# mythos-agent

Reviews codebases for application security vulnerabilities via the Model Context Protocol. Flags logic flaws and builds multi-step attack chains.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 47
- Author: mythos-agent
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/mythos-agent/mythos-agent
- Updated: 2026-05-23
- HTML: https://affpapa.org/en/nevibecode/mcp/mythos-agent

## What it does

The server evaluates application security by pairing pattern checks with reasoning about logic flaws. It inspects potential race conditions, checks for unverified tokens, and maps how isolated bugs combine into critical attack paths. Instead of scanning for exact syntax matches alone, it locates structural variants of known CVEs across your project files.

The verification pipeline moves through reconnaissance, hypothesis generation, and risk validation. It ships with over 329 rules alongside built-in scanners. Node.js 20 or newer is required.

Running the autonomous `hunt` workflow requires configuring an AI provider key via `init`, supporting Anthropic, OpenAI, Ollama, or LM Studio. Without an API key, the server operates strictly in the standard `scan` mode.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mythos-agent -- npx -y mythos-agent
```

### Codex

**Platform CLI**
```bash
codex mcp add mythos-agent -- npx -y mythos-agent
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mythos-agent": {
            "command": "npx",
            "args": [
                "-y",
                "mythos-agent"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mythos-agent": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "mythos-agent"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mythos-agent npx -y mythos-agent
```

## When to use it
- find structural variants of specific CVEs across the repository
- uncover combined attack chains linking injection to data export
- generate reproduction steps for confirmed code vulnerabilities
- export security audit findings as SARIF or HTML reports

## Example prompts
- Run an autonomous security hunt across the project
- Check the codebase for variants of CVE-2021-44228
- Ask mythos-agent if there are any authorization bypasses

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md