Niro

What Niro MCP server does

The supplied documentation presents Niro as a command-line application for automated application security testing. It works against web applications, APIs, and MCP servers that you authorize as targets. Before testing, it can start the application or use a supplied target, create users and data, seed test state, and address setup conditions that would otherwise prevent coverage.

A run has two distinct roles. An attacker agent probes the running application, looks for exploitable behavior, and produces a working exploit without modifying the code. A developer agent can then patch findings, add validation evidence such as regression tests, and open draft pull requests. People remain responsible for setting scope, reviewing changes, and deciding what merges.

How it works

Niro treats unproven reports as unconfirmed. Its workflow attacks reachable HTTP surfaces, creates missing tenants or login state when needed, and attempts to reproduce each suspected issue. Confirmed findings are grouped by root cause so related changes can be reviewed together. The result can include a report, exploit demonstrations, coverage gaps, validation evidence, and remediation pull requests.

The README describes local execution and CI workflows, including whole-application and focused runs. It also states that Niro does not proxy model requests or require sending repositories, credentials, findings, or logs to a Niro backend. AI-provider behavior and data boundaries depend on the provider and agent CLI used for the run.

Setup and configuration

The documented quick start begins in the project root after checking the prerequisites:

curl -fsSL https://raw.githubusercontent.com/apxlabs-ai/niro/main/install.sh | sh
niro fix

The fix command opens the selected agent CLI interactively with an initial instruction already submitted. Niro also supports report-only and scoped runs, local or CI execution, and focused developer-agent workflows. Target authorization and scope are configured through scope.yaml; attack tools run in a sandbox with network egress restricted to authorized targets.

An unattended run uses --autonomous. The documentation warns that this grants the agent CLI full current-user host access without approval prompts, so the associated privilege and threat-model documentation should be reviewed before enabling it.

Tools and capabilities

• Prepare application state, users, tenants, and test data for a run.
• Probe web applications, APIs, and MCP servers for exploitable bugs.
• Produce runnable exploit evidence for confirmed findings.
• Report unreachable areas and other coverage gaps.
• Patch selected findings and add validation evidence.
• Group fixes by root cause and open review-ready pull requests.

Limitations and notes

The Niro MCP server material does not document an MCP tool interface, hosted endpoint, or MCP-specific client configuration; it documents the Niro CLI. The software is strongest on common exploitable bug classes. The README notes that novel, multi-step business logic remains an area where humans are responsible for review. Coverage is limited by the targets and access authorized in scope.yaml, and every run may report areas it could not reach.

Niro Community Edition is free of charge but proprietary. The repository distributes a prebuilt binary and documentation rather than product source code. Its license permits installation, use, backup copies, and internal mirroring of the unmodified binary, while restricting public redistribution, resale, modification, and reverse engineering. Enterprise governance, audit, compliance, deployment, and commercial support are described as planned separately.