{
  "markdown": "# HackTricks MCP Server\n\nMCP (Model Context Protocol) server for searching and querying [HackTricks](https://github.com/carlospolop/hacktricks) pentesting documentation directly from Claude.\n\n## Features\n\n- **Quick lookup** - One-shot exploitation info with alias support (sqli, xss, ssrf, etc.)\n- **Grouped search results** - Results aggregated by file with match count, title, and relevant sections\n- **Page outline** - Quick table of contents to identify relevant sections\n- **Section extraction** - Read specific sections instead of full pages (token-efficient)\n- **Cheatsheet mode** - Extract only code blocks/commands from pages\n- **Category browsing** - Discover available topics and file paths\n- **Fast grep search** - Uses ripgrep for instant results\n- **Security hardened** - Protection against command injection and path traversal\n\n## Quick Start\n\n### Installation\n\n```bash\nnpm install -g hacktricks-mcp-server\n```\n\nThe postinstall script automatically clones the HackTricks repository (~2 minutes on first install).\n\n### Configure Claude Desktop\n\nAdd to your Claude settings (`~/.claude/settings.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"hacktricks\": {\n      \"command\": \"npx\",\n      \"args\": [\"hacktricks-mcp-server\"]\n    }\n  }\n}\n```\n\nRestart Claude Desktop and try: *\"Search HackTricks for SQL injection\"*\n\n### Alternative: Install from Source\n\n```bash\ngit clone https://github.com/Xplo8E/hacktricks-mcp-server.git\ncd hacktricks-mcp-server\ngit submodule update --init --recursive\nnpm install\nnpm run build\n```\n\n**Configuration for source install:**\n\n```json\n{\n  \"mcpServers\": {\n    \"hacktricks\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/hacktricks-mcp-server/dist/index.js\"]\n    }\n  }\n}\n```\n\n## Usage Examples\n\nOnce configured in Claude Desktop, you can ask:\n\n- **\"Search HackTricks for SQL injection techniques\"**\n- **\"Give me SUID privilege escalation commands\"**\n- **\"Show me XSS payloads\"**\n- **\"List all pentesting categories in HackTricks\"**\n- **\"How do I exploit XXE vulnerabilities?\"**\n\nThe server provides 7 specialized tools for efficient HackTricks searching.\n\n## Available Tools\n\n### `hacktricks_quick_lookup`\n\n⚡ **One-shot exploitation lookup**. Searches, finds best page, and returns exploitation sections + code blocks in one call.\n\n**Parameters:**\n- `topic` (string, required): Attack/technique to look up (e.g., 'SUID', 'sqli', 'xss', 'docker escape')\n- `category` (string, optional): Category filter for faster results\n\n**Supported aliases:** `sqli`, `xss`, `rce`, `lfi`, `rfi`, `ssrf`, `csrf`, `xxe`, `ssti`, `idor`, `jwt`, `suid`, `privesc`\n\n**Example:**\n```\nhacktricks_quick_lookup(\"SSRF\", category=\"pentesting-web\")\n```\n\n**Benefits:** Reduces 3+ tool calls to 1 for \"how do I exploit X\" questions.\n\n---\n\n### `search_hacktricks`\n\nSearch through HackTricks documentation. **Returns results GROUPED BY FILE** with match count, page title, and relevant section headers.\n\n**Parameters:**\n- `query` (string, required): Search term or regex pattern\n- `category` (string, optional): Filter to specific category (e.g., 'pentesting-web')\n- `limit` (number, optional): Max grouped results (default: 20)\n\n**Example output:**\n```\nFound matches in 5 files for: \"SUID\"\n\n────────────────────────────────────────────────────────────\n\n📄 **Linux Privilege Escalation**\n   Path: src/linux-hardening/privilege-escalation/README.md\n   Matches: 12\n   Sections: SUID Binaries | Finding SUID | GTFOBins\n   Preview:\n     L45: Find files with SUID bit set...\n     L78: Common SUID exploitation techniques...\n\n────────────────────────────────────────────────────────────\n```\n\n---\n\n### `get_hacktricks_outline`\n\nGet the **table of contents** of a page (all section headers). Use this BEFORE reading full pages to understand structure.\n\n**Parameters:**\n- `path` (string): Relative path to markdown file\n\n**Example output:**\n```\n# Linux Privilege Escalation\n  ## Enumeration\n    ### System Information\n    ### Network\n  ## SUID Binaries\n    ### Finding SUID Files\n    ### Exploiting SUID\n  ## Capabilities\n```\n\n**Benefits:** See page structure in ~20 lines vs reading 500+ lines.\n\n---\n\n### `get_hacktricks_section`\n\nExtract a **specific section** from a page by header name. Much more efficient than reading the full page.\n\n**Parameters:**\n- `path` (string): Relative path to markdown file\n- `section` (string): Section header to extract (partial match, case-insensitive)\n\n**Example:**\n```\nget_hacktricks_section(\"src/linux-hardening/privilege-escalation/README.md\", \"SUID\")\n```\n\n**Benefits:** Read just \"SUID Binaries\" section (~200 tokens) instead of entire page (~3000 tokens).\n\n---\n\n### `get_hacktricks_cheatsheet`\n\nExtract **only code blocks** from a page. Perfect when you just need commands, payloads, or examples.\n\n**Parameters:**\n- `path` (string): Relative path to markdown file\n\n**Example output:**\n```bash\nfind / -perm -4000 2>/dev/null\n```\n\n```bash\n./vulnerable_suid -p\n```\n\n**Benefits:** Skip explanatory text when you just need \"give me the command\".\n\n---\n\n### `get_hacktricks_page`\n\nGet **full content** of a HackTricks page.\n\n**Parameters:**\n- `path` (string): Relative path to markdown file\n\n**Warning:** Pages can be very long (3000+ tokens). Consider using `get_hacktricks_outline` + `get_hacktricks_section` instead.\n\n---\n\n### `list_hacktricks_categories`\n\nList categories and their contents.\n\n**Parameters:**\n- `category` (string, optional): Category to expand\n\n**Without category:** Lists top-level categories\n**With category:** Shows full directory tree with file paths\n\n## Efficient Usage Pattern\n\nFor optimal token usage, Claude should:\n\n1. **Search with category filter** → Get grouped results with context\n2. **Get outline of relevant page** → See structure before reading\n3. **Extract specific section** → Read only what's needed\n4. **Get cheatsheet** → Quick command reference\n\n**Before (inefficient):**\n```\nsearch_hacktricks(\"SUID\")     → 50 raw lines\nget_page(file1)               → 3000 tokens\nget_page(file2)               → 2500 tokens  \nTotal: ~5500 tokens, 3 calls\n```\n\n**After (efficient):**\n```\nsearch_hacktricks(\"SUID\", category=\"linux-hardening\")  → Grouped results\nget_outline(best_match)                                 → 20 lines\nget_section(best_match, \"SUID\")                         → 200 tokens\nTotal: ~400 tokens, 3 calls\n```\n\n## Requirements\n\n- Node.js (v18 or higher)\n- ripgrep (`rg`) - usually pre-installed on macOS/Linux\n- Bun (for package management)\n\n## Development\n\n**Watch mode:**\n```bash\nbun run dev\n```\n\n**Test locally:**\n```bash\nbun run start\n```\n\n## Contributing\n\nContributions are welcome! If you'd like to improve the server:\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/improvement`)\n3. Make your changes and test locally\n4. Submit a pull request\n\nPlease ensure your PR includes tests for new features and maintains the existing code style.\n\n## License\n\nMIT\n\n## Credits\n\n- [HackTricks](https://github.com/carlospolop/hacktricks) by Carlos Polop\n- Built with [Model Context Protocol SDK](https://github.com/modelcontextprotocol/sdk)\n",
  "bytes": 7053,
  "sha": "282b3393fc2a22fc0204f6f320b733bfb44491bbb7761e836f1f398e00fea0fa",
  "repo_slug": "xplo8e/hacktricks-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_xplo8e_hacktricks_mcp_server_d16a87c3/readme"
}