Operant MCP

Run introspection query to enumerate all types, fields, and mutations. Sends the standard GraphQL introspection query (__schema) to discover the full API schema including hidden/undocumented fields, mutations, and types. Returns: {introspection_enabled, types: [{name, kind, fields: [str]}], mutations: [str], queries: [str]}. Side effects: Single POST request. Read-only.

Test Insecure Direct Object References by iterating through IDs/GUIDs. Sends requests with each ID and compares response status codes and lengths. Differing responses suggest IDOR — the server returns data for other users' objects without proper authorization checks. Returns: {"baseline": dict, "results": [{"id": str, "status": int, "length": int, "different": bool, "snippet": str}], "idor_candidates": [str]}. Side effects: Read-only requests. Sends len(id_list) + 1 requests. Errors: ConnectionError if target unreachable.

Full malware document analysis pipeline. 1. oledump.py — list OLE streams, identify macro-containing streams (marked 'M') 2. olevba — extract VBA macro code 3. Identify auto-execution triggers (Document_open, AutoOpen, Workbook_Open) 4. Look for obfuscation patterns and base64 payloads 5. Search for PowerShell, WMI, and shell execution indicators Returns: {"ole_streams": str, "vba_macros": str, "auto_exec_triggers": [str], "suspicious_strings": [str], "iocs": [str]}. Side effects: Read-only file analysis. Does NOT execute any payloads. Errors: Requires oledump.py and olevba (pip install ol…

Extract raw VBA macros from an OLE document. Returns: {"macros": str, "stream_count": int, "macro_streams": [str]}. Side effects: Read-only file analysis.

Check for rootkits via syscall table tampering and hidden kernel modules. Runs linux_check_syscall and linux_hidden_modules plugins. Returns syscall_check, hidden_modules, rootkit_indicators, and likely_compromised. Read-only analysis.

Test NoSQL operator injection ($ne, $gt, $regex) for authentication bypass. Sends payloads that abuse MongoDB query operators to bypass password checks. E.g., {"username":"admin","password":{"$ne":""}} matches any non-empty password. Returns: {results: [{payload_name, status, length, likely_bypass, snippet}]}. Side effects: Sends POST requests to the login endpoint. May create sessions.

Test NoSQL injection detection in query parameters. Tests MongoDB operator injection ($ne, $gt, $regex, $where) in GET parameters and JSON body to detect NoSQL injection points. Returns: {baseline, results: [{payload_name, status, length, different}], injectable}. Side effects: Read-only. Sends ~10 requests.

Run nuclei vulnerability scanner against a target. Supports template IDs, tags (cve, xss, sqli, etc.), and severity filtering. Returns array of findings in JSON format. Side effects: Sends multiple HTTP requests to target based on templates.

Generate category-specific out-of-band payloads using an OAST domain. Supports: sqli_oracle, sqli_mssql, sqli_mysql, xxe, ssrf, cmdi, ldap. Returns ready-to-use payload strings.

Read the interactsh JSON output file for new OOB interactions. Returns array of interactions with type, remote_address, raw_request, and timestamp.

Start an interactsh-client listener in the background. Returns the unique OAST domain and session file path for polling interactions later. Side effects: Spawns a background interactsh-client process writing JSON to /tmp.

Discover hidden parameters on a URL using arjun. Sends requests with parameter wordlists to detect reflected or functional parameters. Returns list of discovered parameter names.

Test path traversal with encoding variants at multiple depths. Tries plain ../, URL-encoded %2e%2e/, double-encoded %252e%252e/, and null-byte/truncation bypasses. Returns results array with payload, status, length, contains_target per attempt, and vulnerable_payloads list. Side effects: Read-only GET requests. Sends ~32 requests.

Detect port scans by analyzing SYN packets without ACK. Returns scanners (ip + syn_count), top_scanned_ports, and a hint. Read-only file analysis.

Extract and analyze DNS queries from a PCAP. Returns dns_queries_by_frequency, dns_servers, and ipv6_dns_endpoints. Read-only file analysis.

Extract credentials from FTP, HTTP, and SMTP traffic. Returns ftp_credentials, http_authorization_headers, http_post_data, and smtp_data. Read-only, may contain sensitive credentials.

Follow a TCP/UDP/HTTP stream in a PCAP. Returns stream_content, stream_num, and protocol. Read-only file analysis.

Export HTTP objects (files) from a PCAP to a directory. Returns exported_count, output_dir, files list, and tshark_output. Creates files in the output directory.

Detect LLMNR poisoning and extract NTLM credentials from SMB. Returns llmnr_queries, ntlm_auth_entries, counts, and poisoning_indicators. Read-only file analysis.

Get protocol hierarchy and endpoint statistics from a PCAP. Returns protocol_hierarchy, endpoints, packet_count, and capture_info. Read-only file analysis, no network access.

Analyze TLS handshakes, SNI values, and certificate data in a PCAP. Returns sni_values, tls_versions, server_ephemeral_keys, and client_randoms. Read-only file analysis.

Test client-side price manipulation by sending modified price values. Sends price=0, price=1, price=-1, and negative quantity variants to check if the server validates prices server-side. Returns: {"results": [{"test_case": str, "payload": str, "status": int, "length": int, "accepted": bool, "snippet": str}]}. Side effects: May add items to cart or create orders at manipulated prices.

Last-byte synchronization race condition attack. Sends all requests minus their final byte, pauses, then sends all final bytes simultaneously. Works over HTTP/1.1 with multiple connections. Returns array of responses.

HTTP/2 single-packet race condition attack. Multiplexes all requests into a single TCP packet so they arrive simultaneously at the server. Used to exploit TOCTOU bugs like double-spending, coupon reuse, parallel account creation. Returns array of responses with status codes.

Send multiple raw HTTP requests on a single TLS connection. Useful for testing connection-level attacks like request smuggling, pipeline confusion, and socket poisoning.

HTTP/2 request smuggling via Python h2 library with header validation disabled. Allows CRLF in header values and appending smuggled HTTP/1.1 requests in the body. Returns all responses received.

Send raw bytes over a TLS socket to a target host. Bypasses HTTP library normalization — useful for smuggling, CRLF injection, malformed requests. Returns the first 4096 bytes of the raw response.

Directory brute-force using parallel curl requests. Returns results (path/status/length), found_count, and paths_tested. Read-only GET requests, sends one request per wordlist entry per extension.

Full DNS enumeration: A, AAAA, MX, TXT, NS, CNAME, AXFR, BIND version. Returns records object, axfr_result, and bind_version. Read-only DNS queries.

Search git history for secrets: commit messages, author info, branches, deleted files. Returns secrets_in_code_history, unique_authors, branches, deleted_files_summary, and suspicious_commit_messages. Read-only git operations on local repository.

Quick reconnaissance: robots.txt, security.txt, common dirs, response headers. Returns robots_txt, security_txt, response_headers, accessible_directories, and error_page_snippet. Read-only, sends ~10 GET requests.

Test an S3 bucket for public access (listing, reading). Returns bucket_url, listable, listing_snippet, and readable_files. Read-only requests to S3.

Extract Subject Alternative Names from the TLS certificate. Returns common_name, subject_alternative_names, issuer, validity, and san_count. Read-only TLS handshake.

Brute-force virtual hosts by fuzzing the Host header. Returns baseline_length, results (vhost/status/length/length_delta), unique_vhosts, and tested count. Read-only, sends one request per wordlist entry.

Test cookie/parameter-based role escalation. Sends requests with various role cookie values (Admin=true, roleid=2, etc.) and checks for privilege escalation. Also tests JSON body field manipulation for profile update endpoints. Returns: {"baseline": dict, "results": [{"value": str, "status": int, "length": int, "escalated": bool}], "escalation_candidates": [str]}. Side effects: If json_body is set, sends POST/PUT requests that may modify state.

Boolean-based blind SQLi with binary search character enumeration. Uses ASCII(SUBSTRING(...))>N technique with binary search for efficiency. Determines true/false by comparing response lengths. Returns extracted_value, characters_found, requests_sent. Side effects: Read-only. Sends ~8 requests per character (binary search on ASCII 32-126).

Time-based blind SQLi detection for MySQL, PostgreSQL, and MSSQL. Sends sleep-inducing payloads and measures response time to detect injection. Returns vulnerable, dbtype, and results array with payload, response_time, triggered. Side effects: Read-only but slow (each payload waits up to delay_seconds). Sends 3 requests.

Read server files via UNION SELECT LOAD_FILE(). Requires MySQL FILE privilege. Uses LOAD_FILE() in a UNION SELECT. Returns file_content, success, target_file. Errors: FILE privilege required. Returns empty if privilege denied.

Bypass login via SQL comment truncation (administrator'--). Extracts CSRF token from form, then POSTs with SQLi in the username field. The -- comment truncates the password check. Returns csrf_extracted, status_code, response_length, headers, likely_bypass.

Step-by-step UNION-based data extraction. 1. Finds column count via ORDER BY. 2. Identifies string-displayable columns via UNION SELECT. 3. Extracts database name and version. 4. Lists tables and columns. Returns column_count, string_columns, db_name, db_version, tables, user_columns. Side effects: Read-only GET requests. Sends ~30 requests depending on column count.

Test WHERE clause bypass via OR 1=1 variants. Sends multiple payloads (OR 1=1--, OR '1'='1, OR 1=1/*, etc.) against the target parameter and compares response lengths to the baseline. Returns baseline_length and results array. Side effects: None (read-only GET requests). Sends 7 requests total.

Test SSRF access to cloud metadata endpoints (AWS/GCP/Azure). Attempts to reach instance metadata services through the SSRF vector. Returns results array with provider, endpoint, status, length, response_snippet. Side effects: May cause target to request cloud metadata. Could expose IAM credentials if successful.

Test SSRF with localhost bypass variants. Sends 10+ representations of localhost (127.0.0.1, 0, decimal, hex, IPv6, etc.) to check if the server fetches internal resources. Returns results array with variant, payload_url, status, length, different_from_baseline per attempt. Side effects: May cause the target server to make internal requests.

Run a Volatility 2 Linux plugin against a memory dump. Returns plugin, profile, success, output, and errors. Read-only analysis. Requires volatility2 (vol.py) on PATH.

Run a Volatility 3 Windows plugin against a memory dump. Returns plugin, success, output, and errors. Read-only analysis, Volatility 3 auto-detects OS. Requires vol3 (vol) on PATH.

Generate context-appropriate XSS payloads with optional filter evasion. Returns a list of payloads tailored to the injection context and filter bypass requirements. Returns context, filter_bypass, payloads array, notes. Side effects: None. Pure payload generation, no network requests.

Test multiple reflected XSS vectors against a parameter. Sends 10 payloads (script tags, event handlers, SVG, attribute injection, case variation, template literals) and checks if they appear unescaped in the response. Returns results array with reflected/encoded/status per payload, and vulnerable_count. Side effects: Read-only GET requests. Sends 10 requests.