# HackTricks MCP Server

Searches the HackTricks pentesting knowledge base directly from your AI agent. Helps retrieve exploit steps and cheatsheets without reading massive markdown pages.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 10
- Author: Xplo8E
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Xplo8E/hacktricks-mcp-server
- Updated: 2026-03-28
- HTML: https://affpapa.org/en/nevibecode/mcp/hacktricks-mcp-server

## What it does

This server hooks your coding agent directly into the HackTricks offensive security documentation. It includes seven dedicated tools. You can run one-shot lookups using attack aliases like `sqli` or `xss`, or inspect page outlines before fetching content.

Instead of pulling whole guides into the prompt, the server extracts specific sections or code blocks. That keeps context clean. Built-in checks guard against command injection and directory traversal.

Running it requires Node.js 18 or higher along with `ripgrep` installed on your machine. Keep in mind that the initial install clones the full documentation repository, which takes roughly two minutes.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add hacktricks-mcp-server -- npx -y hacktricks-mcp-server
```

### Codex

**Platform CLI**
```bash
codex mcp add hacktricks-mcp-server -- npx -y hacktricks-mcp-server
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hacktricks-mcp-server": {
            "command": "npx",
            "args": [
                "-y",
                "hacktricks-mcp-server"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hacktricks-mcp-server": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "hacktricks-mcp-server"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add hacktricks-mcp-server npx -y hacktricks-mcp-server
```

## When to use it
- search pentesting guides for specific exploits
- extract command cheatsheets without full documentation text
- view document outlines to reduce token consumption
- pull Linux privilege escalation payloads

## Example prompts
- Search HackTricks for SUID privilege escalation commands
- Show me XSS payloads from the pentesting-web category
- Extract the outline for the Linux privilege escalation page

## Similar
- [fix-security-vulnerabilities-with-strix](https://affpapa.org/en/nevibecode/skills/fix-security-vulnerabilities-with-strix.md) — skill · 15700 installs
- [owasp-top-10-testing](https://affpapa.org/en/nevibecode/skills/owasp-top-10-testing.md) — skill · 12800 installs
- [ctf-web](https://affpapa.org/en/nevibecode/skills/ctf-web.md) — skill · 9700 installs
- [hack](https://affpapa.org/en/nevibecode/skills/hack.md) — skill · 4300 installs
- [sqli-sql-injection](https://affpapa.org/en/nevibecode/skills/sqli-sql-injection.md) — skill · 4000 installs
- [shannon](https://affpapa.org/en/nevibecode/skills/shannon.md) — skill · 2900 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md