MCP Red Team Server

A Model Context Protocol (MCP) server for orchestrating red team security assessments. This server enables LLMs to manage security operations, agents, targets, and findings through structured tool calls aligned with the MITRE ATT&CK framework.

Features

• 45 MCP Tools organized by MITRE ATT&CK workflow stages
• Multi-LLM Support - Works with Claude, GPT-4, Gemini, and any MCP-compatible model
• Security Integrations - VirusTotal, AlienVault OTX, and HackerOne APIs
• Operation Management - Track assessments from planning through reporting
• Finding Documentation - Record vulnerabilities with severity, evidence, and CVSS scores

Quick Start

Prerequisites

• Node.js 18+
• npm or yarn

Installation

# Clone the repository
git clone https://github.com/yourusername/mcp-redteam-server.git
cd mcp-redteam-server

# Install dependencies
npm install

# Start the server
npm run dev

MCP Client Configuration

Add to your MCP client configuration (e.g., Claude Desktop):

{
  "mcpServers": {
    "redteam": {
      "command": "npm",
      "args": ["run", "start"],
      "cwd": "/path/to/mcp-redteam-server"
    }
  }
}

Tools by Workflow Stage

Planning (7 tools)

Setup agents, operations, and targets before engagement.

Tool	Description
create_agent	Create a new agent with type and capabilities
list_agents	List all agents, optionally filtered by status
get_agent	Get detailed info about a specific agent
update_agent	Update agent properties
create_operation	Create a new operation targeting a system
create_target	Define a target (web app, network, host, API, database, cloud)
hackerone_create_asset	Create asset in HackerOne organization

Reconnaissance (16 tools)

Gather intelligence on targets using built-in tools and external APIs.

Tool	Description
list_operations	List operations with status/phase filters
get_operation	Get operation details including findings
list_targets	List all targets with optional type filter
get_target	Get target details including vulnerabilities
update_target	Update target information
virustotal_scan_hash	Look up file hash on VirusTotal
virustotal_scan_url	Scan URL for malicious content
virustotal_scan_ip	Get VirusTotal IP address report
virustotal_scan_domain	Get VirusTotal domain report
otx_get_indicator	Get AlienVault OTX threat intelligence
otx_get_pulses	Get OTX threat feeds/pulses
hackerone_get_program	Get HackerOne program details and scope
hackerone_get_programs	List all accessible HackerOne programs
hackerone_list_assets	List assets in a HackerOne organization
hackerone_get_activities	Get activity feed for a program

Exploitation (4 tools)

Execute attacks, activate agents, and record vulnerabilities.

Tool	Description
activate_agent	Set agent status to active for deployment
start_operation	Begin execution of an operation
update_operation	Update operation phase or details
add_vulnerability	Record a vulnerability on a target

Post-Exploitation (3 tools)

Document findings during active exploitation.

Tool	Description
add_finding	Record a security finding with severity, evidence, and mitigation
hackerone_create_report	Create/import vulnerability report to HackerOne
hackerone_update_severity	Update severity of a HackerOne report

Reporting (15 tools)

Generate

... View full README on GitHub