches any non-empty password. Returns: {results: [{payload_name, status, length, likely_bypass, snippet}]}. Side effects: Sends POST requests to the login endpoint. May create sessions.
Inputs: url (required), username_param, password_param, target_username.
Test NoSQL injection detection in query parameters. Tests MongoDB operator injection ($ne, $gt, $regex, $where) in GET parameters and JSON body to detect NoSQL injection points. Returns: {baseline, results: [{payload_name, status, length, different}], injectable}. Side effects: Read-only. Sends ~10 requests.
Inputs: url (required), parameter (required), method, content_type.
Test path traversal with encoding variants at multiple depths. Tries plain ../, URL-encoded %2e%2e/, double-encoded %252e%252e/, and null-byte/truncation bypasses. Returns results array with payload, status, length, contains_target per attempt, and vulnerable_payloads list. Side effects: Read-only GET requests. Sends ~32 requests.
Inputs: url (required), parameter (required), target_file, depth.
Detect port scans by analyzing SYN packets without ACK. Returns scanners (ip + syn_count), top_scanned_ports, and a hint. Read-only file analysis.
Inputs: pcap_path (required).
Extract and analyze DNS queries from a PCAP. Returns dns_queries_by_frequency, dns_servers, and ipv6_dns_endpoints. Read-only file analysis.
Inputs: pcap_path (required), source_ip.
Extract credentials from FTP, HTTP, and SMTP traffic. Returns ftp_credentials, http_authorization_headers, http_post_data, and smtp_data. Read-only, may contain sensitive credentials.
Inputs: pcap_path (required), protocol.
Follow a TCP/UDP/HTTP stream in a PCAP. Returns stream_content, stream_num, and protocol. Read-only file analysis.
Inputs: pcap_path (required), stream_num (required), protocol.
Export HTTP objects (files) from a PCAP to a directory. Returns exported_count, output_dir, files list, and tshark_output. Creates files in the output directory.
Inputs: pcap_path (required), output_dir (required).
Detect LLMNR poisoning and extract NTLM credentials from SMB. Returns llmnr_queries, ntlm_auth_entries, counts, and poisoning_indicators. Read-only file analysis.
Inputs: pcap_path (required).
Get protocol hierarchy and endpoint statistics from a PCAP. Returns protocol_hierarchy, endpoints, packet_count, and capture_info. Read-only file analysis, no network access.
Inputs: pcap_path (required).
Analyze TLS handshakes, SNI values, and certificate data in a PCAP. Returns sni_values, tls_versions, server_ephemeral_keys, and client_randoms. Read-only file analysis.
Inputs: pcap_path (required).
Test client-side price manipulation by sending modified price values.
Sends price=0, price=1, price=-1, and negative quantity variants to check if the server validates prices server-side.
Returns: {"results": [{"test_case": str, "payload": str, "status": int, "length": int, "accepted": bool, "snippet": str}]}.
Side effects: May add items to cart or create orders at manipulated prices.
Inputs: url (required), price_param (required), cart_endpoint, extra_params, +2 more.
Directory brute-force using parallel curl requests. Returns results (path/status/length), found_count, and paths_tested. Read-only GET requests, sends one request per wordlist entry per extension.
Inputs: target (required), wordlist, threads, extensions.
Full DNS enumeration: A, AAAA, MX, TXT, NS, CNAME, AXFR, BIND version. Returns records object, axfr_result, and bind_version. Read-only DNS queries.
Inputs: target (required).
Search git history for secrets: commit messages, author info, branches, deleted files. Returns secrets_in_code_history, unique_authors, branches, deleted_files_summary, and suspicious_commit_messages. Read-only git operations on local repository.
Inputs: repo_path (required).
Quick reconnaissance: robots.txt, security.txt, common dirs, response headers. Returns robots_txt, security_txt, response_headers, accessible_directories, and error_page_snippet. Read-only, sends ~10 GET requests.
Inputs: target (required).
Test an S3 bucket for public access (listing, reading). Returns bucket_url, listable, listing_snippet, and readable_files. Read-only requests to S3.
Inputs: bucket_name (required).
Extract Subject Alternative Names from the TLS certificate. Returns common_name, subject_alternative_names, issuer, validity, and san_count. Read-only TLS handshake.
Inputs: target (required).
Brute-force virtual hosts by fuzzing the Host header. Returns baseline_length, results (vhost/status/length/length_delta), unique_vhosts, and tested count. Read-only, sends one request per wordlist entry.
Inputs: target (required), base_domain (required), wordlist.
Test cookie/parameter-based role escalation.
Sends requests with various role cookie values (Admin=true, roleid=2, etc.) and checks for privilege escalation. Also tests JSON body field manipulation for profile update endpoints.
Returns: {"baseline": dict, "results": [{"value": str, "status": int, "length": int, "escalated": bool}], "escalation_candidates": [str]}.
Side effects: If json_body is set, sends POST/PUT requests that may modify state.
Inputs: url (required), cookie_name (required), cookie_values (required), extra_cookies, +2 more.
Boolean-based blind SQLi with binary search character enumeration. Uses ASCII(SUBSTRING(...))>N technique with binary search for efficiency. Determines true/false by comparing response lengths. Returns extracted_value, characters_found, requests_sent. Side effects: Read-only. Sends ~8 requests per character (binary search on ASCII 32-126).
Inputs: url (required), parameter (required), query, max_length.
Time-based blind SQLi detection for MySQL, PostgreSQL, and MSSQL. Sends sleep-inducing payloads and measures response time to detect injection. Returns vulnerable, dbtype, and results array with payload, response_time, triggered. Side effects: Read-only but slow (each payload waits up to delay_seconds). Sends 3 requests.
Inputs: url (required), parameter (required), dbtype, delay_seconds.
Read server files via UNION SELECT LOAD_FILE(). Requires MySQL FILE privilege. Uses LOAD_FILE() in a UNION SELECT. Returns file_content, success, target_file. Errors: FILE privilege required. Returns empty if privilege denied.
Inputs: url (required), parameter (required), target_file, column_count, +1 more.
Bypass login via SQL comment truncation (administrator'--). Extracts CSRF token from form, then POSTs with SQLi in the username field. The -- comment truncates the password check. Returns csrf_extracted, status_code, response_length, headers, likely_bypass.
Inputs: url (required), username, csrf_field, username_field, +1 more.
Step-by-step UNION-based data extraction. 1. Finds column count via ORDER BY. 2. Identifies string-displayable columns via UNION SELECT. 3. Extracts database name and version. 4. Lists tables and columns. Returns column_count, string_columns, db_name, db_version, tables, user_columns. Side effects: Read-only GET requests. Sends ~30 requests depending on column count.
Inputs: url (required), parameter (required), max_columns.
Test WHERE clause bypass via OR 1=1 variants. Sends multiple payloads (OR 1=1--, OR '1'='1, OR 1=1/*, etc.) against the target parameter and compares response lengths to the baseline. Returns baseline_length and results array. Side effects: None (read-only GET requests). Sends 7 requests total.
Inputs: url (required), parameter (required), value (required).
Test SSRF access to cloud metadata endpoints (AWS/GCP/Azure). Attempts to reach instance metadata services through the SSRF vector. Returns results array with provider, endpoint, status, length, response_snippet. Side effects: May cause target to request cloud metadata. Could expose IAM credentials if successful.
Inputs: url (required), parameter (required), cloud_provider, method.
Test SSRF with localhost bypass variants. Sends 10+ representations of localhost (127.0.0.1, 0, decimal, hex, IPv6, etc.) to check if the server fetches internal resources. Returns results array with variant, payload_url, status, length, different_from_baseline per attempt. Side effects: May cause the target server to make internal requests.
Inputs: url (required), parameter (required), internal_target, method.
Run a Volatility 2 Linux plugin against a memory dump. Returns plugin, profile, success, output, and errors. Read-only analysis. Requires volatility2 (vol.py) on PATH.
Inputs: dump_path (required), profile (required), plugin (required).
Run a Volatility 3 Windows plugin against a memory dump. Returns plugin, success, output, and errors. Read-only analysis, Volatility 3 auto-detects OS. Requires vol3 (vol) on PATH.
Inputs: dump_path (required), plugin (required).
Generate context-appropriate XSS payloads with optional filter evasion. Returns a list of payloads tailored to the injection context and filter bypass requirements. Returns context, filter_bypass, payloads array, notes. Side effects: None. Pure payload generation, no network requests.
Inputs: context (required), filter_bypass, callback_url.
Test multiple reflected XSS vectors against a parameter. Sends 10 payloads (script tags, event handlers, SVG, attribute injection, case variation, template literals) and checks if they appear unescaped in the response. Returns results array with reflected/encoded/status per payload, and vulnerable_count. Side effects: Read-only GET requests. Sends 10 requests.
Inputs: url (required), parameter (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 51 tools
Tools are grouped by domain prefixes (pcap_, recon_, sqli_, etc.) and each description specifies a unique technique. Minor overlap exists between clickjacking/frame-buster tools and cookie/role manipulation tools, but the descriptions are explicit enough to avoid serious misselection.
All tool names follow snake_case with clear domain prefixes, making them readable and predictable. However, verb placement is inconsistent—some use noun_verb (cloudtrail_analyze), others verb_placement varies (pcap_detect_scan, sqli_blind_time)—so the pattern is not uniform.
51 tools is far beyond the typical well-scoped range and makes the server unwieldy for agents. The set spans unrelated domains—web testing, PCAP analysis, memory forensics, and cloud log review—which would be better served by splitting into smaller specialized servers.
The tool surface is broad and deep, covering reconnaissance, SQLi/NoSQLi/XSS/SSRF, authentication flaws, PCAP analysis, and memory forensics. Minor gaps exist, such as no dedicated port scanner or LFI/RFI tester, but core offensive security workflows are well supported.
MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
