{
  "slug": "io-github-xplo8e-hacktricks-mcp-server",
  "name": "HackTricks MCP Server",
  "auditedAt": "2026-10-24T01:06:19Z",
  "version": "1.3.4",
  "ecosystem": "npm",
  "package": "hacktricks-mcp-server",
  "disclaimer": "Automated smoke test, not a security guarantee.",
  "complete": true,
  "checks": {
    "versionPin": {
      "status": "pass",
      "detail": "Pinned npm hacktricks-mcp-server@1.3.4",
      "version": "1.3.4"
    },
    "vulnerabilities": {
      "status": "pass",
      "detail": "No critical, high, or medium advisories were returned.",
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "packagesScanned": 80
    },
    "license": {
      "status": "pass",
      "detail": "MIT",
      "spdx": "MIT"
    },
    "installScripts": {
      "status": "warn",
      "detail": "Install-time scripts: postinstall",
      "scripts": [
        "postinstall"
      ]
    },
    "secrets": {
      "status": "pass",
      "detail": "No credential patterns in the published artifact.",
      "findings": []
    },
    "packageSize": {
      "status": "pass",
      "detail": "11525 bytes",
      "bytes": 11525
    },
    "activity": {
      "status": "warn",
      "detail": "Last activity was 300 days ago.",
      "ageDays": 300
    },
    "sandbox": {
      "status": "pass",
      "detail": "MCP handshake completed. 7 tools listed.",
      "starts": true,
      "handshake": true,
      "timeToReadyMs": 183,
      "tools": [
        {
          "name": "search_hacktricks",
          "description": "Search HackTricks for pentesting techniques, exploits, and security info. Returns results GROUPED BY FILE with: page title, match count, relevant sections, and top matches. WORKFLOW: search \u2192 get_hacktricks_outline (see structure) \u2192 get_hac"
        },
        {
          "name": "get_hacktricks_page",
          "description": "Get FULL page content. \u26a0\ufe0f EXPENSIVE: Pages average 3000-15000 tokens. PREFER: get_hacktricks_section for specific topics, get_hacktricks_cheatsheet for just commands. Only use this when you need the complete page or multiple sections."
        },
        {
          "name": "get_hacktricks_outline",
          "description": "Get TABLE OF CONTENTS (all section headers) of a page. Returns ~20-50 lines showing page structure. Use this FIRST after search to: (1) verify page is relevant, (2) find exact section names for get_hacktricks_section. Cost: ~100 tokens vs 3"
        },
        {
          "name": "get_hacktricks_section",
          "description": "Extract ONE SECTION from a page. MOST EFFICIENT way to read content. Typical sections: 'Exploitation', 'Enumeration', 'Prevention', 'Example', 'Payload', 'PoC', 'Bypass'. Use get_hacktricks_outline first to see exact section names. Returns "
        },
        {
          "name": "get_hacktricks_cheatsheet",
          "description": "Extract ALL CODE BLOCKS from a page (commands, payloads, scripts, one-liners). Skips explanatory text. Perfect for: 'give me the exploit command', 'show me the payload', 'what's the syntax'. Returns code with language tags (bash, python, et"
        },
        {
          "name": "list_hacktricks_categories",
          "description": "Browse HackTricks structure. Without params: list all categories. With category: show all pages in that category. Use when: (1) unsure which category to search, (2) want to explore what's available, (3) need exact file paths."
        },
        {
          "name": "hacktricks_quick_lookup",
          "description": "\u26a1 ONE-SHOT exploitation lookup. Searches, finds best page, and returns exploitation sections + code blocks. Use for: 'how do I exploit X', 'give me X payload', 'X attack technique'. Handles aliases (sqli\u2192SQL injection, xss\u2192Cross-site script"
        }
      ],
      "toolCount": 7,
      "resourceCount": null,
      "promptCount": null,
      "stderrExcerpt": "HackTricks MCP Server v1.3.0 running on stdio\n",
      "requiresCredentials": false,
      "network": "disabled",
      "networkAttemptedWhileOffline": false,
      "outboundHosts": []
    }
  },
  "tier": "tested",
  "tierReason": "Sandbox handshake completed, with warnings: install scripts present; not active within 180 days.",
  "logExcerpt": "HackTricks MCP Server v1.3.0 running on stdio\n"
}