# operantlabs/operant-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/operantlabs/operant-mcp  
**GitHub Stars:** 23  
**npm Downloads (last month):** 229  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/operantlabs-operant-mcp

## Description
Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment.

## Tools
Capabilities this server exposes over MCP:

- **sqli_where_bypass** — Test OR-based WHERE clause bypass
- **sqli_login_bypass** — Test login form SQL injection
- **sqli_union_extract** — UNION-based data extraction
- **sqli_blind_boolean** — Boolean-based blind SQLi
- **sqli_blind_time** — Time-based blind SQLi
- **sqli_file_read** — Read files via LOAD_FILE()
- **xss_reflected_test** — Test reflected XSS with 10 payloads
- **xss_payload_generate** — Generate context-aware XSS payloads
- **cmdi_test** — Test OS command injection
- **cmdi_blind_detect** — Blind command injection via sleep timing
- **path_traversal_test** — Test directory traversal with encoding variants
- **ssrf_test** — Test SSRF with localhost bypass variants
- **ssrf_cloud_metadata** — Test cloud metadata access via SSRF
- **pcap_overview** — Protocol hierarchy and endpoint stats
- **pcap_extract_credentials** — Extract FTP/HTTP/SMTP credentials
- **pcap_dns_analysis** — DNS query analysis
- **pcap_http_objects** — Export HTTP objects
- **pcap_detect_scan** — Detect port scanning
- **pcap_follow_stream** — Follow TCP/UDP streams
- **pcap_tls_analysis** — TLS/SNI analysis
- **pcap_llmnr_ntlm** — Detect LLMNR/NTLM attacks
- **recon_quick** — Quick recon (robots.txt, headers, common dirs)
- **recon_dns** — Full DNS enumeration
- **recon_vhost** — Virtual host discovery
- **recon_tls_sans** — Extract SANs from TLS certificates
- **recon_directory_bruteforce** — Directory brute-force
- **recon_git_secrets** — Search git repos for secrets
- **recon_s3_bucket** — Test S3 bucket permissions
- **volatility_linux** — Linux memory analysis (Volatility 2)
- **volatility_windows** — Windows memory analysis (Volatility 3)
- **memory_detect_rootkit** — Linux rootkit detection
- **maldoc_analyze** — Full OLE document analysis pipeline
- **maldoc_extract_macros** — Extract VBA macros
- **cloudtrail_analyze** — CloudTrail log analysis
- **cloudtrail_find_anomalies** — Detect anomalous CloudTrail events
- **auth_csrf_extract** — Extract CSRF tokens
- **auth_bruteforce** — Username enumeration + credential brute-force
- **auth_cookie_tamper** — Cookie tampering test
- **idor_test** — Test for IDOR vulnerabilities
- **role_escalation_test** — Test privilege escalation
- **price_manipulation_test** — Test price/quantity manipulation
- **coupon_abuse_test** — Test coupon stacking/reuse
- **clickjacking_test** — Test X-Frame-Options/CSP
- **frame_buster_bypass** — Test frame-busting bypass
- **cors_test** — Test CORS misconfigurations
- **file_upload_test** — Test file upload bypasses
- **nosqli_auth_bypass** — MongoDB auth bypass
- **nosqli_detect** — NoSQL injection detection
- **deserialization_test** — Test insecure deserialization
- **graphql_introspect** — Full schema introspection
- **graphql_find_hidden** — Discover hidden fields

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "operant-mcp": {
    "command": "npx",
    "args": ["-y","operant-mcp"]
  }
}
```

## Documentation & README

# operant-mcp

[![NPM Version](https://img.shields.io/npm/v/operant-mcp?color=red)](https://www.npmjs.com/package/operant-mcp) [![npm downloads](https://img.shields.io/npm/dw/operant-mcp)](https://www.npmjs.com/package/operant-mcp) [![GitHub stars](https://img.shields.io/github/stars/operantlabs/operant-mcp?style=social)](https://github.com/operantlabs/operant-mcp) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![TypeScript](https://img.shields.io/badge/TypeScript-5.7-blue.svg)](https://www.typescriptlang.org/) ![MCP Server](https://badge.mcpx.dev?type=server&features=tools,prompts 'MCP Server with Tools and Prompts') [![smithery badge](https://smithery.ai/badge/operant-mcp)](https://smithery.ai/server/operant-mcp)

[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=operant-mcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm9wZXJhbnQtbWNwIl19) [![Install in Cursor](https://img.shields.io/badge/Cursor-Install_Server-000000?style=flat-square&logo=cursor&logoColor=white)](https://cursor.com/en/install-mcp?name=operant-mcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm9wZXJhbnQtbWNwIl19)

<a href="https://glama.ai/mcp/servers/operantlabs/operant-mcp">
  <img width="380" height="200" src="https://glama.ai/mcp/servers/operantlabs/operant-mcp/badge" alt="operant-mcp MCP server" />
</a>

Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment.

## Quick Start

```bash
npx operant-mcp
```

Or install globally:

```bash
npm install -g operant-mcp
operant-mcp
```

## Usage with Claude Code

Add to your MCP config:

```json
{
  "mcpServers": {
    "operant": {
      "command": "npx",
      "args": ["-y", "operant-mcp"]
    }
  }
}
```

## Tools (51)

### SQL Injection (6)
- `sqli_where_bypass` — Test OR-based WHERE clause bypass
- `sqli_login_bypass` — Test login form SQL injection
- `sqli_union_extract` — UNION-based data extraction
- `sqli_blind_boolean` — Boolean-based blind SQLi
- `sqli_blind_time` — Time-based blind SQLi
- `sqli_file_read` — Read files via LOAD_FILE()

### XSS (2)
- `xss_reflected_test` — Test reflected XSS with 10 payloads
- `xss_payload_generate` — Generate context-aware XSS payloads

### Command Injection (2)
- `cmdi_test` — Test OS command injection
- `cmdi_blind_detect` — Blind command injection via sleep timing

### Path Traversal (1)
- `path_traversal_test` — Test directory traversal with encoding variants

### SSRF (2)
- `ssrf_test` — Test SSRF with localhost bypass variants
- `ssrf_cloud_metadata` — Test cloud metadata access via SSRF

### PCAP/Network Forensics (8)
- `pcap_overview` — Protocol hierarchy and endpoint stats
- `pcap_extract_credentials` — Extract FTP/HTTP/SMTP credentials
- `pcap_dns_analysis` — DNS query analysis
- `pcap_http_objects` — Export HTTP objects
- `pcap_detect_scan` — Detect port scanning
- `pcap_follow_stream` — Follow TCP/UDP streams
- `pcap_tls_analysis` — TLS/SNI analysis
- `pcap_llmnr_ntlm` — Detect LLMNR/NTLM attacks

### Reconnaissance (7)
- `recon_quick` — Quick recon (robots.txt, headers, common dirs)
- `recon_dns` — Full DNS enumeration
- `recon_vhost` — Virtual host discovery
- `recon_tls_sans` — Extract SANs from TLS certificates
- `recon_directory_bruteforce` — Directory brute-force
- `recon_git_secrets` — Search git repos for secrets
- `recon_s3_bucket` — Test S3 bucket permissions

### Memory Forensics (3)
- `volatility_linux` — Linux memory analysis (Volatility 2)
- `volatility_windows` — Windows memory analysis (Volatility 3)
- `memory_detect_rootkit` — Linux rootkit detection

### Malware Analysis (2)
- `maldoc_analyze` — Full OLE document analysis pipeline
- `maldoc_extract_macros` — Extract VBA macros

### Cloud Security (2)
- `cloudtrail_analyze` — CloudTrail log analysis
- `cloudtrail_find_anomalies` — Detect anomalous CloudTrail events

### Authentication (3)
- `auth_csrf_extract` — Extract CSRF tokens
- `auth_bruteforce` — Username enumeration + credential brute-force
- `auth_cookie_tamper` — Cookie tampering test

### Access Control (2)
- `idor_test` — Test for IDOR vulnerabilities
- `role_escalation_test` — Test privilege escalation

### Business Logic (2)
- `price_manipulation_test` — Test price/quantity manipulation
- `coupon_abuse_test` — Test coupon stacking/reuse

### Clickjacking (2)
- `clickjacking_test` — Test X-Frame-Options/CSP
- `frame_buster_bypass` — Test frame-busting bypass

### CORS (1)
- `cors_test` — Test CORS misconfigurations

### File Upload (1)
- `file_upload_test` — Test file upload bypasses

### NoSQL Injection (2)
- `nosqli_auth_bypass` — MongoDB auth bypass
- `nosqli_detect` — NoSQL injection detection

### Deserialization (1)
- `deserialization_test` — Test insecure deserialization

### GraphQL (2)
- `graphql_introspect` — Full schema introspection
- `graphql_find_hidden` — Discover hidden fields

## Prompts (8)

Methodology guides for structured security assessments:

- `web_app_pentest` — Full web app pentest methodology
- `pcap_forensics` — PCAP analysis workflow
- `memory_forensics` — Memory dump analysis (Linux/Windows)
- `recon_methodology` — Reconnaissance checklist
- `malware_analysis` — Malware document analysis
- `cloud_security_audit` — CloudTrail analysis workflow
- `sqli_methodology` — SQL injection testing guide
- `xss_methodology` — XSS testing guide

## System Requirements

Tools require various CLI utilities depending on the module:

- **Most tools**: `curl`
- **PCAP analysis**: `tshark` (Wireshark CLI)
- **DNS recon**: `dig`, `host`
- **Memory forensics**: `volatility` / `vol.py` / `vol3`
- **Malware analysis**: `olevba`, `oledump.py`
- **Cloud analysis**: `jq`
- **Secrets scanning**: `git`

## License

MIT