velric-agentCAUTION
Agent 自主渗透测试工具: SPA/MPA 接口枚举、运行时流量捕获、权限树还原、参数矩阵合并。
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Agent 自主渗透测试工具包 —— 让 Agent 独立完成 Web 应用的攻击面测绘。覆盖 SPA/MPA 的后端接口枚举、无头浏览器运行时流量录制、前端权限树重建与多样本参数矩阵聚合,提供 CLI 与 MCP server 双形态,可被任何 MCP 客户端直接驱动。仅用于已授权的安全测试。
功能
静态分析
harvest_static— SPA bundle 全量收割:抓取入口页 → 解析 webpack/Vite chunk manifest → 迭代下载全部 lazy chunk(不只 HTML 里引用的)→ 提取 API 路径、前端路由、其他路径。产出api_static.txt/routes.txt/paths_other.txt/chunkmap.txt/js/。extract_routes— 对已下载的js/目录重新执行接口/路由提取(改了正则策略后重跑用)。spider_mpa— MPA 爬虫:同源受限 BFS,抽取 `表单(真实端点+参数名)、内联 ajax URL、可达页面清单。产出forms.txt/links.txt/api_inline.txt`。
运行时捕获
capture_runtime— 无头 Chromium 驱动 SPA,document-start 注入 hook(fetch/XHR/WS 全录制),过三道客户端门禁(渲染门/拦截器门/内容门),遍历路由记录真实 METHOD + URL + body + 响应样本。产出runtime_api.json/api_merged.txt。
结构还原
build_perm_tree— 从收割的 JS 里解析userRouteAuth权限模块,解析 webpack 别名(x=o.KEY),按 code 前缀推断层级,生成全量放行的菜单/权限 stub。产出permissions_all_stub.json/role_permissions_stub.json/permissions_tree.json等。
参数合并
merge_params— 合并多份运行时录制样本,按端点聚合字段(body/query 区分),标注置信度(≥2 样本一致=high,单样本=medium)。单一样本永远不会被当成必填/可选的结论。
网络探测
dns_resolve— A/AAAA/CNAME 解析(≤50 hosts)。http_probe— 单 URL 探测:状态码/标题/Server/尺寸/sha256,支持自定义 header、cookie、代理。
安装
要求 Node ≥ 22;capture_runtime 需要系统 Chromium(--chromium 或 VELRIC_CHROMIUM 指定)。
npm install -g velric-agent # 或免安装运行 npx -y velric-agent
CLI 用法
velric-agent dns-resolve example.com velric-agent http-probe https://target/ velric-agent harvest https://target/ /tmp/recon velric-agent extract-routes /tmp/recon/js /tmp/recon velric-agent spider https://target/ /tmp/recon --cookie "session=..." velric-agent runtime https://target/ /tmp/recon --chromium /usr/bin/chromium --wait 6000 --per-route 4000 velric-agent perm-tree /tmp/recon/js /tmp/recon velric-agent merge-params /tmp/recon/param_samples.json /tmp/recon ve
534a4beac6d6OBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add velric-agent -- npx -y [email protected] mcp
Exposed tools (8)
6 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
build_perm_tree | read | Parse userRouteAuth from downloaded JS, resolve webpack aliases via routeMap, infer hierarchy from code prefixes, and write permissive menu/permission stubs (permissions_all_stub.json / role_permissions_stub.json). |
capture_runtime | read | Drive a headless Chromium through an authorized SPA: inject the api-recon preload hook (three-gate defeat), walk routes, record live XHR/fetch/WS endpoints with methods and bodies into runtime_api.json. |
dns_resolve | read | Resolve A/AAAA/CNAME records for one or more hosts. Stateless lookup; no caching. |
extract_routes | write | Run endpoint/route extraction over a directory of already-downloaded JS chunks (the js/ dir produced by harvest_static). |
harvest_static | read | Fetch the SPA entry, download every script, expand webpack/Vite chunk manifests to fixpoint, extract API endpoints and frontend routes into api_static.txt / routes.txt / paths_other.txt / chunkmap.txt under output_root. |
http_probe | read | GET one URL: status, title, server/x-powered-by, size, sha256. TLS verification disabled (recon targets are often self-signed). |
merge_params | write | Merge recorded param samples (param_samples.json: [{method,url,body,query}]) into per-endpoint field sets with confidence. A field seen in every sample is high; seen once is medium; nothing implies required/optional from one sample. |
spider_mpa | read | Same-origin bounded BFS crawl for non-SPA targets: extract <form> endpoints with params, inline ajax URLs, and the reached link set into forms.txt / links.txt / api_inline.txt. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
connect: { rejectUnauthorized: false },expect(() => new Function(script)).not.toThrow();
undici, @modelcontextprotocol/client, @types/node, @types/write-file-atomic, typescript, vitest
Gates applied: no_behavioural_pass.
534a4beac6d6full audit observations/trust-audit/mcp-server/ikooky__velric-agent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 534a4beac6d6 | CAUTION | B | 89 | first audit |
Questions
What is the velric-agent MCP server?
Agent 自主渗透测试工具: SPA/MPA 接口枚举、运行时流量捕获、权限树还原、参数矩阵合并。
What tools does velric-agent expose?
8 in total: 6 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is velric-agent safe to connect to an agent?
With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does velric-agent need?
No credential environment variables were found in its source, so it appears to need none.
How does velric-agent run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as velric-agent at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (534a4beac6d6), read on 2026-10-13. The repository is watched and re-audited when it changes.