Is Mergen Mcp safe to use?

Mergen Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Mergen Mcp?

Mergen Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Mergen Mcp?

Mergen Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Mergen Mcp actively maintained?

Mergen Mcp is less actively maintained — last commit was 91 days ago. It has 9 GitHub stars.

Mergen Mcp

Name: Mergen Mcp
Author: g4sk0

by g4sk0

Mergen is an MCP server that gives your AI a real red team brain. It doesn't just run tools, it picks the right ones, chains them together, and actually makes sense of the output. Built by pentesters, for pentesters who are tired of babysitting scripts.

9 0 tools GitHub

No known CVEs

MIT license

Maintained

Last commit 91d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mergen-ai": {
      "args": [
        "/path/to/mergen_mcp.py",
        "--server",
        "http://KALI_IP:8000"
      ],
      "command": "python3",
      "timeout": 300,
      "disabled": false,
      "description": "Mergen (BETA) — AI-Powered Red Team MCP Server"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mergen-mcp)](https://mcppedia.org/s/mergen-mcp)

Read me

What Mergen Mcp does

AI-native MCP server that gives Claude, Cursor, Antigravity and any MCP-compatible agent full penetration testing capabilities — autonomous planning, adaptive execution, and professional reporting across 44+ security tools.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

37/100across 5 weighted dimensions

How we score →

0255075100

−63

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Mergen Mcp safe to use?: Mergen Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Mergen Mcp?: Mergen Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Mergen Mcp?: Mergen Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Mergen Mcp actively maintained?: Mergen Mcp is less actively maintained — last commit was 91 days ago. It has 9 GitHub stars.

Similar servers

Others in security

View all →

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

8.9k 3

Nothumanallowed91

Security-first platform for AI agents. 38 specialized agents, 15 AI-powered extensions, zero-knowledge multi-agent orchestration. SENTINEL WAF, Ed25519 auth, 2.6M grounding facts.

97 5

MCP Security Weekly

Get CVE alerts and security updates for Mergen Mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mergen-ai": {
      "args": [
        "/path/to/mergen_mcp.py",
        "--server",
        "http://KALI_IP:8000"
      ],
      "command": "python3",
      "timeout": 300,
      "disabled": false,
      "description": "Mergen (BETA) — AI-Powered Red Team MCP Server"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mergen-mcp)](https://mcppedia.org/s/mergen-mcp)

Read me

What Mergen Mcp does

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

Mergen — AI-Powered Red Team MCP Server

Autonomous Penetration Testing via Model Context Protocol

Architecture • Installation • AI Agent Setup • MCP Commands • Tool Arsenal • API Reference • Troubleshooting

Architecture Overview

Mergen BETA features a multi-layer architecture combining a FastAPI backend, an adaptive AI attack engine, and a plugin system with automatic discovery.

graph TD
    A[AI Agent - Claude / Cursor / GPT] -->|MCP Protocol - stdio or SSE| B[mergen_mcp.py - MCP Proxy]
    B -->|HTTP REST| C[server.py - FastAPI Core]

    C --> D[AI Attack Engine]
    C --> E[Process Manager]
    C --> F[Memory Engine]

    D --> G[TargetProfiler]
    D --> H[KillChainBuilder - 41 chains]
    D --> I[AdaptiveExecutionEngine]

    F --> J[Operation History]
    F --> K[Learning Database]
    F --> L[Recon Cache - TTL]

    C --> M[Plugin Manager - 44 tools]
    M --> N[Recon Plugins]
    M --> O[Web Security Plugins]
    M --> P[Exploit Plugins]
    M --> Q[Binary Analysis Plugins]

    C --> R[Correlation Engine]
    C --> S[Defense Detector]
    C --> T[Playbook Selector]

    C --> U[Dashboard - WebSocket]
    C --> V[SQLite - sessions.db]

    style A fill:#4a0000,color:#fff
    style B fill:#6a0000,color:#fff
    style C fill:#8b0000,color:#fff
    style D fill:#333,color:#fff
    style M fill:#333,color:#fff

How It Works

Agent Connection — Claude, Cursor, or any MCP-compatible agent connects via the stdio or SSE transport.
Target Profiling — TargetProfiler classifies the target (IP, domain, URL, CIDR) and identifies the technology stack.
Kill Chain Selection — KillChainBuilder selects from 41 predefined attack chains based on target type and operator mode.
Adaptive Execution — AdaptiveExecutionEngine runs tools in sequence, updating the plan dynamically as results arrive.
Correlation — The correlation engine normalizes findings from multiple tools and assigns unified risk scores.
Reporting — Results are persisted in SQLite and exported as HTML, JSON, or CSV.

Installation

Requirements

Requirement	Version
Operating System	Kali Linux (recommended), Debian/Ubuntu
Python	3.10+
Disk Space	~2 GB with all tools installed
RAM	2 GB minimum, 4 GB recommended

Automated Installation

git clone https://github.com/g4sk0/mergen-mcp.git
cd mergen-mcp
sudo bash install.sh

install.sh handles everything automatically:

Creates a Python virtual environment
Installs all Python dependencies from requirements.txt
Installs 36+ security tools via apt
Registers the mergen command on system PATH
Optionally creates a systemd service for persistent operation

Manual Installation

git clone https://github.com/g4sk0/mergen-mcp.git
cd mergen-mcp

python3 -m venv venv
sour

... [View full README on GitHub](https://github.com/g4sk0/mergen-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

37/100across 5 weighted dimensions

How we score →

0255075100

−63

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Mergen Mcp safe to use?: Mergen Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Mergen Mcp?: Mergen Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Mergen Mcp?: Mergen Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Mergen Mcp actively maintained?: Mergen Mcp is less actively maintained — last commit was 91 days ago. It has 9 GitHub stars.

Similar servers

Others in security

View all →

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

8.9k 3

Nothumanallowed91

Security-first platform for AI agents. 38 specialized agents, 15 AI-powered extensions, zero-knowledge multi-agent orchestration. SENTINEL WAF, Ed25519 auth, 2.6M grounding facts.

97 5

MCP Security Weekly

Get CVE alerts and security updates for Mergen Mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?