Operant Mcp
This is a comprehensive security testing toolkit that exposes 51 tools and 8 methodology prompts through MCP. It covers web vulnerabilities like SQL injection, XSS, and command injection alongside PCAP analysis with tshark, memory forensics using Volatility, malware document inspection with olevba, and CloudTrail log analysis. You'd reach for this when doing penetration testing or forensic investigations and want Claude to help orchestrate security tools, extract credentials from network captures, analyze memory dumps for rootkits, or follow structured testing methodologies. It wraps CLI utilities like curl, dig, and jq into agent-friendly operations. Requires the underlying security tools installed locally.
- GitHub stars
- 8
- tools
- 51
- transport
- STDIO
- last updated
- Mar 25, 2026
Tools
51 toolsPublic tool metadata for what this MCP can expose to an agent.
sqli_where_bypassTest OR-based WHERE clause bypass
Test OR-based WHERE clause bypass
No parameter schema in public metadata yet.
sqli_login_bypassTest login form SQL injection
Test login form SQL injection
No parameter schema in public metadata yet.
sqli_union_extractUNION-based data extraction
UNION-based data extraction
No parameter schema in public metadata yet.
sqli_blind_booleanBoolean-based blind SQLi
Boolean-based blind SQLi
No parameter schema in public metadata yet.
sqli_blind_timeTime-based blind SQLi
Time-based blind SQLi
No parameter schema in public metadata yet.
sqli_file_readRead files via LOAD_FILE()
Read files via LOAD_FILE()
No parameter schema in public metadata yet.
xss_reflected_testTest reflected XSS with 10 payloads
Test reflected XSS with 10 payloads
No parameter schema in public metadata yet.
xss_payload_generateGenerate context-aware XSS payloads
Generate context-aware XSS payloads
No parameter schema in public metadata yet.
cmdi_testTest OS command injection
Test OS command injection
No parameter schema in public metadata yet.
cmdi_blind_detectBlind command injection via sleep timing
Blind command injection via sleep timing
No parameter schema in public metadata yet.
path_traversal_testTest directory traversal with encoding variants
Test directory traversal with encoding variants
No parameter schema in public metadata yet.
ssrf_testTest SSRF with localhost bypass variants
Test SSRF with localhost bypass variants
No parameter schema in public metadata yet.
ssrf_cloud_metadataTest cloud metadata access via SSRF
Test cloud metadata access via SSRF
No parameter schema in public metadata yet.
pcap_overviewProtocol hierarchy and endpoint stats
Protocol hierarchy and endpoint stats
No parameter schema in public metadata yet.
pcap_extract_credentialsExtract FTP/HTTP/SMTP credentials
Extract FTP/HTTP/SMTP credentials
No parameter schema in public metadata yet.
pcap_dns_analysisDNS query analysis
DNS query analysis
No parameter schema in public metadata yet.
pcap_http_objectsExport HTTP objects
Export HTTP objects
No parameter schema in public metadata yet.
pcap_detect_scanDetect port scanning
Detect port scanning
No parameter schema in public metadata yet.
pcap_follow_streamFollow TCP/UDP streams
Follow TCP/UDP streams
No parameter schema in public metadata yet.
pcap_tls_analysisTLS/SNI analysis
TLS/SNI analysis
No parameter schema in public metadata yet.
pcap_llmnr_ntlmDetect LLMNR/NTLM attacks
Detect LLMNR/NTLM attacks
No parameter schema in public metadata yet.
recon_quickQuick recon (robots.txt, headers, common dirs)
Quick recon (robots.txt, headers, common dirs)
No parameter schema in public metadata yet.
recon_dnsFull DNS enumeration
Full DNS enumeration
No parameter schema in public metadata yet.
recon_vhostVirtual host discovery
Virtual host discovery
No parameter schema in public metadata yet.
recon_tls_sansExtract SANs from TLS certificates
Extract SANs from TLS certificates
No parameter schema in public metadata yet.
recon_directory_bruteforceDirectory brute-force
Directory brute-force
No parameter schema in public metadata yet.
recon_git_secretsSearch git repos for secrets
Search git repos for secrets
No parameter schema in public metadata yet.
recon_s3_bucketTest S3 bucket permissions
Test S3 bucket permissions
No parameter schema in public metadata yet.
volatility_linuxLinux memory analysis (Volatility 2)
Linux memory analysis (Volatility 2)
No parameter schema in public metadata yet.
volatility_windowsWindows memory analysis (Volatility 3)
Windows memory analysis (Volatility 3)
No parameter schema in public metadata yet.
memory_detect_rootkitLinux rootkit detection
Linux rootkit detection
No parameter schema in public metadata yet.
maldoc_analyzeFull OLE document analysis pipeline
Full OLE document analysis pipeline
No parameter schema in public metadata yet.
maldoc_extract_macrosExtract VBA macros
Extract VBA macros
No parameter schema in public metadata yet.
cloudtrail_analyzeCloudTrail log analysis
CloudTrail log analysis
No parameter schema in public metadata yet.
cloudtrail_find_anomaliesDetect anomalous CloudTrail events
Detect anomalous CloudTrail events
No parameter schema in public metadata yet.
auth_csrf_extractExtract CSRF tokens
Extract CSRF tokens
No parameter schema in public metadata yet.
auth_bruteforceUsername enumeration + credential brute-force
Username enumeration + credential brute-force
No parameter schema in public metadata yet.
auth_cookie_tamperCookie tampering test
Cookie tampering test
No parameter schema in public metadata yet.
idor_testTest for IDOR vulnerabilities
Test for IDOR vulnerabilities
No parameter schema in public metadata yet.
role_escalation_testTest privilege escalation
Test privilege escalation
No parameter schema in public metadata yet.
price_manipulation_testTest price/quantity manipulation
Test price/quantity manipulation
No parameter schema in public metadata yet.
coupon_abuse_testTest coupon stacking/reuse
Test coupon stacking/reuse
No parameter schema in public metadata yet.
clickjacking_testTest X-Frame-Options/CSP
Test X-Frame-Options/CSP
No parameter schema in public metadata yet.
frame_buster_bypassTest frame-busting bypass
Test frame-busting bypass
No parameter schema in public metadata yet.
cors_testTest CORS misconfigurations
Test CORS misconfigurations
No parameter schema in public metadata yet.
file_upload_testTest file upload bypasses
Test file upload bypasses
No parameter schema in public metadata yet.
nosqli_auth_bypassMongoDB auth bypass
MongoDB auth bypass
No parameter schema in public metadata yet.
nosqli_detectNoSQL injection detection
NoSQL injection detection
No parameter schema in public metadata yet.
deserialization_testTest insecure deserialization
Test insecure deserialization
No parameter schema in public metadata yet.
graphql_introspectFull schema introspection
Full schema introspection
No parameter schema in public metadata yet.
graphql_find_hiddenDiscover hidden fields
Discover hidden fields
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Details
- Repository
- github.com/operantlabs/operant-mcp
- Category
- Security & Pentesting
- Package
operant-mcp- Transport
- STDIO
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Snyk API & Web MCP Serversnyk/saw-mcpMCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage7stars
Ansvar: Threat Intelligenceansvar-systems/ansvar-gatewayCVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.0stars
OWASP ZAP MCP Serverpierre3/dotnet-zap-mcpMCP server for OWASP ZAP vulnerability scanning with Docker management3stars
Black Duck Security Scannerblackducksoftware/mcp-serverAI-powered security scanning using Black Duck Signal for vulnerability detection.0stars
Sectorabraineetech/sectoraThreat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.0stars
Frogeye Security Scannerfrogeye-ai/mcpZero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.0stars