MCPhantom

---

MCPhantom is a local web dashboard for MCP endpoint reconnaissance and exploitation. Point it at any MCP URL, discover exposed resources, templates, tools, and prompts, then interact with them from a clean security console UI. Runs locally at 127.0.0.1:1337; no cloud, no setup beyond Python. Project's Documentation can be found here.

---

[!WARNING] MCPhantom is an extensible security auditing framework; not a turnkey, universal scanner. It provides a solid foundation for MCP focused reconnaissance and vulnerability testing, but it is intentionally designed as a starting skeleton that you are expected to adapt to your targets, environments, and methodology.

• Not guaranteed to work out of the box on every MCP server : Capabilities, schemas, transports, and response formats vary widely across implementations. Classification, payload delivery, and proof detection may need tuning per target.
• Payload coverage is deliberately limited : MCPhantom includes representative probes for classes such as SQL injection, command injection, SSRF, path traversal, IDOR, and information disclosure, but it does not ship exhaustive wordlists or engine scale fuzzing comparable to tools like sqlmap, Burp Intruder, or commercial DAST platforms.
• Proof heuristics are best-effort : Findings are scored from response signals (errors, data leaks, version strings, reflected output, etc.). False positives and false negatives are possible without target-specific customization. This is exactly why the framework also allows you to do manual auditing.
• You are encouraged to extend it : The project is open source so you can grow payload libraries, add plugins, refine classifiers, integrate with your CI/CD pipeline, or harden detection logic for your use cases.
• The AutoPwn feature is a WIP and it is highly discouraged to use it in live production encironments. Only use this feature on CTFs and/or local labs.

---

https://github.com/user-attachments/assets/b62d3a80-2b38-4b5c-a11b-029192279470

---

Category	Feature	Description
Discovery	MCP enumeration	Discovers resources, resource templates, tools, and prompts from a target MCP endpoint
	Capability classification	Tags capabilities (e.g. URL, command, database, path, ID) to decide which tests apply
Interface	Web dashboard	Browser-based console at http://127.0.0.1:1337 with dark/light themes
	Live interaction	Read resources/templates, invoke tools, run prompts, and fill template placeholders from the UI
AutoPwn	Smart targeted scanning	Runs plugin-matched checks only where tags/parameters suggest relevance - avoids blind fuzzing everywhere
	Parallel execution	Runs multiple capability checks concurrently with per-check and per-payload timeouts
	Streaming results	NDJSON progress stream with live coverage, findings, and completion percentage
	Scan coverage report	Per-capability status (vulnerable, clean, timeout, error) with hit counts and notes
Plugins	SQL injection	Single-column UNION probes, DB version extraction, and schema/table enumeration (SQLite, MySQL, PostgreSQL, MSSQL, Oracle)
	Command injection	Shell metacharacter and allowlist-bypass style payloads with MCP response parsing
	SSRF	Internal/localhost and metadata-style URL probes
	Path traversal	Common filesystem path escape payloads
	IDOR	Identifier manipulation probes on ID-like parameters
	Information disclosure	Baseline and verbose/error-triggering requests for sensitive output
Engine	Central payload repository	All payloads live in audit/payloads.py - add categories and entries without rewriting plugins
	Proof scoring (SQLi)	Ranks findings by evidence strength; filters reflection-only and duplicate error responses
	Plugin architecture	Modular plugins loaded via audit/plugin_loader.py - straightforward to add new vulnerability classes
Extensibility	Open source	Fork, extend payload lists, add plugins, and tailor detection to your targets and workflows

python web_server.py

# Open http://127.0.0.1:1337, enter an MCP endpoint, run Start Recon.

---

[!CAUTION] MCPhantom is intended solely for authorized security assessments, research, and educational purposes. Use it only against systems you own or have explicit permission to test. See the LICENSE file for warranty and liability terms.