HackTricks MCP Server

MCP (Model Context Protocol) server for searching and querying HackTricks pentesting documentation directly from Claude.

Features

• Quick lookup - One-shot exploitation info with alias support (sqli, xss, ssrf, etc.)
• Grouped search results - Results aggregated by file with match count, title, and relevant sections
• Page outline - Quick table of contents to identify relevant sections
• Section extraction - Read specific sections instead of full pages (token-efficient)
• Cheatsheet mode - Extract only code blocks/commands from pages
• Category browsing - Discover available topics and file paths
• Fast grep search - Uses ripgrep for instant results
• Security hardened - Protection against command injection and path traversal

Quick Start

Installation

npm install -g hacktricks-mcp-server

The postinstall script automatically clones the HackTricks repository (~2 minutes on first install).

Configure Claude Desktop

Add to your Claude settings (~/.claude/settings.json):

{
  "mcpServers": {
    "hacktricks": {
      "command": "npx",
      "args": ["hacktricks-mcp-server"]
    }
  }
}

Restart Claude Desktop and try: “Search HackTricks for SQL injection”

Alternative: Install from Source

git clone https://github.com/Xplo8E/hacktricks-mcp-server.git
cd hacktricks-mcp-server
git submodule update --init --recursive
npm install
npm run build

Configuration for source install:

{
  "mcpServers": {
    "hacktricks": {
      "command": "node",
      "args": ["/absolute/path/to/hacktricks-mcp-server/dist/index.js"]
    }
  }
}

Usage Examples

Once configured in Claude Desktop, you can ask:

• “Search HackTricks for SQL injection techniques”
• “Give me SUID privilege escalation commands”
• “Show me XSS payloads”
• “List all pentesting categories in HackTricks”
• “How do I exploit XXE vulnerabilities?”

The server provides 7 specialized tools for efficient HackTricks searching.

Available Tools

hacktricks_quick_lookup

⚡ One-shot exploitation lookup. Searches, finds best page, and returns exploitation sections + code blocks in one call.

Parameters:

• topic (string, required): Attack/technique to look up (e.g., ‘SUID’, ‘sqli’, ‘xss’, ‘docker escape’)
• category (string, optional): Category filter for faster results

Supported aliases: sqli, xss, rce, lfi, rfi, ssrf, csrf, xxe, ssti, idor, jwt, suid, privesc

Example:

hacktricks_quick_lookup("SSRF", category="pentesting-web")

Benefits: Reduces 3+ tool calls to 1 for “how do I exploit X” questions.

---

search_hacktricks

Search through HackTricks documentation. Returns results GROUPED BY FILE with match count, page title, and relevant section headers.

Parameters:

• query (string, required): Search term or regex pattern