Hacktricks MCP Server

🚀 HackTricks MCP Server

The HackTricks MCP Server, based on the Model Context Protocol (MCP), enables users to directly search and query the HackTricks pentesting documentation from Claude.

✨ Features

• Quick lookup: Provides one-shot exploitation information with support for aliases such as sqli, xss, ssrf, etc.
• Grouped search results: Aggregates search results by file, including match count, page title, and relevant sections.
• Page outline: Offers a quick table of contents to help identify relevant sections.
• Section extraction: Allows users to read specific sections instead of the full page, which is more token - efficient.
• Cheatsheet mode: Extracts only code blocks and commands from pages.
• Category browsing: Enables users to discover available topics and file paths.
• Fast grep search: Utilizes ripgrep for instant search results.
• Security hardened: Protects against command injection and path traversal attacks.

🚀 Quick Start

📦 Installation

npm install -g hacktricks-mcp-server

The post - install script will automatically clone the HackTricks repository, which may take about 2 minutes on the first install.

Configure Claude Desktop

Add the following to your Claude settings (~/.claude/settings.json):

{
  "mcpServers": {
    "hacktricks": {
      "command": "npx",
      "args": ["hacktricks-mcp-server"]
    }
  }
}

Restart Claude Desktop and try the query: "Search HackTricks for SQL injection"

Alternative: Install from Source

git clone https://github.com/Xplo8E/hacktricks-mcp-server.git
cd hacktricks-mcp-server
git submodule update --init --recursive
npm install
npm run build

Configuration for source install:

{
  "mcpServers": {
    "hacktricks": {
      "command": "node",
      "args": ["/absolute/path/to/hacktricks-mcp-server/dist/index.js"]
    }
  }
}

💻 Usage Examples

After configuring in Claude Desktop, you can ask the following questions:

• "Search HackTricks for SQL injection techniques"
• "Give me SUID privilege escalation commands"
• "Show me XSS payloads"
• "List all pentesting categories in HackTricks"
• "How do I exploit XXE vulnerabilities?"

The server provides 7 specialized tools for efficient HackTricks searching.

📚 Documentation

Available Tools

hacktricks_quick_lookup

⚡ One - shot exploitation lookup. This tool searches, finds the best - matching page, and returns exploitation sections and code blocks in one call.

Parameters:

• topic (string, required): The attack or technique to look up (e.g., 'SUID', 'sqli', 'xss', 'docker escape').
• category (string, optional): A category filter to get faster results.

Supported aliases: sqli, xss, rce, lfi, rfi, ssrf, csrf, xxe, ssti, idor, jwt, suid, privesc

Example:

hacktricks_quick_lookup("SSRF", category="pentesting-web")

Benefits: Reduces the need for 3 or more tool calls to just 1 for "how do I exploit X" questions.

search_hacktricks

Search through HackTricks documentation. Returns results GROUPED BY FILE along with match count, page title, and relevant section headers.

Parameters:

• query (string, required): The search term or regex pattern.
• category (string, optional): Filter the search to a specific category (e.g., 'pentesting - web').
• limit (number, optional): The maximum number of grouped results (default: 20).

Example output:

Found matches in 5 files for: "SUID"

────────────────────────────────────────────────────────────

📄 **Linux Privilege Escalation**
   Path: src/linux-hardening/privilege-escalation/README.md
   Matches: 12
   Sections: SUID Binaries | Finding SUID | GTFOBins
   Preview:
     L45: Find files with SUID bit set...
     L78: Common SUID exploitation techniques...

────────────────────────────────────────────────────────────

get_hacktricks_outline

Get the table of contents of a page (all section headers). Use this before reading full pages to understand the page structure.

Parameters:

• path (string): The relative path to the markdown file.

Example output:

# Linux Privilege Escalation
  ## Enumeration
    ### System Information
    ### Network
  ## SUID Binaries
    ### Finding SUID Files
    ### Exploiting SUID
  ## Capabilities

Benefits: Allows you to see the page structure in about 20 lines instead of reading 500+ lines.

get_hacktricks_section

Extract a specific section from a page by its header name. This is much more efficient than reading the full page.

Parameters:

• path (string): The relative path to the markdown file.
• section (string): The section header to extract (partial match, case - insensitive).

Example:

get_hacktricks_section("src/linux-hardening/privilege-escalation/README.md", "SUID")

Benefits: Allows you to read just the "SUID Binaries" section (about 200 tokens) instead of the entire page (about 3000 tokens).

get_hacktricks_cheatsheet

Extract only code blocks from a page. This is perfect when you only need commands, payloads, or examples.

Parameters:

• path (string): The relative path to the markdown file.

Example output:

find / -perm -4000 2>/dev/null

./vulnerable_suid -p

Benefits: Helps you skip the explanatory text when you only need "give me the command".

get_hacktricks_page

Get the full content of a HackTricks page.

Parameters:

• path (string): The relative path to the markdown file.

Warning: Pages can be very long (3000+ tokens). Consider using get_hacktricks_outline + get_hacktricks_section instead.

list_hacktricks_categories

List categories and their contents.

Parameters:

• category (string, optional): The category to expand.

Without category: Lists top - level categories. With category: Shows the full directory tree with file paths.

Efficient Usage Pattern

For optimal token usage, Claude should follow these steps:

1. Search with category filter → Get grouped results with context.
2. Get outline of relevant page → See the page structure before reading.
3. Extract specific section → Read only what's needed.
4. Get cheatsheet → Get a quick command reference.

Before (inefficient):

search_hacktricks("SUID")     → 50 raw lines
get_page(file1)               → 3000 tokens
get_page(file2)               → 2500 tokens  
Total: ~5500 tokens, 3 calls

After (efficient):

search_hacktricks("SUID", category="linux-hardening")  → Grouped results
get_outline(best_match)                                 → 20 lines
get_section(best_match, "SUID")                         → 200 tokens
Total: ~400 tokens, 3 calls

🔧 Technical Details

Requirements

• Node.js (v18 or higher)
• ripgrep (rg) - usually pre - installed on macOS/Linux
• Bun (for package management)

Development

Watch mode:

bun run dev

Test locally:

bun run start

Contributing

Contributions are welcome! If you'd like to improve the server:

1. Fork the repository.
2. Create a feature branch (git checkout -b feature/improvement).
3. Make your changes and test locally.
4. Submit a pull request.

Please ensure your PR includes tests for new features and maintains the existing code style.

📄 License

MIT

Credits

• HackTricks by Carlos Polop
• Built with Model Context Protocol SDK