BreachPilotBLOCK
Autonomous Offensive Security Agent for Red Team Operations
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Open-source autonomous security-testing operator for authorized environments. Plans, executes, verifies, and reports full assessment lifecycles with evidence — target-locked, sandboxed, and audited.
[](https://github.com/braydos-h/BreachPilot/actions/workflows/ci.yml) [](https://github.com/braydos-h/BreachPilot/releases)
Quick start · Documentation · Architecture · Safety model · Reliability metrics · [Live demo](https://breachpilot-site.vercel.app/)
[!WARNING] Authorized testing only. Only test systems you own or have explicit written permission to assess. Run the operator from an isolated, throwaway machine or VM.
What is BreachPilot?
BreachPilot is an agentic penetration-testing operator. Given an authorized target, it runs the full loop — reconnaissance, exploitation, privilege escalation, lateral movement, verification, and reporting — through a WebUI mission-control interface or a scriptable CLI.
It is built for lab and sanctioned-assessment use: every action executes inside defined authorization boundaries, every finding requires stored-probe evidence, and every step lands in a tamper-evident audit trail.
Linux is the primary platform (full tool arsenal). Windows is installer-supported with a Python-only fallback.
Why BreachPilot?
Auditable, evidence-driven autonomous security testing — scope → containment → verification → provenance → operator graph. See positioning and reliability metrics (baseline
6d1e37803655OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add breachpilot-webui --env ABUSEIPDB_KEY=${ABUSEIPDB_KEY} --env BHE_SECRET=${BHE_SECRET} --env BREACHPILOT_API_KEY_FILE=${BREACHPILOT_API_KEY_FILE} --env BREACHPILOT_API_TOKEN=${BREACHPILOT_API_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"breachpilot-webui": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ABUSEIPDB_KEY": "${ABUSEIPDB_KEY}",
"BHE_SECRET": "${BHE_SECRET}",
"BREACHPILOT_API_KEY_FILE": "${BREACHPILOT_API_KEY_FILE}",
"BREACHPILOT_API_TOKEN": "${BREACHPILOT_API_TOKEN}"
}
}
}
}Exposed tools (22)
14 read · 8 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
DVWA | read | |
backdoor | write | Install a backdoor. |
browser.dom.inspect | read | DOM snapshots |
browser.navigate | read | Open URLs |
custom | read | Type your own goal |
cve_lookup | read | NVD CVE lookup for a known product/version string (e.g. |
enumerate-then-report | read | Map and report. |
evil_tool | read | return |
get_run | write | Return one run |
get_skill | read | Return one skill |
list_runs | read | List recent assessment runs (read-only history). Newest first. |
ok | read | d |
probe_tool_without_audit_gate | read | return command |
run_limited_terminal | write | Run a command if it is an allowlisted Nmap command and the |
run_nmap_basic_scan | write | Service/version detection on a single approved host. |
run_nmap_ping_sweep | write | Run `nmap -sn` against an approved subnet. Returns live hosts. |
run_nmap_service_scan | write | Service + scripts + OS detection on a single approved host. |
run_nmap_triage_scan | write | Top-port triage scan against an approved subnet. |
run_nmap_vuln_scan | write | Run the Nmap NSE `vuln` category on a single approved host. |
search_cve_intel | read | NVD CVE lookup for a known product/version string. |
search_skills | read | Lexical + field-weighted search over the runtime skill catalog |
search_vulnerability_intel | read | Defensive public vulnerability/advisory search. The query is |
Trust audit
BLOCKgrade F · trust 22/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (17 observation(s))
- Network
- declared (21 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
A TE.CL smuggling attack injects a partial POST request to a comment endpoint. The next user's request (including cookies and authorization headers) is appended to the comment body and stored in the d
The `/api/users/{id}` endpoint returns full user profiles including email, phone, and address. The API only checks if the request has a valid token but never verifies whether the token owner matches tlogin_resp = requests.post(f"{BASE_URL}/auth/login", json={"email": "[email protected]", "password": "TestPass123!"})4. Send the forged token to `GET /api/v1/users/me` - server accepts it (algorithm confusion confirmed)
"description": f"'unsafe-eval' allows eval() and similar in {directive}","bypass": "Use eval(), Function(), setTimeout('string') for XSS",finding["issues"].append("unsafe-eval allows eval() calls (XSS risk)")weaknesses.append("unsafe-eval allows eval()")"(`ssh -i ~/.ssh/id_ed25519 user@host`); if you must materialize a key file use "
"org:{org} filename:id_rsa",/.env" ... urllib.request
"http://169.254.169.254/latest/meta-data/", # AWS IMDS
unauth_resp = requests.get(url, timeout=timeout, allow_redirects=False, verify=False)
verify=False,
resp = requests.request(method, urljoin(base_url, path), timeout=10, verify=False)
resp = requests.get(urljoin(base_url, variant), timeout=10, verify=False)
resp = requests.get(urljoin(base_url, path), timeout=10, verify=False)
SMUGGLE = re.compile(r"[---\U000e0000-\U000e007f]")
Print every tool/prompt/resource description without verification, then read them for hidden instructions, `<important>`-style blocks, or imperative text aimed at the model.
Capture the model's expected input contract: the system prompt, the tool schemas (JSON Schema for MCP tools / function calls), the message format (chat roles), and any structured-input validator (a Py
4. **Add output guardrails.** Run the model's response through a deterministic classifier before any action. Block: requests to call tools not in the allowlist, requests to reveal the system prompt, r
role-directive lines (`## SYSTEM:`, `[SYSTEM]`, `<<SYSTEM>>`, `<|...|>`),
imported markdown** — role-directive lines (`## SYSTEM:`, `[SYSTEM]`,
`<<SYSTEM>>`, `<|...|>`) and tool-call mimics (`- run tool: ...`) are
- Role-directive headings/lines are dropped: `## SYSTEM:`, `[SYSTEM]`,
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
6d1e37803655full audit observations/trust-audit/mcp-server/braydos-h__breachpilot.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 6d1e37803655 | BLOCK | F | 22 | first audit |
Questions
What is the BreachPilot MCP server?
Autonomous Offensive Security Agent for Red Team Operations
What tools does BreachPilot expose?
22 in total: 14 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is BreachPilot safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (22/100) and found 25 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does BreachPilot need?
It reads ABUSEIPDB_KEY, BHE_SECRET, BREACHPILOT_API_KEY_FILE, BREACHPILOT_API_TOKEN, DD_API_KEY, DEFECTDOJO_API_KEY, GITHUB_TOKEN, HIBP_API_KEY, MCP_HTTP_IDENTITY_SECRET, MCP_HTTP_TOKEN, NESSUS_ACCESS_KEY and NESSUS_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does BreachPilot run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as breachpilot-webui at 0.68.4.
How current is this page?
The grade is for one exact copy of the source (6d1e37803655), read on 2026-10-11. The repository is watched and re-audited when it changes.