Log inSubmit server
Mythos Agent logo

Mythos Agent

AI-assisted application security analysis with code scanning, CVE variant detection, policy checks, and fix suggestions over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Mythos Agent

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mythos-agent": {
      "command": "npx",
      "args": [
        "-y",
        "mythos-agent"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y mythos-agent

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 13d ago.

Overview

The mythos-agent MCP server brings AI-assisted application security review to agent workflows, covering code patterns, secrets, dependencies, infrastructure configuration, and policy checks. It combines pattern scanning with AI-generated hypotheses, dynamic testing, and proof-of-concept generation to rank findings by confidence. Use it when an agent needs to inspect a codebase, investigate a known CVE, ask security questions, or produce remediation suggestions. A quick scan works without an API key, while the full autonomous hunt requires one.

Use cases

  • Scan an application for common security flaws and exposed secrets
  • Find code variants of a known CVE
  • Ask natural-language questions about authentication or other security risks
  • Generate and review AI-assisted remediation patches
  • Export findings as JSON, HTML, or SARIF

Key features

  • Hypothesis-driven vulnerability analysis
  • CVE variant analysis
  • Multi-stage finding verification
  • Policy-as-code checks for SOC2, HIPAA, PCI, and OWASP
  • SARIF, JSON, HTML, and terminal reporting
  • Continuous file-save monitoring

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

8/8 checks healthy over the last 45d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 12d ago via OSV.dev · mythos-agent (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars48Stargazers on the source repository.
npm downloads278Package downloads in the last 30 days.
Last commit5mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Mythos Agent works

What the mythos-agent MCP server does

The mythos-agent MCP server exposes application-security analysis through MCP while also providing a command-line interface. It reads a project, identifies likely vulnerabilities, explains the reasoning behind findings, and can suggest patches for review. Its coverage includes common code vulnerabilities such as SQL injection, cross-site scripting, command injection, eval, and SSRF; framework-specific checks; exposed secrets; dependency CVEs; infrastructure-as-code issues; API security problems; and selected AI or LLM security risks.

The project describes 15 wired scanners, 28 experimental scanners, and more than 329 rules. Experimental scanners are shipped and tested but are not reachable through the CLI, HTTP, MCP, or agent entry points yet. Default scanners run during a normal scan.

How it works

A standard scan combines pattern checks, secret detection, dependency analysis, infrastructure checks, and AI analysis. The broader hunt workflow divides the review into reconnaissance, hypothesis generation, analysis, and exploitation stages. Reconnaissance maps entry points, authentication boundaries, and data stores; later stages examine possible weaknesses, test findings, connect related issues, and generate reproductions where possible.

Findings move through a confidence process rather than being reported solely from a pattern match. A candidate can be examined with an AI hypothesis, tested dynamically with a smart fuzzer, and checked through generated proof-of-concept steps. Results are grouped as confirmed, likely, possible, or dismissed in the example output.

Variant analysis looks for the underlying cause of a known CVE instead of only matching its original syntax. For example, variants CVE-2021-44228 searches the project for structurally similar code, and variants --auto enables automatic detection and scanning of variants.

Setup and configuration

Install the package globally with npm and use the init command to configure an AI provider:

Terminal
npm install -g mythos-agent
mythos-agent init

The setup wizard supports Anthropic, OpenAI, Ollama, and LM Studio. A quick mythos-agent scan does not need an API key. The full autonomous workflow uses mythos-agent init followed by mythos-agent hunt and does require an API key.

The repository advertises Node.js 20 or newer.

Tools and capabilities

Available command-level capabilities include:

  • Run a normal project scan with scan [path].
  • Perform the multi-stage autonomous review with hunt [path].
  • Search for known-CVE variants with variants [cve-id].
  • Ask natural-language security questions with ask [question].
  • Analyze data flow and taint with taint [path].
  • Generate patches with fix [path], optionally using --apply.
  • Monitor file changes with watch.
  • Inspect results in a local web dashboard with dashboard.
  • Export terminal, JSON, HTML, or SARIF reports with report [path].
  • Apply policy-as-code checks for SOC2, HIPAA, PCI, and OWASP with policy.
  • Search, install, or publish community rules with rules.
  • Check installed external security tools with tools.

The mythos-agent MCP server is a fit for agent-assisted code review, security triage, remediation planning, and repeatable checks in development workflows.

Limitations and notes

The quick scan and full hunt have different setup requirements: the former works without an API key, while the latter needs one. Findings are presented with confidence categories and should be reviewed rather than treated as unconditional proof of a vulnerability. Some scanner implementations remain experimental and are not wired into the available entry points.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Mythos Agent

mythos-agent is an MCP server that connects AI agents to application-security analysis for a project codebase. Its main tools cover scanning, autonomous hunts, CVE variant detection, natural-language security questions, taint analysis, patch generation, policy checks, monitoring, and report export. It also provides a command-line interface.

Install it with `npm install -g mythos-agent`, then run `mythos-agent init` to configure an AI provider. The documented setup supports Anthropic, OpenAI, Ollama, and LM Studio, and the repository lists Node.js 20 or newer.

A quick `mythos-agent scan` does not need an API key. The full autonomous `mythos-agent hunt` workflow does require one and is started after running `mythos-agent init`.

Run `mythos-agent variants CVE-2021-44228` with the relevant CVE identifier. To let the tool detect candidate CVEs automatically, use `mythos-agent variants --auto`; the analyzer searches for structurally similar root causes rather than only matching surface syntax.

Yes. Use the `report [path]` command to export findings in SARIF, JSON, HTML, or terminal formats.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMythos Agent AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mythos-agent?style=directory)](https://allmcps.com/mcp/mythos-agent)
HTML Embed
<a href="https://allmcps.com/mcp/mythos-agent"><img src="https://allmcps.com/api/badge/mythos-agent?style=directory" alt="Mythos Agent on AllMCPs" /></a>