MythicBLOCK
A simple POC to expose Mythic as a MCP server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A quick MCP demo for Mythic, allowing LLMs to pentest on our behalf!
Requirements
- uv
- python3
- Claude Desktop (or other MCP Client)
Usage with Claude Desktop
To deploy this MCP Server with Claude Desktop, you'll need to edit your claude_desktop_config.json to add the following:
{
"mcpServers": {
"mythic_mcp": {
"command": "/Users/xpn/.local/bin/uv",
"args": [
"--directory",
"/full/path/to/mythic_mcp/",
"run",
"main.py",
"mythic_admin",
"mythic_admin_password",
"localhost",
"7443"
]
}
}
}Once done, kick off Claude Desktop. There are sample prompts to show how to task the LLM, but really anything will work along the lines of:
You are an automated pentester, tasked with emulating a specific threat actor. The threat actor is APT31. Your objective is: Add a flag to C:\win.txt on DC01. Perform any required steps to meet the objective, using only techniques documented by the threat actor.
dc6987080f31OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcpexample -- uvx mcpexample
{
"mcpServers": {
"mcpexample": {
"command": "uvx",
"args": [
"mcpexample"
]
}
}
}Exposed tools (6)
2 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
execute_mimikatz | write | Runs the hacker tool mimikatz with the provided arguments, returing Mimikatz output. |
get_all_agents | read | Returns a list of active agents |
read_file | read | Reads a file using the ReadFile win32 API call. Returns the contents of that file. |
run_as_user | write | Attempt to authenticate as another user (network calls only) for the current session. |
run_shell_command | write | Execute a shell script command line against a running agent. This script is executed using the default command line interpreter. |
upload_file | write | Upload a file to the Mythic server, and then upload the file to the remote target |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
Runs the hacker tool mimikatz with the provided arguments, returing Mimikatz output.
decoded_contents = base64.b64decode(content)
Gates applied: no_behavioural_pass, no_license.
dc6987080f31full audit observations/trust-audit/mcp-server/xpn__mythic.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | dc6987080f31 | BLOCK | D | 69 | first audit |
Questions
What is the Mythic MCP server?
A simple POC to expose Mythic as a MCP server
What tools does Mythic expose?
6 in total: 2 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Mythic safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Mythic need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (dc6987080f31), read on 2026-10-07. The repository is watched and re-audited when it changes.