MCPwner

What is this?

MCPwner is a swiss knife Model Context Protocol for security researchers consolidating all secrets finding, infrastructure scanning, SAST, DAST, POC, and exploitation in a single place.

What tools are included?

SAST tools

Future tools (to be added soon!):

DAST, API & RECON

OWASP ZAP: owasp/zap2docker-stable:latest
Nikto: sullo/nikto:latest
SQLmap: paoloo/sqlmap:latest
Nuclei: projectdiscovery/nuclei:latest
Akto: akto/akto-api-security:latest
Wapiti: vasilyev/wapiti:latest
Nmap: instrumentisto/nmap:latest
Amass: caffix/amass:latest
FFUF: ffuf/ffuf:latest

SECRETS & SCA

Gitleaks: zricethezav/gitleaks:latest
TruffleHog: trufflesecurity/trufflehog:latest
Whispers: skyscanner/whispers:latest
Trivy: aquasec/trivy:latest
Grype: anchore/grype:latest
OSV-Scanner: ghcr.io/google/osv-scanner:latest

INFRASTRUCTURE & IAC

POC & EXPLOITATION

Metasploit: metasploitframework/metasploit-framework:latest
SearchSploit: offensive-security/exploitdb:latest
Interactsh: projectdiscovery/interactsh-client:latest

How to use it?

Setup config:

cp config/config.yaml.example config/config.yaml

run:

sudo docker compose up

Add mcp.json or configure your LLM to communicate with MCPwner or any other set up you use to connect MCP servers to your agent/s.

{
  "mcpServers": {
    "mcpwner": {
      "command": "docker",
      "args": ["exec", "-i", "mcpwner-server", "python", "/app/src/server.py"],
      "env": {
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

profit.

Contributing

Contributions are welcome!

MCPwner is expected to grow significantly. Therefore, there is a need for more extensive testing infrastructure, e2e and maybe some unit testing for cruicial functions, better error handling, and timeouts. Among many other things to consider.

You can read full contribution guidelines here.

Will also consider a better management of containers since many of them are needed ad hoc and not to be ran all the time, this might be configured or maybe managed like kubernetes does with KEDA

Also, adding all the tools and testing that them with LLM to verify they work as efficiently and as expected will take some time as well.

If you want to contribute, please submit a single purpose pull request with a manageable number of changes and reasonable lines of code to review.

Future plans

This project was built with supporting future deployments to remote servers in mind, but for the moment it mainly supports local usage. However, with a few modifications, it could be deployed and used. That's why communication between containers is HTTP and not using the docker-cli.

MCP Servers