Atlas / MCP servers / usk6666 / yorishiro-proxy

yorishiro-proxyBLOCK

Name: yorishiro-proxy
Author: usk6666

mcp/usk6666/yorishiro-proxy

MCP server by usk6666 · mcp server · mitm proxy · penetration testing · Audited 2026-10-10

⚑ Report / re-scan Source ↗

AI-native MITM proxy — MCP server for traffic interception, recording & replay

Verdict

BLOCK

Grade

Trust score

62 /100

Exposed tools

26 25r · 1w · 0d

Transport

streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

AI-First MITM Proxy Tool A network proxy for AI agents — intercept, record, and replay traffic through MCP.

日本語

Beta — yorishiro-proxy is under active development. APIs, configuration formats, and protocol behavior may change between minor versions. Non-HTTP/HTTPS protocols (gRPC, WebSocket, Raw TCP, SOCKS5) are at an earlier stage of maturity and may have known limitations.

Yorishiro Proxy runs as an MCP (Model Context Protocol) server, giving AI agents full control over proxy operations through a typed-per-protocol MCP tool surface. Designed for use with Claude Code and other MCP-compatible agents, it enables automated security testing workflows without manual UI interaction. An embedded Web UI is also available for visual inspection and interactive use.

Features

Traffic Interception & Recording -- MITM proxy with automatic CA certificate management
Per-Protocol Resend -- Replay recorded flows with typed schemas (`resend

Read from source at commit f6fea298bc9bOBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add yorishiro-proxy-webui -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "yorishiro-proxy-webui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (26)

25 read · 1 write · 0 destructive.

Tool	Risk	Description
`audit-auth`	read	Audit a recorded HTTP flow for authentication-bypass and role-downgrade / privilege-escalation flaws by replacing the credential header value.
`capture-traffic`	read	Capture HTTP / WebSocket / gRPC traffic via playwright-cli through yorishiro-proxy with a scoped capture filter; obtains flow_ids for verification playbooks.
`fuzz-endpoint`	read	General-purpose fuzz workflow for a recorded request; picks fuzz_http / fuzz_ws / fuzz_grpc / fuzz_raw based on the captured flow
`replay-with-mods`	read	Single-shot replay of a recorded request using resend_http / resend_ws / resend_grpc / resend_raw with selective header / body modifications.
`schema_configure`	read	JSON Schema for the configure tool input.
`schema_fuzz_grpc`	read	JSON Schema for the fuzz_grpc tool input.
`schema_fuzz_http`	read	JSON Schema for the fuzz_http tool input.
`schema_fuzz_raw`	read	JSON Schema for the fuzz_raw tool input.
`schema_fuzz_ws`	read	JSON Schema for the fuzz_ws tool input.
`schema_grpc_schema`	read	JSON Schema for the grpc_schema tool input.
`schema_intercept`	read	JSON Schema for the intercept tool input.
`schema_macro`	read	JSON Schema for the macro tool input.
`schema_manage`	read	JSON Schema for the manage tool input.
`schema_plugin_introspect`	read	JSON Schema for the plugin_introspect tool input.
`schema_proxy_start`	write	JSON Schema for the proxy_start tool input.
`schema_query`	read	JSON Schema for the query tool input.
`schema_resend_grpc`	read	JSON Schema for the resend_grpc tool input.
`schema_resend_http`	read	JSON Schema for the resend_http tool input.
`schema_resend_raw`	read	JSON Schema for the resend_raw tool input.
`schema_resend_ws`	read	JSON Schema for the resend_ws tool input.
`schema_security`	read	JSON Schema for the security tool input.
`stateful-fuzz-loop`	read	Drive setup → resend_http → teardown around a stateful endpoint that cannot be safely fuzzed in bulk (repeated DELETE, single-use tokens, rotating CSRF).
`verify-csrf`	read	Verify whether a state-changing HTTP flow validates its CSRF token by emptying, forging, or removing the token header and observing acceptance.
`verify-idor`	read	Verify Insecure Direct Object Reference on a recorded HTTP flow — sweep candidate ids in body or path and compare authenticated vs unauthorised access.
`verify-sqli`	read	Verify SQL injection on a recorded HTTP flow with time-based / error-based / UNION techniques; method-aware safety guardrails block destructive payloads.
`verify-xss`	read	Verify reflected Cross-Site Scripting on a recorded HTTP flow using YP_-prefixed marker payloads — no scripts execute; only detects unescaped reflection.

Trust audit

BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (8 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.claude/skills/autopilot/SKILL.md:97

5. **Never** read secrets (`.env*`, `~/.ssh`, CA keys) or print tokens.

Why it matters. asks the agent to read credentials

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

internal/mcp/macro_define_warnings_test.go:246

const secret = "SENTINEL-SESSION-VALUE-71bd"

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.hidden_file · CWE-1104

.golangci-lint-version

.golangci-lint-version

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.golangci.yml

.golangci.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.worktreeinclude

.worktreeinclude

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

internal/rules/http/safety_test.go:172

Name:     "eval() call",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

internal/rules/http/safety_test.go:179

[]byte(`eval(userInput)`))

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

internal/rules/http/safety_test.go:182

t.Fatal("expected violation for eval()")

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

.github/workflows/dependabot-security.yml:94

-package-json ../../web/package.json \

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

web/src/components/Layout/Header.tsx:1

import { useMcpClient } from "../../lib/mcp/index.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

web/src/components/hooks/HookConfigEditor.tsx:2

import type { HookConfig, HooksInput, MacrosEntry } from "../../lib/mcp/types.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

web/src/pages/Dashboard/BudgetWidget.tsx:1

import { Spinner } from "../../components/ui/Spinner.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

web/src/pages/Dashboard/BudgetWidget.tsx:2

import type { SecurityGetBudgetResult } from "../../lib/mcp/types.js";

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

docs/rfc/envelope.md:908

| deny `{hostname: "169.254.169.254", schemes: ["http"]}` | rule stops matching; evaluation falls through to the allow check, which is empty | **BYPASS** — cloud metadata reachable |