MCP server · Audited from source
HexStrike AI MCP server
by 0x4m4/hexstrike-aiMIT licenceAudited 20 Sep 2026 · source 876657bfe240
★ 11,990
Is it safe? No — BLOCK, grade D (69/100). It exposes 150 tools: 134 read, 13 write and 3 destructive. The audit recorded 25 findings (1 critical, 3 high, 15 medium, 5 low). Maintainer's description: HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capa
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “HexStrike AI MCP server (0x4m4/hexstrike-ai)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/0x4m4/hexstrike-ai
Why this is BLOCK. The audit found 1 critical and 3 high findings; the most severe is Obfuscation / stealth at hexstrike_server.py:7289. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 20 Sep 2026
Trust score69/100✕BLOCK D
1 critical3 high15 medium5 low1 info
25 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemUndeclared12 observations not in its description
- NetworkDeclared19 observations
- ShellDeclared2 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
Findings (25)
Sorted by severity
CRITICALObfuscation / stealthobf.decode_then_exec · hexstrike_server.py:7289
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
b64decode( ... exec(
- Why
- decodes a payload and executes it
- Fix
- —
HIGHNetwork egressnet.metadata_ip · hexstrike_server.py:2597
F-04 Network egressCWE-200 · CWE-319Layer L1
{"name": "Cloud Metadata", "payloads": ["http://169.254.169.254/latest/meta-data/"]},- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
HIGHNetwork egressnet.tls_off · hexstrike_server.py:13766
F-04 Network egressCWE-200 · CWE-319Layer L1
resp = requests.get(page_info.get('url',''), timeout=10, verify=False)- Why
- certificate verification is disabled
- Fix
- leave verification on
HIGHNetwork egressnet.tls_off · hexstrike_server.py:13844
F-04 Network egressCWE-200 · CWE-319Layer L1
r = requests.get(test_url, timeout=8, verify=False)
- Why
- certificate verification is disabled
- Fix
- leave verification on
MEDIUMFilesystem / pathfs.destructive · hexstrike_server.py:8985
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(file_path)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathfs.destructive · hexstrike_server.py:10696
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.remove(command_file)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathfs.destructive · hexstrike_server.py:11081
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.remove(resource_file)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathfs.destructive · hexstrike_server.py:11997
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.remove("/tmp/gdb_commands.txt")- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathfs.destructive · hexstrike_server.py:12040
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.remove("/tmp/r2_commands.txt")- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · hexstrike_mcp.py:4216
F-04 Network egressCWE-200 · CWE-319Layer L1
valid_attack_types = ["rce", "privilege_escalation", "persistence", "exfiltration", "xss", "sqli", "lfi", "ssrf"]
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · hexstrike_mcp.py:4350
F-04 Network egressCWE-200 · CWE-319Layer L1
"Data exfiltration indicators"
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · hexstrike_mcp.py:4359
F-04 Network egressCWE-200 · CWE-319Layer L1
"Data staging and exfiltration"
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · hexstrike_server.py:2598
F-04 Network egressCWE-200 · CWE-319Layer L1
{"name": "DNS Exfiltration", "payloads": ["http://burpcollaborator.net"]}- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · hexstrike_mcp.py:143
F-04 Network egressCWE-200 · CWE-319Layer L1
DEFAULT_HEXSTRIKE_SERVER = "http://127.0.0.1:8888" # Default HexStrike server URL
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · hexstrike_server.py:2596
F-04 Network egressCWE-200 · CWE-319Layer L1
{"name": "Internal Network", "payloads": ["http://127.0.0.1:80", "http://localhost:22"]},- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · hexstrike_server.py:2597
F-04 Network egressCWE-200 · CWE-319Layer L1
{"name": "Cloud Metadata", "payloads": ["http://169.254.169.254/latest/meta-data/"]},- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · hexstrike_server.py:13298
F-04 Network egressCWE-200 · CWE-319Layer L1
'http': f'http://127.0.0.1:{proxy_port}',- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · hexstrike_server.py:13299
F-04 Network egressCWE-200 · CWE-319Layer L1
'https': f'http://127.0.0.1:{proxy_port}'- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
clear_cache, delete_file, terminate_process
- Why
- 3 tool(s) can delete or overwrite
- Fix
- prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInsecure cryptocrypto.weak_hash · hexstrike_server.py:6680
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return hashlib.md5(key_data.encode()).hexdigest()
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · hexstrike_server.py:14582
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"basic": ["../../../etc/passwd", "..\\..\\..\\windows\\system32\\drivers\\etc\\hosts"],
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · hexstrike_server.py:15041
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
header = json.loads(base64.b64decode(header_b64))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · hexstrike_server.py:15042
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
payload = json.loads(base64.b64decode(payload_b64))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
flask, requests, psutil, fastmcp, beautifulsoup4, selenium, webdriver-manager, aiohttp
- Why
- 11 requirement(s) not pinned with ==
- Fix
- pin exact versions
INFOInventory / provenanceinv.oversize · assets/leaksapi-logo.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/leaksapi-logo.png
- Why
- 1014134 bytes not read
- Fix
- —
Tools it exposes
150 declared in source · 3 destructive
134 read13 write3 destructive
3 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
clear_cache | No description in the source | destructive |
delete_file | No description in the source | destructive |
terminate_process | No description in the source | destructive |
bugbounty_file_upload_testing | No description in the source | write |
create_attack_chain_ai | No description in the source | write |
create_file | No description in the source | write |
create_scan_summary | No description in the source | write |
create_vulnerability_report | No description in the source | write |
execute_command | No description in the source | write |
execute_python_script | No description in the source | write |
http_repeater | Send a crafted request (Burp Repeater equivalent). request_spec keys: url, method, headers, cookies, data. | write |
http_set_rules | Set match/replace rules used to rewrite parts of URL/query/headers/body before sending. | write |
http_set_scope | Define in-scope host (and optionally subdomains) so out-of-scope requests are skipped. | write |
install_python_package | No description in the source | write |
metasploit_run | No description in the source | write |
modify_file | No description in the source | write |
advanced_payload_generation | No description in the source | read |
ai_generate_attack_suite | No description in the source | read |
ai_generate_payload | No description in the source | read |
ai_reconnaissance_workflow | No description in the source | read |
ai_test_payload | No description in the source | read |
ai_vulnerability_assessment | No description in the source | read |
amass_scan | No description in the source | read |
analyze_target_intelligence | No description in the source | read |
anew_data_processing | No description in the source | read |
angr_symbolic_execution | No description in the source | read |
api_fuzzer | No description in the source | read |
api_schema_analyzer | No description in the source | read |
arjun_parameter_discovery | No description in the source | read |
arjun_scan | No description in the source | read |
arp_scan_discovery | No description in the source | read |
autorecon_comprehensive | No description in the source | read |
autorecon_scan | No description in the source | read |
binwalk_analyze | No description in the source | read |
browser_agent_inspect | No description in the source | read |
bugbounty_authentication_bypass_testing | No description in the source | read |
bugbounty_business_logic_testing | No description in the source | read |
bugbounty_comprehensive_assessment | No description in the source | read |
bugbounty_osint_gathering | No description in the source | read |
bugbounty_reconnaissance_workflow | No description in the source | read |
bugbounty_vulnerability_hunting | No description in the source | read |
burpsuite_alternative_scan | No description in the source | read |
burpsuite_scan | No description in the source | read |
checkov_iac_scan | No description in the source | read |
checksec_analyze | No description in the source | read |
clair_vulnerability_scan | No description in the source | read |
cloudmapper_analysis | No description in the source | read |
comprehensive_api_audit | No description in the source | read |
correlate_threat_intelligence | No description in the source | read |
dalfox_xss_scan | No description in the source | read |
detect_technologies_ai | No description in the source | read |
dirb_scan | No description in the source | read |
dirsearch_scan | No description in the source | read |
discover_attack_chains | No description in the source | read |
display_system_metrics | No description in the source | read |
dnsenum_scan | No description in the source | read |
docker_bench_security_scan | No description in the source | read |
dotdotpwn_scan | No description in the source | read |
enum4linux_ng_advanced | No description in the source | read |
enum4linux_scan | No description in the source | read |
error_handling_statistics | No description in the source | read |
exiftool_extract | No description in the source | read |
falco_runtime_monitoring | No description in the source | read |
feroxbuster_scan | No description in the source | read |
ffuf_scan | No description in the source | read |
fierce_scan | No description in the source | read |
foremost_carving | No description in the source | read |
format_tool_output_visual | No description in the source | read |
gau_discovery | No description in the source | read |
gdb_analyze | No description in the source | read |
gdb_peda_debug | No description in the source | read |
generate_exploit_from_cve | No description in the source | read |
generate_payload | No description in the source | read |
get_cache_stats | No description in the source | read |
get_live_dashboard | No description in the source | read |
get_process_dashboard | No description in the source | read |
get_process_status | No description in the source | read |
get_telemetry | No description in the source | read |
ghidra_analysis | No description in the source | read |
gobuster_scan | No description in the source | read |
graphql_scanner | No description in the source | read |
hakrawler_crawl | No description in the source | read |
hashcat_crack | No description in the source | read |
hashpump_attack | No description in the source | read |
http_framework_test | No description in the source | read |
http_intruder | Simple Intruder (sniper) fuzzing. Iterates payloads over each param individually. | read |
httpx_probe | No description in the source | read |
hydra_attack | No description in the source | read |
intelligent_smart_scan | No description in the source | read |
jaeles_vulnerability_scan | No description in the source | read |
john_crack | No description in the source | read |
jwt_analyzer | No description in the source | read |
katana_crawl | No description in the source | read |
kube_bench_cis | No description in the source | read |
kube_hunter_scan | No description in the source | read |
libc_database_lookup | No description in the source | read |
list_active_processes | No description in the source | read |
list_files | No description in the source | read |
masscan_high_speed | No description in the source | read |
monitor_cve_feeds | No description in the source | read |
msfvenom_generate | No description in the source | read |
nbtscan_netbios | No description in the source | read |
netexec_scan | No description in the source | read |
nikto_scan | No description in the source | read |
nmap_advanced_scan | No description in the source | read |
nmap_scan | No description in the source | read |
nuclei_scan | No description in the source | read |
objdump_analyze | No description in the source | read |
one_gadget_search | No description in the source | read |
optimize_tool_parameters_ai | No description in the source | read |
pacu_exploitation | No description in the source | read |
paramspider_discovery | No description in the source | read |
paramspider_mining | No description in the source | read |
pause_process | No description in the source | read |
prowler_scan | No description in the source | read |
pwninit_setup | No description in the source | read |
pwntools_exploit | No description in the source | read |
qsreplace_parameter_replacement | No description in the source | read |
radare2_analyze | No description in the source | read |
research_zero_day_opportunities | No description in the source | read |
responder_credential_harvest | No description in the source | read |
resume_process | No description in the source | read |
ropgadget_search | No description in the source | read |
ropper_gadget_search | No description in the source | read |
rpcclient_enumeration | No description in the source | read |
rustscan_fast_scan | No description in the source | read |
scout_suite_assessment | No description in the source | read |
select_optimal_tools_ai | No description in the source | read |
server_health | No description in the source | read |
smbmap_scan | No description in the source | read |
sqlmap_scan | No description in the source | read |
steghide_analysis | No description in the source | read |
strings_extract | No description in the source | read |
subfinder_scan | No description in the source | read |
terrascan_iac_scan | No description in the source | read |
test_error_recovery | No description in the source | read |
threat_hunting_assistant | No description in the source | read |
trivy_scan | No description in the source | read |
uro_url_filtering | No description in the source | read |
volatility3_analyze | No description in the source | read |
volatility_analyze | No description in the source | read |
vulnerability_intelligence_dashboard | No description in the source | read |
wafw00f_scan | No description in the source | read |
waybackurls_discovery | No description in the source | read |
wfuzz_scan | No description in the source | read |
wpscan_analyze | No description in the source | read |
x8_parameter_discovery | No description in the source | read |
xsser_scan | No description in the source | read |
xxd_hexdump | No description in the source | read |
zap_scan | No description in the source | read |
Safer alternatives
Clueo✓SAFE
clueofoundation/clueomcp
🎭 The Personality Layer for LLMs- Transform any MCP-compatible AI with rich, consistent personalities powered by Clueo's Big Five personality engine.
1 writeGrade B
SEC Edgar✓SAFE
stefanoamorelli/sec-edgar-mcp
A SEC EDGAR MCP (Model Context Protocol) Server
Grade B
Claudeus WordPress✓SAFE
deus-h/claudeus-wp-mcp
Claudeus WordPress MCP Server
19 destructiveGrade B
Audit history
- ✕BLOCK D 69 / 100
Source changed, verdict held ·
876657bfe240
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about HexStrike AI MCP server
What is the HexStrike AI MCP server?
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capa
What tools does HexStrike AI expose?
150 in total: 134 read-only, 13 that write, and 3 that can delete or overwrite (clear_cache, delete_file, terminate_process). Every one is listed on this page with its risk.
Is HexStrike AI safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does HexStrike AI need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (876657bfe240), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed HexStrike AI. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- 0x4m4/hexstrike-ai on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 876657bfe240Observed · 20 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the HexStrike AI MCP server?
- What tools does HexStrike AI expose?
- Is HexStrike AI safe to connect to an agent?