mythos-agent — Claude Code MCP server: what it does, how to install
Reviews codebases for application security vulnerabilities via the Model Context Protocol. Flags logic flaws and builds multi-step attack chains.
claude mcp add mythos-agent -- npx -y mythos-agentWhat mythos-agent does
The server evaluates application security by pairing pattern checks with reasoning about logic flaws. It inspects potential race conditions, checks for unverified tokens, and maps how isolated bugs combine into critical attack paths. Instead of scanning for exact syntax matches alone, it locates structural variants of known CVEs across your project files.
The verification pipeline moves through reconnaissance, hypothesis generation, and risk validation. It ships with over 329 rules alongside built-in scanners. Node.js 20 or newer is required.
Running the autonomous hunt workflow requires configuring an AI provider key via init, supporting Anthropic, OpenAI, Ollama, or LM Studio. Without an API key, the server operates strictly in the standard scan mode.
What it helps with
- find structural variants of specific CVEs across the repository
- uncover combined attack chains linking injection to data export
- generate reproduction steps for confirmed code vulnerabilities
- export security audit findings as SARIF or HTML reports
Example prompts for the agent
- Run an autonomous security hunt across the project
- Check the codebase for variants of CVE-2021-44228
- Ask mythos-agent if there are any authorization bypasses
How to install mythos-agent
Platform CLI
claude mcp add mythos-agent -- npx -y mythos-agentPlatform CLI
codex mcp add mythos-agent -- npx -y mythos-agentConfig file
{
"mcpServers": {
"mythos-agent": {
"command": "npx",
"args": [
"-y",
"mythos-agent"
]
}
}
}Config file
{
"servers": {
"mythos-agent": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mythos-agent"
]
}
}
}Platform CLI
gemini mcp add mythos-agent npx -y mythos-agentStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mythos-agent
How to install mythos-agent in Claude Code?
Run claude mcp add mythos-agent -- npx -y mythos-agent in your terminal. You must have Node.js 20 or newer installed on your machine.
What does mythos-agent do?
It inspects codebases for security vulnerabilities, builds hypothesis chains for logic flaws, and suggests code fixes. It can also produce scan reports in terminal, JSON, HTML, and SARIF formats.
Is an external API key necessary to use mythos-agent?
Standard scans run locally without an API key. Autonomous investigation with the hunt command requires configuring an LLM provider such as Anthropic, OpenAI, Ollama, or LM Studio.
