io.github.operantlabs/operant-mcp

operant-mcp

Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment.

Quick Start

npx operant-mcp

Or install globally:

npm install -g operant-mcp
operant-mcp

Usage with Claude Code

Add to your MCP config:

{
  "mcpServers": {
    "operant": {
      "command": "npx",
      "args": ["-y", "operant-mcp"]
    }
  }
}

Tools (51)

SQL Injection (6)

• sqli_where_bypass — Test OR-based WHERE clause bypass
• sqli_login_bypass — Test login form SQL injection
• sqli_union_extract — UNION-based data extraction
• sqli_blind_boolean — Boolean-based blind SQLi
• sqli_blind_time — Time-based blind SQLi
• sqli_file_read — Read files via LOAD_FILE()

XSS (2)

• xss_reflected_test — Test reflected XSS with 10 payloads
• xss_payload_generate — Generate context-aware XSS payloads

Command Injection (2)

• cmdi_test — Test OS command injection
• cmdi_blind_detect — Blind command injection via sleep timing

Path Traversal (1)

• path_traversal_test — Test directory traversal with encoding variants

SSRF (2)

• ssrf_test — Test SSRF with localhost bypass variants
• ssrf_cloud_metadata — Test cloud metadata access via SSRF

PCAP/Network Forensics (8)

• pcap_overview — Protocol hierarchy and endpoint stats
• pcap_extract_credentials — Extract FTP/HTTP/SMTP credentials
• pcap_dns_analysis — DNS query analysis
• pcap_http_objects — Export HTTP objects
• pcap_detect_scan — Detect port scanning
• pcap_follow_stream — Follow TCP/UDP streams
• pcap_tls_analysis — TLS/SNI analysis
• pcap_llmnr_ntlm — Detect LLMNR/NTLM attacks

Reconnaissance (7)

• recon_quick — Quick recon (robots.txt, headers, common dirs)
• recon_dns — Full DNS enumeration
• recon_vhost — Virtual host discovery
• recon_tls_sans — Extract SANs from TLS certificates
• recon_directory_bruteforce — Directory brute-force
• recon_git_secrets — Search git repos for secrets
• recon_s3_bucket — Test S3 bucket permissions

Memory Forensics (3)

• volatility_linux — Linux memory analysis (Volatility 2)
• volatility_windows — Windows memory analysis (Volatility 3)
• memory_detect_rootkit — Linux rootkit detection

Malware Analysis (2)

• maldoc_analyze — Full OLE document analysis pipeline
• maldoc_extract_macros — Extract VBA macros

Cloud Security (2)

• cloudtrail_analyze — CloudTrail log analysis
• cloudtrail_find_anomalies — Detect anomalous CloudTrail events

Authentication (3)

• auth_csrf_extract — Extract CSRF tokens
• auth_bruteforce — Username enumeration + credential brute-force
• auth_cookie_tamper — Cookie tampering test

Access Control (2)

• idor_test — Test for IDOR vulnerabilities
• role_escalation_test — Test privilege escalation

Business Logic (2)

• price_manipulation_test — Test price/quantity manipulation
• coupon_abuse_test — Test coupon stacking/reuse

Clickjacking (2)

• clickjacking_test — Test X-Frame-Options/CSP
• frame_buster_bypass — Test frame-busting bypass

CORS (1)

• cors_test — Test CORS misconfigurations

File Upload (1)

• file_upload_test — Test file upload bypasses

NoSQL Injection (2)

• nosqli_auth_bypass — MongoDB auth bypass
• nosqli_detect — NoSQL injection detection

Deserialization (1)

• deserialization_test — Test insecure deserialization

GraphQL (2)

• graphql_introspect — Full schema introspection
• graphql_find_hidden — Discover hidden fields

Prompts (8)

Methodology guides for structured security assessments:

• web_app_pentest — Full web app pentest methodology
• pcap_forensics — PCAP analysis workflow
• memory_forensics — Memory dump analysis (Linux/Windows)
• recon_methodology — Reconnaissance checklist
• malware_analysis — Malware document analysis
• cloud_security_audit — CloudTrail analysis workflow
• sqli_methodology — SQL injection testing guide
• xss_methodology — XSS testing guide

System Requirements

Tools require various CLI utilities depending on the module:

• Most tools: curl
• PCAP analysis: tshark (Wireshark CLI)
• DNS recon: dig, host
• Memory forensics: volatility / vol.py / vol3
• Malware analysis: olevba, oledump.py
• Cloud analysis: jq
• Secrets scanning: git

License

MIT