Atlas / MCP servers / pwno-io / Pwno

PwnoSAFE

Name: Pwno
Author: pwno-io

mcp/pwno-io/pwno

MCP server by pwno-io · mcp · mcp server · pwn · Audited 2026-10-05

⚑ Report / re-scan Source ↗

MCP for Pwn

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

12 7r · 4w · 1d

Transport

stdio

License

NOASSERTION

Stars

281

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

stateful system for autonomous pwn and binary research, designed for LLM agents.

Overview

pwno-mcp runs GDB + pwndbg in an isolated environment and exposes stateful debugging, exploit I/O, and helper tooling over MCP for agentic coding clients.

Features

Stateful debugger sessions via GDB + pwndbg
Deterministic execution control via GDB/MI
Fast context snapshots for registers, stack, disassembly, source, and backtrace
Interactive exploit-driver workflows with pwncli
Multi-session support for parallel workflows
Workspace automation helpers for commands, processes, Python, repos, and RetDec
HTTP and stdio transport support

Documentation

The full documentation is available at docs.pwno.io.

Quick Start

Create a local workspace directory, put your target binary there, then run the container.

mkdir -p ./workspace
cp ./path/to/your/binary ./workspace/chal
chmod +x ./workspace/chal

docker run --rm -p 5500:5500 \
--cap-add=SYS_PTRACE \
--cap-add=SYS_ADMIN \
--security-opt seccomp=unconfined \
--security-opt apparmor=unconfined \
-v "$PWD/workspace:/workspace" \
ghcr.io/pwno-io/pwno-mcp:latest

Default MCP endpoint:

http://127.0.0.1:5500/mcp

For stdio mode, client configs, health checks, and attach-helper details, use the docs site: docs.pwno.io/quickstart.

Development

For local development, architecture, and contributing guidance, see docs.pwno.io/development.

Usage

non-profit: yes
commercial: [email protected]

Future Enhancements

WebSocket endpoint for streaming I/O
Advanced memory analysis too

Read from source at commit 6b57f5e3b031OBSERVED · 2026-10-05

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add pwno-mcp-docs -- npx -y pwno-mcp-docs

claude-desktop

{
  "mcpServers": {
    "pwno-mcp-docs": {
      "command": "npx",
      "args": [
        "-y",
        "pwno-mcp-docs"
      ]
    }
  }
}

Exposed tools (12)

7 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`execute_python_code`	write	Execute Python code dynamically in the shared environment.
`execute_python_script`	write	Execute an existing Python script within the shared environment.
`fetch_repo`	read	Fetch a git repository into /workspace.
`get_decompiled_code`	read	Return RetDec decompiled C code if available, or a status describing why not.
`get_process`	read	Get information about a tracked background process by PID.
`get_retdec_status`	read	Get the current RetDec decompilation status, lazily initializing as needed.
`install_python_packages`	write	Install additional Python packages using the shared package manager (uv).
`kill_process`	destructive	Send a signal to a tracked background process (default SIGTERM=15).
`list_processes`	read	List all tracked background processes and their metadata (PID, command, log paths).
`list_python_packages`	read	List all packages installed in the shared Python environment.
`run_command`	write	Execute a system command and wait for completion.
`spawn_process`	read	Spawn a long-running background process and return its PID and log paths.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (6 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (8)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

kill_process

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.suspicious_name · CWE-1104

docs/guides/interactive-exploit-loop.mdx

interactive-exploit-loop.mdx

Why it matters. member named after an attack tool

Fix. remove or justify

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_paths.py:34

resolve_workspace_path("../../etc/passwd", workspace_root="/workspace")