attackforge-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@attackforge-mcplist projects with status 'active'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
attackforge-mcp
An MCP server that connects AI assistants (Claude, etc.) to the AttackForge Self-Service API (SSAPI).
vs. the official AttackForge MCP
AttackForge publishes an official MCP server. It exposes a limited subset of
the SSAPI — specifically: whoami, get_file, count_projects,
count_vulnerabilities, count_writeups, find_affected_assets,
find_projects, find_writeups, find_vulnerabilities, and
get_field_structure.
This server covers the full SSAPI and adds a layer of context efficiency on top, designed specifically for use inside long AI conversations:
Official MCP | attackforge-mcp | |
API coverage | 10 endpoints | Full SSAPI |
Response passthrough | Raw API JSON | Slimmed (see below) |
HTML fields | Returned | Stripped globally (−40–60% size) |
List responses | Full objects | Summary projection + |
Static data (form configs, testsuite library, project index) | Re-fetched every call | SQLite cache with TTLs |
Cache management | — |
|
Escape hatch | — |
|
Why it matters: Large tool responses dump hundreds of lines of JSON into context on every call. Over a multi-step engagement that context fills up fast. By stripping HTML duplicates, projecting summary fields, and caching data that never changes mid-engagement, this server keeps each tool response as small as possible without losing information.
Related MCP server: Burp Suite MCP Server
Setup
Requirements
Python 3.12+
Install
git clone https://github.com/unstrike/attackforge-mcp
cd attackforge-mcp
uv syncConfiguration
Set two environment variables before starting the server:
Variable | Description | Default |
| Your AttackForge instance hostname | (required) |
| Your SSAPI key | (required) |
Run
AF_HOSTNAME=your.attackforge.com X_SSAPI_KEY=your-key uv run attackforge-mcpOr add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"attackforge-mcp": {
"command": "uv",
"args": ["run", "--directory", "/path/to/attackforge-mcp", "attackforge-mcp"],
"env": {
"AF_HOSTNAME": "your.attackforge.com",
"X_SSAPI_KEY": "your-key"
}
}
}
}Tools
Tool | What it does |
| List, get, create, update, clone, archive projects and notes |
| List, get, create, update, bulk-create vulnerabilities |
| Browse and manage the testsuite library |
| List, assign, update test cases on a project |
| Manage project and library assets |
| Create and update remediation notes on vulnerabilities |
| Generate and retrieve project reports |
| Failed testcases, vulnerable assets, common vulnerabilities |
| Markdown → rich text conversion; form config lookup |
| Inspect and invalidate the local SQLite cache |
| Direct access to any SSAPI endpoint |
See CLAUDE.md for usage patterns.
This server cannot be installed
Maintenance
Latest Blog Posts
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/unstrike/attackforge-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server