Mimikatz MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MIMIKATZ_PATH | No | Full path to mimikatz.exe binary. If not set, default locations are checked. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| mimikatz_statusA | Check Mimikatz installation status and system compatibility |
| mimikatz_sekurlsa_logonpasswordsA | Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. Requires elevated privileges. |
| mimikatz_sekurlsa_wdigestB | Extract WDigest credentials from LSASS memory |
| mimikatz_sekurlsa_kerberosB | List Kerberos credentials and tickets |
| mimikatz_sekurlsa_msvB | Extract MSV1_0 credentials (NTLM hashes) |
| mimikatz_lsadump_samB | Dump SAM database hashes (local accounts) |
| mimikatz_lsadump_secretsB | Dump LSA secrets (service account credentials, etc.) |
| mimikatz_lsadump_dcsyncA | Perform DCSync attack to replicate AD credentials. Requires domain admin or replication rights. |
| mimikatz_kerberos_goldenC | Create a Golden Ticket for persistent domain access |
| mimikatz_kerberos_silverC | Create a Silver Ticket for service-specific access |
| mimikatz_kerberos_pttB | Pass-the-Ticket: Import a Kerberos ticket into the current session |
| mimikatz_kerberos_listB | List Kerberos tickets in current session |
| mimikatz_kerberos_purgeA | Purge all Kerberos tickets from current session |
| mimikatz_vault_credB | Dump Windows Vault credentials (saved passwords) |
| mimikatz_dpapi_masterkeyC | Decrypt DPAPI master keys |
| mimikatz_crypto_certificatesB | Export certificates with private keys |
| mimikatz_token_elevateB | Elevate to SYSTEM token or impersonate another user |
| mimikatz_privilege_debugA | Enable SeDebugPrivilege for process manipulation |
| mimikatz_process_listA | List running processes with security context |
| mimikatz_misc_cmdB | Spawn a command prompt with current (potentially elevated) context |
| mimikatz_customC | Execute custom Mimikatz commands |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 21 tools
Each tool targets a distinct Mimikatz module/operation: sekurlsa variants separate by credential type, kerberos ticket actions are clearly split, and lsadump/vault/dpapi/crypto/token functions are unambiguous. Although several tools extract credentials from LSASS, their descriptions specify exactly which credential source is involved.
All tools follow the consistent mimikatz_<module>_<operation> pattern with snake_case throughout. The names map directly to vanilla Mimikatz command modules, making the set predictable and familiar.
At 21 tools the set is slightly above the ideal 3-15 range, but the breadth reflects Mimikatz's many credential and security subsystems. Each tool corresponds to a distinct functionality rather than redundant wrappers.
The surface covers the major Mimikatz workflows: credential extraction, SAM/LSA dumping, DCSync, ticket attacks, DPAPI, certificates, token manipulation, and a custom command fallback. Minor gaps such as pass-the-hash or some secondary lsadump/sekurlsa options are not exposed directly but can be reached through mimikatz_custom.