# operant-mcp

MCP server designed for security assessments, network forensics, and memory inspection directly within agent sessions. Built for penetration testers and auditors.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 26
- Author: operantlabs
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/operantlabs/operant-mcp
- Updated: 2026-04-01
- HTML: https://affpapa.org/en/nevibecode/mcp/operant-mcp

## What it does

The server delivers 51 specialized tools and 8 workflow prompts for technical security assessments. Through connected agents, you can probe web endpoints for SQL injection vulnerabilities, check cross-site scripting flaws, and evaluate IDOR issues. It tests SSRF vectors alongside NoSQL authentication bypasses.

Beyond application scanning, the server handles forensic investigations. It processes PCAP capture files, extracts cleartext credentials from protocols, and inspects memory dumps using Volatility. Additional scripts parse malicious document macros and inspect AWS CloudTrail logs.

Tools fail immediately if supporting command-line binaries are absent: PCAP operations demand `tshark`, memory forensic tasks require `volatility`, and basic HTTP tests rely on `curl`. Execution runs directly through `npx` with zero local build steps.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add operant-mcp -- npx -y operant-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add operant-mcp -- npx -y operant-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "operant-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "operant-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "operant-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "operant-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add operant-mcp npx -y operant-mcp
```

## When to use it
- Probe web APIs for SQL injection and cross-site scripting
- Extract plain text credentials from network packet captures
- Inspect system memory dumps for kernel rootkits
- Audit Git repositories for exposed credential secrets

## Example prompts
- Run an authentication bypass test on the `/api/login` endpoint using SQL injection payloads
- Analyze `traffic.pcap` to extract plaintext credentials and protocol statistics
- Inspect `memory.dmp` using the Windows volatility methodology to detect suspicious processes

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md