Operant MCP

Security testing MCP server with 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. Its 40 documented tools cover pcap, recon, sqli, test. It runs locally over stdio via the published package.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-04-01 · ★ 23 · #105 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · TypeScript servers · how we verify → /methodology

01 · Install Operant MCP

Claude Code

claude mcp add operantlabs-operant-mcp -- npx -y operant-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "operantlabs-operant-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "operant-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

npm package operant-mcp - unscoped; check the name against the project README before installing

registry namespace io.github.operantlabs is GitHub-verified and matches the repo owner

03 · What Operant MCP can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can read files via LOAD_FILE(), generate context-aware XSS payloads, detect port scanning, and search git repos for secrets.

Capability map

Tools grouped from the project's README - what Operant MCP lets an agent do.

Pcap

8 tools - e.g. Protocol hierarchy and endpoint stats; Extract FTP/HTTP/SMTP credentials; DNS query analysis

pcap_overview · pcap_extract_credentials · pcap_dns_analysis · pcap_http_objects · pcap_detect_scan · pcap_follow_stream…

Recon

7 tools - e.g. Quick recon (robots.txt, headers, common dirs); Full DNS enumeration; Virtual host discovery

recon_quick · recon_dns · recon_vhost · recon_tls_sans · recon_directory_bruteforce · recon_git_secrets…

Sqli

6 tools - e.g. Test OR-based WHERE clause bypass; Test login form SQL injection; UNION-based data extraction

sqli_where_bypass · sqli_login_bypass · sqli_union_extract · sqli_blind_boolean · sqli_blind_time · sqli_file_read

Auth

3 tools - e.g. Extract CSRF tokens; Username enumeration + credential brute-force; Cookie tampering test

auth_csrf_extract · auth_bruteforce · auth_cookie_tamper

Xss

2 tools - e.g. Test reflected XSS with 10 payloads; Generate context-aware XSS payloads

xss_reflected_test · xss_payload_generate

Cmdi

2 tools - e.g. Test OS command injection; Blind command injection via sleep timing

cmdi_test · cmdi_blind_detect

Ssrf

2 tools - e.g. Test SSRF with localhost bypass variants; Test cloud metadata access via SSRF

ssrf_test · ssrf_cloud_metadata

Volatility

2 tools - e.g. Linux memory analysis (Volatility 2); Windows memory analysis (Volatility 3)

volatility_linux · volatility_windows

04 · Who maintains Operant MCP

operant-mcp is maintained by operantlabs. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/operantlabs/operant-mcp
category: security - ranked #105 of 182 actively-maintained security servers as of 2026-08-25.
registry: io.github.operantlabs/operant-mcp (active, first published 2026-03-25)
packages: npm:operant-mcp

06 · Operant MCP FAQ

Is Operant MCP still maintained?

Yes - as of 2026-08-25, its last commit was 2026-04-01. We re-verify nightly.

What can Operant MCP do?

With this server connected, an agent can read files via LOAD_FILE(), generate context-aware XSS payloads, detect port scanning, and search git repos for secrets.

How do I install Operant MCP?

Run `npx -y operant-mcp`. You can also paste the ready-made client config above.

Does Operant MCP run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Operant MCP

Alternatives to Operant MCP

Maintained security servers if Operant MCP isn't the fit.

Pairs well with

Servers that cover what Operant MCP doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Otto Travel · Ovecc · Pairoa · Fitbit MCP · DugganUSA CLI - Local STDIO MCP

More TypeScript MCP servers · Tariff Resolver · Optifeed Radar · Kanban AI · Omnicord · OPA MCP · see all