# mythos-agent [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/mythos-agent/mythos-agent  
**GitHub Stars:** 48  
**npm Downloads (last month):** 278  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mythos-agent

## Description
Open-source AI security agent: SAST, DAST, and policy-as-code over MCP.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mythos-agent": {
    "command": "npx",
    "args": ["-y","mythos-agent"]
  }
}
```

## Documentation

## What the mythos-agent MCP server does

The mythos-agent MCP server exposes application-security analysis through MCP while also providing a command-line interface. It reads a project, identifies likely vulnerabilities, explains the reasoning behind findings, and can suggest patches for review. Its coverage includes common code vulnerabilities such as SQL injection, cross-site scripting, command injection, `eval`, and SSRF; framework-specific checks; exposed secrets; dependency CVEs; infrastructure-as-code issues; API security problems; and selected AI or LLM security risks.

The project describes 15 wired scanners, 28 experimental scanners, and more than 329 rules. Experimental scanners are shipped and tested but are not reachable through the CLI, HTTP, MCP, or agent entry points yet. Default scanners run during a normal scan.

## How it works

A standard scan combines pattern checks, secret detection, dependency analysis, infrastructure checks, and AI analysis. The broader `hunt` workflow divides the review into reconnaissance, hypothesis generation, analysis, and exploitation stages. Reconnaissance maps entry points, authentication boundaries, and data stores; later stages examine possible weaknesses, test findings, connect related issues, and generate reproductions where possible.

Findings move through a confidence process rather than being reported solely from a pattern match. A candidate can be examined with an AI hypothesis, tested dynamically with a smart fuzzer, and checked through generated proof-of-concept steps. Results are grouped as confirmed, likely, possible, or dismissed in the example output.

Variant analysis looks for the underlying cause of a known CVE instead of only matching its original syntax. For example, `variants CVE-2021-44228` searches the project for structurally similar code, and `variants --auto` enables automatic detection and scanning of variants.

## Setup and configuration

Install the package globally with npm and use the `init` command to configure an AI provider:

```bash
npm install -g mythos-agent
mythos-agent init
```

The setup wizard supports Anthropic, OpenAI, Ollama, and LM Studio. A quick `mythos-agent scan` does not need an API key. The full autonomous workflow uses `mythos-agent init` followed by `mythos-agent hunt` and does require an API key.

The repository advertises Node.js 20 or newer.

## Tools and capabilities

Available command-level capabilities include:

- Run a normal project scan with `scan [path]`.
- Perform the multi-stage autonomous review with `hunt [path]`.
- Search for known-CVE variants with `variants [cve-id]`.
- Ask natural-language security questions with `ask [question]`.
- Analyze data flow and taint with `taint [path]`.
- Generate patches with `fix [path]`, optionally using `--apply`.
- Monitor file changes with `watch`.
- Inspect results in a local web dashboard with `dashboard`.
- Export terminal, JSON, HTML, or SARIF reports with `report [path]`.
- Apply policy-as-code checks for SOC2, HIPAA, PCI, and OWASP with `policy`.
- Search, install, or publish community rules with `rules`.
- Check installed external security tools with `tools`.

The mythos-agent MCP server is a fit for agent-assisted code review, security triage, remediation planning, and repeatable checks in development workflows.

## Limitations and notes

The quick scan and full hunt have different setup requirements: the former works without an API key, while the latter needs one. Findings are presented with confidence categories and should be reviewed rather than treated as unconditional proof of a vulnerability. Some scanner implementations remain experimental and are not wired into the available entry points.

_Full upstream README: https://allmcps.com/mcp/mythos-agent/readme_