Log inSubmit server
Operant MCP logo

Operant MCP

by operantlabs

Security assessment tools for web vulnerabilities, reconnaissance, PCAP analysis, memory forensics, malware, and cloud logs.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Operant MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "operantlabs-operant-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "operant-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 62 tools correctly (9d ago).

Overview

operantlabs/operant-mcp MCP server exposes 51 security testing tools and eight methodology prompts through MCP. It runs from npm with npx or a global installation, and several modules call local utilities such as curl, tshark, dig, volatility, olevba, jq, and git. Use it for authorized web application testing, reconnaissance, network forensics, memory analysis, malware document review, and CloudTrail investigation. The available tools cover both active testing and analysis of supplied artifacts.

Use cases

  • Test authorized web applications for injection and access-control flaws
  • Analyze PCAP files for credentials, scans, DNS activity, and TLS details
  • Perform DNS, virtual-host, directory, and Git secret reconnaissance
  • Inspect Linux or Windows memory dumps
  • Review malware documents and CloudTrail activity

Key features

  • 51 security testing tools
  • Eight structured security assessment prompts
  • Web vulnerability testing across multiple attack classes
  • PCAP and network forensics
  • Linux and Windows memory analysis
  • Malware document and CloudTrail analysis

Tools62

What Operant MCP lets your agent do. Expand a tool for its parameters.

Verified live~11.9k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

18/19 checks healthy over the last 79d

What it can do

From the 62 tools this server returned when we ran it.

Runs commands · 3Handles credentials · 12Makes network requests · 19Read-only tools · 59
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age211 days
Maintainers1

Observed 2026-10-19 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · operant-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars26Stargazers on the source repository.
npm downloads363Package downloads in the last 30 days.
Last commit7mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed62Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Operant MCP works

What operantlabs/operant-mcp MCP server does

operantlabs/operant-mcp MCP server brings a broad security assessment toolkit into MCP-compatible AI clients. Its 51 tools cover web application testing, reconnaissance, network traffic analysis, memory forensics, malware document analysis, cloud log review, and several application security categories.

Web testing includes SQL injection, reflected XSS, command injection, path traversal, SSRF, CSRF token extraction, authentication and cookie checks, IDOR, privilege escalation, business-logic flaws, clickjacking, CORS, file uploads, NoSQL injection, deserialization, and GraphQL schema discovery. Reconnaissance tools handle DNS enumeration, virtual hosts, TLS certificate SANs, directory brute-forcing, Git secret searches, and S3 bucket permission checks.

The server also includes PCAP inspection for protocol and endpoint statistics, credential extraction, DNS queries, HTTP objects, scanning activity, streams, TLS/SNI details, and LLMNR/NTLM attacks. Memory tools target Linux and Windows analysis, while malware tools inspect OLE documents and extract VBA macros. CloudTrail analysis and anomaly detection round out the investigation features.

How it works

The package exposes MCP tools and eight prompts that guide structured workflows. Prompts cover web application penetration testing, PCAP forensics, memory analysis, reconnaissance, malware documents, CloudTrail, SQL injection, and XSS.

operantlabs/operant-mcp MCP server runs as a local process started with npx operant-mcp, or through the globally installed operant-mcp command. Tool behavior depends on the input supplied by the client and, for several modules, command-line programs available on the host. This makes it suitable for environments where the relevant targets, captures, dumps, logs, or repositories are accessible to the local process.

Setup and configuration

Start the package without a global install:

Terminal
npx operant-mcp

Alternatively, install it with npm and run the command:

Terminal
npm install -g operant-mcp
operant-mcp

An MCP client can launch it with the operant-mcp npm package as the command and -y plus operant-mcp as arguments. The README specifically documents configuration for Claude Code and provides installation links for Cursor and VS Code.

Required host utilities vary by feature. Most tools require curl; PCAP work requires tshark; DNS reconnaissance uses dig and host; memory analysis uses volatility, vol.py, or vol3; malware analysis uses olevba or oledump.py; cloud analysis uses jq; and secrets scanning uses git.

Tools and capabilities

The tool groups include SQL injection, XSS, command injection, path traversal, SSRF, PCAP/network forensics, reconnaissance, memory forensics, malware analysis, cloud security, authentication, access control, business logic, clickjacking, CORS, file uploads, NoSQL injection, deserialization, and GraphQL analysis.

operantlabs/operant-mcp MCP server is best matched to authorized assessments and investigation workflows that need several security disciplines in one MCP endpoint. Its prompts provide methodology guidance, while the individual tools support focused checks such as blind SQL injection timing, TLS analysis, rootkit detection, CloudTrail anomaly detection, and hidden GraphQL field discovery.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Operant MCP

operantlabs/operant-mcp is an MCP server that connects AI clients to local security assessment utilities and exposes tools for web vulnerability testing, reconnaissance, PCAP forensics, memory analysis, malware documents, and CloudTrail logs. It also provides methodology prompts for structured SQL injection, XSS, recon, forensics, malware, and cloud investigations.

Install it with `npx operant-mcp`, or run `npm install -g operant-mcp` followed by `operant-mcp`. MCP clients can launch the package with `npx`, `-y`, and `operant-mcp` arguments.

Yes, operantlabs/operant-mcp works with Cursor according to the repository’s installation link. Cursor can add the server using the provided MCP install configuration, which launches the npm package through `npx`.

Dependencies vary by module. Most tools require `curl`; PCAP analysis needs `tshark`; DNS reconnaissance uses `dig` and `host`; memory analysis uses a Volatility command; malware analysis uses `olevba` or `oledump.py`; cloud analysis uses `jq`; and Git secret scanning uses `git`.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewOperant MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/operantlabs-operant-mcp?style=directory)](https://allmcps.com/mcp/operantlabs-operant-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/operantlabs-operant-mcp"><img src="https://allmcps.com/api/badge/operantlabs-operant-mcp?style=directory" alt="Operant MCP on AllMCPs" /></a>