@integsec/mcp-pentester-cli 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +56 -0
- package/README.md +342 -0
- package/dist/index.d.ts +3 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +183 -0
- package/dist/index.js.map +1 -0
- package/dist/mcp-client.d.ts +23 -0
- package/dist/mcp-client.d.ts.map +1 -0
- package/dist/mcp-client.js +163 -0
- package/dist/mcp-client.js.map +1 -0
- package/dist/transport/base.d.ts +18 -0
- package/dist/transport/base.d.ts.map +1 -0
- package/dist/transport/base.js +64 -0
- package/dist/transport/base.js.map +1 -0
- package/dist/transport/http.d.ts +14 -0
- package/dist/transport/http.d.ts.map +1 -0
- package/dist/transport/http.js +137 -0
- package/dist/transport/http.js.map +1 -0
- package/dist/transport/stdio.d.ts +15 -0
- package/dist/transport/stdio.d.ts.map +1 -0
- package/dist/transport/stdio.js +89 -0
- package/dist/transport/stdio.js.map +1 -0
- package/dist/transport/websocket.d.ts +15 -0
- package/dist/transport/websocket.d.ts.map +1 -0
- package/dist/transport/websocket.js +109 -0
- package/dist/transport/websocket.js.map +1 -0
- package/dist/types.d.ts +103 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +3 -0
- package/dist/types.js.map +1 -0
- package/dist/ui/tui.d.ts +43 -0
- package/dist/ui/tui.d.ts.map +1 -0
- package/dist/ui/tui.js +872 -0
- package/dist/ui/tui.js.map +1 -0
- package/examples/http-burp-config.json +9 -0
- package/examples/https-burp-config.json +13 -0
- package/examples/stdio-config.json +10 -0
- package/examples/tor-config.json +9 -0
- package/examples/websocket-config.json +9 -0
- package/package.json +61 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
INTEGSEC SOFTWARE LICENSE
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 IntegSec. All Rights Reserved.
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to use,
|
|
7
|
+
copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
|
8
|
+
the Software, and to permit persons to whom the Software is furnished to do
|
|
9
|
+
so, subject to the following conditions:
|
|
10
|
+
|
|
11
|
+
1. The above copyright notice and this permission notice shall be included in
|
|
12
|
+
all copies or substantial portions of the Software.
|
|
13
|
+
|
|
14
|
+
2. All intellectual property rights, including but not limited to copyrights,
|
|
15
|
+
patents, trade secrets, and trademarks, remain the exclusive property of
|
|
16
|
+
IntegSec. This license does not grant any ownership rights to the Software.
|
|
17
|
+
|
|
18
|
+
3. The Software is provided "AS IS", without warranty of any kind, express or
|
|
19
|
+
implied, including but not limited to the warranties of merchantability,
|
|
20
|
+
fitness for a particular purpose and noninfringement. In no event shall
|
|
21
|
+
IntegSec be liable for any claim, damages or other liability, whether in an
|
|
22
|
+
action of contract, tort or otherwise, arising from, out of or in connection
|
|
23
|
+
with the Software or the use or other dealings in the Software.
|
|
24
|
+
|
|
25
|
+
4. You may not use IntegSec's name, trademarks, or other intellectual property
|
|
26
|
+
to endorse or promote products derived from this Software without prior
|
|
27
|
+
written permission from IntegSec.
|
|
28
|
+
|
|
29
|
+
5. If you modify the Software, you must include a prominent notice stating that
|
|
30
|
+
you have modified it, and you must not remove or alter any copyright notices
|
|
31
|
+
or other proprietary notices from the Software.
|
|
32
|
+
|
|
33
|
+
INTELLECTUAL PROPERTY:
|
|
34
|
+
This Software is protected by copyright laws and international copyright treaties,
|
|
35
|
+
as well as other intellectual property laws and treaties. IntegSec retains all
|
|
36
|
+
right, title, and interest in and to the Software, including all copyrights,
|
|
37
|
+
patents, trade secrets, trademarks, and other intellectual property rights.
|
|
38
|
+
This license grants permission to use the Software but does not transfer any
|
|
39
|
+
ownership or intellectual property rights.
|
|
40
|
+
|
|
41
|
+
NO WARRANTY:
|
|
42
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
43
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
44
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
45
|
+
INTEGSEC BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
46
|
+
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
|
47
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
48
|
+
|
|
49
|
+
LIMITATION OF LIABILITY:
|
|
50
|
+
IN NO EVENT SHALL INTEGSEC BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT,
|
|
51
|
+
OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES
|
|
52
|
+
FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS
|
|
53
|
+
INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR
|
|
54
|
+
INABILITY TO USE THIS SOFTWARE.
|
|
55
|
+
|
|
56
|
+
For questions about this License, contact: legal@integsec.com
|
package/README.md
ADDED
|
@@ -0,0 +1,342 @@
|
|
|
1
|
+
# MCP Pentester CLI
|
|
2
|
+
|
|
3
|
+
A free, open-source interactive console tool for penetration testers to interact with Model Context Protocol (MCP) servers via JSON-RPC 2.0. Supports multiple transport protocols (stdio, HTTP/HTTPS, WebSocket) with full proxy support for tools like Burp Suite.
|
|
4
|
+
|
|
5
|
+

|
|
6
|
+
|
|
7
|
+
**Copyright © 2025 IntegSec. All Rights Reserved.**
|
|
8
|
+
|
|
9
|
+
## Features
|
|
10
|
+
|
|
11
|
+
- **Multiple Transport Protocols**
|
|
12
|
+
- stdio (process communication)
|
|
13
|
+
- HTTP/HTTPS
|
|
14
|
+
- WebSocket (ws/wss)
|
|
15
|
+
|
|
16
|
+
- **Proxy Support**
|
|
17
|
+
- HTTP/HTTPS proxies (Burp Suite, etc.)
|
|
18
|
+
- SOCKS5 proxies (Tor, etc.)
|
|
19
|
+
- Authentication support
|
|
20
|
+
|
|
21
|
+
- **Interactive TUI**
|
|
22
|
+
- Graphical console interface using blessed
|
|
23
|
+
- Real-time traffic logging
|
|
24
|
+
- Navigate tools, resources, and prompts
|
|
25
|
+
- Execute MCP operations interactively
|
|
26
|
+
|
|
27
|
+
- **Traffic Inspection**
|
|
28
|
+
- View all JSON-RPC requests and responses
|
|
29
|
+
- Traffic logging for analysis
|
|
30
|
+
- Compatible with HTTP intercepting proxies
|
|
31
|
+
|
|
32
|
+
- **Pentesting Features**
|
|
33
|
+
- Redirect all traffic through Burp Suite or similar tools
|
|
34
|
+
- Inspect and modify MCP protocol messages
|
|
35
|
+
- Test server implementations
|
|
36
|
+
- Analyze security of MCP servers
|
|
37
|
+
|
|
38
|
+
## Installation
|
|
39
|
+
|
|
40
|
+
### Install from npm
|
|
41
|
+
|
|
42
|
+
```bash
|
|
43
|
+
npm install -g @integsec/mcp-pentester-cli
|
|
44
|
+
```
|
|
45
|
+
<|tool▁calls▁begin|><|tool▁call▁begin|>
|
|
46
|
+
run_terminal_cmd
|
|
47
|
+
|
|
48
|
+
After installation, verify it works:
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
mcp-pentester-cli --version
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
Then use the `mcp-pentester-cli` command:
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
mcp-pentester-cli --help
|
|
58
|
+
mcp-pentester-cli connect --transport stdio --command "npx" --args "-y" "@modelcontextprotocol/server-filesystem" "/tmp"
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
### Install from source
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
npm install
|
|
65
|
+
npm run build
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
Or install globally from source:
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
npm install -g .
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
After global installation, use the `mcp-pentester-cli` command as shown above.
|
|
75
|
+
|
|
76
|
+
## Quick Start
|
|
77
|
+
|
|
78
|
+
### Connect to an MCP server via stdio
|
|
79
|
+
|
|
80
|
+
```bash
|
|
81
|
+
mcp-pentester-cli connect --transport stdio --command "npx" --args "-y" "@modelcontextprotocol/server-filesystem" "/tmp"
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
### Connect via HTTP through Burp Suite
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
mcp-pentester-cli connect --transport http --url "http://localhost:3000/mcp" --proxy-host 127.0.0.1 --proxy-port 8080
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
### Connect via WebSocket through SOCKS5 (Tor)
|
|
91
|
+
|
|
92
|
+
```bash
|
|
93
|
+
mcp-pentester-cli connect --transport wss --url "wss://api.example.com/mcp" --proxy-host 127.0.0.1 --proxy-port 9050 --proxy-protocol socks5
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
### Using Configuration Files
|
|
97
|
+
|
|
98
|
+
Generate example configs:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
mcp-pentester-cli gen-config -o my-config.json
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
Connect using a config file:
|
|
105
|
+
|
|
106
|
+
```bash
|
|
107
|
+
mcp-pentester-cli connect --config examples/http-burp-config.json
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## Usage
|
|
111
|
+
|
|
112
|
+
### Command Line Options
|
|
113
|
+
|
|
114
|
+
```
|
|
115
|
+
mcp-pentester-cli connect [options]
|
|
116
|
+
|
|
117
|
+
Options:
|
|
118
|
+
-t, --transport <type> Transport type: stdio, http, https, ws, wss (default: "stdio")
|
|
119
|
+
-u, --url <url> URL for HTTP/WebSocket transports
|
|
120
|
+
-c, --command <command> Command for stdio transport
|
|
121
|
+
-a, --args <args...> Arguments for stdio command
|
|
122
|
+
--proxy-host <host> Proxy server host
|
|
123
|
+
--proxy-port <port> Proxy server port
|
|
124
|
+
--proxy-protocol <protocol> Proxy protocol: http, https, socks, socks5
|
|
125
|
+
--proxy-user <username> Proxy username
|
|
126
|
+
--proxy-pass <password> Proxy password
|
|
127
|
+
-f, --config <file> Load configuration from JSON file
|
|
128
|
+
-h, --help Display help for command
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
### Configuration File Format
|
|
132
|
+
|
|
133
|
+
```json
|
|
134
|
+
{
|
|
135
|
+
"type": "https",
|
|
136
|
+
"url": "https://api.example.com/mcp",
|
|
137
|
+
"proxy": {
|
|
138
|
+
"host": "127.0.0.1",
|
|
139
|
+
"port": 8080,
|
|
140
|
+
"protocol": "http",
|
|
141
|
+
"auth": {
|
|
142
|
+
"username": "pentester",
|
|
143
|
+
"password": "changeme"
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
}
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
### TUI Keyboard Shortcuts
|
|
150
|
+
|
|
151
|
+
**Function Keys:**
|
|
152
|
+
- **F1** - Focus navigation sidebar
|
|
153
|
+
- **F2** - Focus main content panel
|
|
154
|
+
- **F3** - Focus traffic log panel
|
|
155
|
+
- **F4** - Close popup window
|
|
156
|
+
- **F5** - Refresh current view
|
|
157
|
+
- **F10** - Quit application
|
|
158
|
+
|
|
159
|
+
**Navigation:**
|
|
160
|
+
- **↑/↓** (Up/Down Arrows) - Navigate through lists
|
|
161
|
+
- **Enter** - Execute selected item (call tool, read resource, use prompt, view traffic details)
|
|
162
|
+
|
|
163
|
+
**Traffic Log:**
|
|
164
|
+
- Most recent entries appear at the top
|
|
165
|
+
- Shows detailed information: timestamps, tool names, parameters, URIs
|
|
166
|
+
- Press Enter on any entry to see full request/response pair side-by-side
|
|
167
|
+
|
|
168
|
+
### Navigation Menu
|
|
169
|
+
|
|
170
|
+
1. **Tools** - View and execute available MCP tools
|
|
171
|
+
2. **Resources** - Browse and read MCP resources
|
|
172
|
+
3. **Prompts** - View and use MCP prompts
|
|
173
|
+
4. **Traffic Log** - View detailed JSON-RPC traffic
|
|
174
|
+
|
|
175
|
+
## Example Configurations
|
|
176
|
+
|
|
177
|
+
### Testing a Local MCP Server with Burp Suite
|
|
178
|
+
|
|
179
|
+
```json
|
|
180
|
+
{
|
|
181
|
+
"type": "http",
|
|
182
|
+
"url": "http://localhost:3000/mcp",
|
|
183
|
+
"proxy": {
|
|
184
|
+
"host": "127.0.0.1",
|
|
185
|
+
"port": 8080,
|
|
186
|
+
"protocol": "http"
|
|
187
|
+
}
|
|
188
|
+
}
|
|
189
|
+
```
|
|
190
|
+
|
|
191
|
+
### Connecting to Remote MCP Server via Tor
|
|
192
|
+
|
|
193
|
+
```json
|
|
194
|
+
{
|
|
195
|
+
"type": "wss",
|
|
196
|
+
"url": "wss://api.example.onion/mcp",
|
|
197
|
+
"proxy": {
|
|
198
|
+
"host": "127.0.0.1",
|
|
199
|
+
"port": 9050,
|
|
200
|
+
"protocol": "socks5"
|
|
201
|
+
}
|
|
202
|
+
}
|
|
203
|
+
```
|
|
204
|
+
|
|
205
|
+
### Local stdio Server
|
|
206
|
+
|
|
207
|
+
```json
|
|
208
|
+
{
|
|
209
|
+
"type": "stdio",
|
|
210
|
+
"command": "node",
|
|
211
|
+
"args": ["./my-mcp-server.js"],
|
|
212
|
+
"env": {
|
|
213
|
+
"DEBUG": "true"
|
|
214
|
+
}
|
|
215
|
+
}
|
|
216
|
+
```
|
|
217
|
+
|
|
218
|
+
## Pentesting Workflow
|
|
219
|
+
|
|
220
|
+
1. **Setup Burp Suite**
|
|
221
|
+
- Configure Burp to listen on 127.0.0.1:8080
|
|
222
|
+
- Disable SSL validation if testing with self-signed certs
|
|
223
|
+
|
|
224
|
+
2. **Launch MCP CLI with Proxy**
|
|
225
|
+
```bash
|
|
226
|
+
mcp-pentester-cli connect --transport https --url "https://target.com/mcp" \
|
|
227
|
+
--proxy-host 127.0.0.1 --proxy-port 8080
|
|
228
|
+
```
|
|
229
|
+
|
|
230
|
+
3. **Intercept Traffic**
|
|
231
|
+
- All JSON-RPC requests will flow through Burp
|
|
232
|
+
- Modify requests to test for vulnerabilities
|
|
233
|
+
- Analyze responses for sensitive data
|
|
234
|
+
|
|
235
|
+
4. **Test MCP Operations**
|
|
236
|
+
- Navigate to Tools in the TUI
|
|
237
|
+
- Execute tools with crafted inputs
|
|
238
|
+
- Monitor responses in Traffic Log
|
|
239
|
+
|
|
240
|
+
5. **Analyze Security**
|
|
241
|
+
- Check for authentication bypass
|
|
242
|
+
- Test input validation
|
|
243
|
+
- Look for information disclosure
|
|
244
|
+
- Verify proper error handling
|
|
245
|
+
|
|
246
|
+
## MCP Protocol Operations
|
|
247
|
+
|
|
248
|
+
The tool supports all standard MCP protocol operations:
|
|
249
|
+
|
|
250
|
+
- **initialize** - Establish connection with server
|
|
251
|
+
- **tools/list** - List available tools
|
|
252
|
+
- **tools/call** - Execute a tool with arguments
|
|
253
|
+
- **resources/list** - List available resources
|
|
254
|
+
- **resources/read** - Read resource content
|
|
255
|
+
- **prompts/list** - List available prompts
|
|
256
|
+
- **prompts/get** - Get a prompt with arguments
|
|
257
|
+
|
|
258
|
+
## Traffic Logging
|
|
259
|
+
|
|
260
|
+
All JSON-RPC traffic is logged in real-time:
|
|
261
|
+
|
|
262
|
+
- Timestamp for each message
|
|
263
|
+
- Direction (sent/received)
|
|
264
|
+
- Full JSON payload
|
|
265
|
+
- Method name for easy filtering
|
|
266
|
+
|
|
267
|
+
Traffic can be cleared at any time using the 'c' key in the traffic panel.
|
|
268
|
+
|
|
269
|
+
## Security Considerations
|
|
270
|
+
|
|
271
|
+
This tool is designed for authorized security testing only. Use responsibly:
|
|
272
|
+
|
|
273
|
+
- Only test systems you have permission to test
|
|
274
|
+
- Be aware that proxy configurations may expose credentials
|
|
275
|
+
- Traffic logs may contain sensitive information
|
|
276
|
+
- Follow responsible disclosure practices
|
|
277
|
+
|
|
278
|
+
## Development
|
|
279
|
+
|
|
280
|
+
### Build
|
|
281
|
+
|
|
282
|
+
```bash
|
|
283
|
+
npm run build
|
|
284
|
+
```
|
|
285
|
+
|
|
286
|
+
### Development Mode
|
|
287
|
+
|
|
288
|
+
```bash
|
|
289
|
+
npm run dev
|
|
290
|
+
```
|
|
291
|
+
|
|
292
|
+
### Project Structure
|
|
293
|
+
|
|
294
|
+
```
|
|
295
|
+
src/
|
|
296
|
+
├── index.ts # CLI entry point
|
|
297
|
+
├── types.ts # TypeScript type definitions
|
|
298
|
+
├── mcp-client.ts # MCP protocol client
|
|
299
|
+
├── transport/
|
|
300
|
+
│ ├── base.ts # Base transport abstraction
|
|
301
|
+
│ ├── stdio.ts # stdio transport
|
|
302
|
+
│ ├── http.ts # HTTP/HTTPS transport
|
|
303
|
+
│ └── websocket.ts # WebSocket transport
|
|
304
|
+
└── ui/
|
|
305
|
+
└── tui.ts # Terminal UI
|
|
306
|
+
```
|
|
307
|
+
|
|
308
|
+
## Troubleshooting
|
|
309
|
+
|
|
310
|
+
### Connection Issues
|
|
311
|
+
|
|
312
|
+
- Verify the target server is running
|
|
313
|
+
- Check firewall settings
|
|
314
|
+
- Ensure proxy is configured correctly
|
|
315
|
+
- For stdio: verify command path and arguments
|
|
316
|
+
|
|
317
|
+
### Proxy Issues
|
|
318
|
+
|
|
319
|
+
- Test proxy connection with curl first
|
|
320
|
+
- Check proxy authentication credentials
|
|
321
|
+
- For SOCKS5: ensure you're using the correct protocol
|
|
322
|
+
- For Burp: verify invisible proxying is disabled
|
|
323
|
+
|
|
324
|
+
### TUI Display Issues
|
|
325
|
+
|
|
326
|
+
- Ensure terminal supports colors
|
|
327
|
+
- Try resizing the terminal window
|
|
328
|
+
- Check terminal emulator compatibility
|
|
329
|
+
|
|
330
|
+
## License
|
|
331
|
+
|
|
332
|
+
This software is free and open source. See the LICENSE file for full terms and conditions.
|
|
333
|
+
|
|
334
|
+
**Copyright © 2025 IntegSec. All Rights Reserved.** This software is provided free of charge, but all intellectual property rights are reserved by IntegSec.
|
|
335
|
+
|
|
336
|
+
## Contributing
|
|
337
|
+
|
|
338
|
+
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
|
|
339
|
+
|
|
340
|
+
## Disclaimer
|
|
341
|
+
|
|
342
|
+
This tool is for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this tool.
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,183 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
"use strict";
|
|
3
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
4
|
+
if (k2 === undefined) k2 = k;
|
|
5
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
6
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
7
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
8
|
+
}
|
|
9
|
+
Object.defineProperty(o, k2, desc);
|
|
10
|
+
}) : (function(o, m, k, k2) {
|
|
11
|
+
if (k2 === undefined) k2 = k;
|
|
12
|
+
o[k2] = m[k];
|
|
13
|
+
}));
|
|
14
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
15
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
16
|
+
}) : function(o, v) {
|
|
17
|
+
o["default"] = v;
|
|
18
|
+
});
|
|
19
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
20
|
+
var ownKeys = function(o) {
|
|
21
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
22
|
+
var ar = [];
|
|
23
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
24
|
+
return ar;
|
|
25
|
+
};
|
|
26
|
+
return ownKeys(o);
|
|
27
|
+
};
|
|
28
|
+
return function (mod) {
|
|
29
|
+
if (mod && mod.__esModule) return mod;
|
|
30
|
+
var result = {};
|
|
31
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
32
|
+
__setModuleDefault(result, mod);
|
|
33
|
+
return result;
|
|
34
|
+
};
|
|
35
|
+
})();
|
|
36
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
37
|
+
const commander_1 = require("commander");
|
|
38
|
+
const mcp_client_1 = require("./mcp-client");
|
|
39
|
+
const tui_1 = require("./ui/tui");
|
|
40
|
+
const fs = __importStar(require("fs"));
|
|
41
|
+
const path = __importStar(require("path"));
|
|
42
|
+
const program = new commander_1.Command();
|
|
43
|
+
program
|
|
44
|
+
.name('mcp-pentester-cli')
|
|
45
|
+
.description('Interactive console tool for pentesting MCP servers via JSON-RPC 2.0')
|
|
46
|
+
.version('1.0.0');
|
|
47
|
+
program
|
|
48
|
+
.command('connect')
|
|
49
|
+
.description('Connect to an MCP server')
|
|
50
|
+
.option('-t, --transport <type>', 'Transport type: stdio, http, https, ws, wss', 'stdio')
|
|
51
|
+
.option('-u, --url <url>', 'URL for HTTP/WebSocket transports')
|
|
52
|
+
.option('-c, --command <command>', 'Command for stdio transport')
|
|
53
|
+
.option('-a, --args <args...>', 'Arguments for stdio command')
|
|
54
|
+
.option('--proxy-host <host>', 'Proxy server host')
|
|
55
|
+
.option('--proxy-port <port>', 'Proxy server port')
|
|
56
|
+
.option('--proxy-protocol <protocol>', 'Proxy protocol: http, https, socks, socks5')
|
|
57
|
+
.option('--proxy-user <username>', 'Proxy username')
|
|
58
|
+
.option('--proxy-pass <password>', 'Proxy password')
|
|
59
|
+
.option('-f, --config <file>', 'Load configuration from JSON file')
|
|
60
|
+
.action(async (options) => {
|
|
61
|
+
let config;
|
|
62
|
+
// Load from config file if provided
|
|
63
|
+
if (options.config) {
|
|
64
|
+
try {
|
|
65
|
+
const configPath = path.resolve(options.config);
|
|
66
|
+
const configData = fs.readFileSync(configPath, 'utf-8');
|
|
67
|
+
config = JSON.parse(configData);
|
|
68
|
+
}
|
|
69
|
+
catch (error) {
|
|
70
|
+
console.error(`Failed to load config file: ${error}`);
|
|
71
|
+
process.exit(1);
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
else {
|
|
75
|
+
// Build config from command line options
|
|
76
|
+
config = {
|
|
77
|
+
type: options.transport,
|
|
78
|
+
};
|
|
79
|
+
if (options.url) {
|
|
80
|
+
config.url = options.url;
|
|
81
|
+
}
|
|
82
|
+
if (options.command) {
|
|
83
|
+
config.command = options.command;
|
|
84
|
+
config.args = options.args || [];
|
|
85
|
+
}
|
|
86
|
+
if (options.proxyHost && options.proxyPort) {
|
|
87
|
+
config.proxy = {
|
|
88
|
+
host: options.proxyHost,
|
|
89
|
+
port: parseInt(options.proxyPort, 10),
|
|
90
|
+
protocol: options.proxyProtocol,
|
|
91
|
+
};
|
|
92
|
+
if (options.proxyUser && options.proxyPass) {
|
|
93
|
+
config.proxy.auth = {
|
|
94
|
+
username: options.proxyUser,
|
|
95
|
+
password: options.proxyPass,
|
|
96
|
+
};
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
// Validate config
|
|
101
|
+
if (config.type === 'stdio' && !config.command) {
|
|
102
|
+
console.error('Error: --command is required for stdio transport');
|
|
103
|
+
process.exit(1);
|
|
104
|
+
}
|
|
105
|
+
if ((config.type === 'http' || config.type === 'https' ||
|
|
106
|
+
config.type === 'ws' || config.type === 'wss') && !config.url) {
|
|
107
|
+
console.error(`Error: --url is required for ${config.type} transport`);
|
|
108
|
+
process.exit(1);
|
|
109
|
+
}
|
|
110
|
+
// Create TUI
|
|
111
|
+
const tui = new tui_1.TUI();
|
|
112
|
+
// Create and connect client
|
|
113
|
+
const client = new mcp_client_1.MCPClient(config);
|
|
114
|
+
tui.setClient(client);
|
|
115
|
+
try {
|
|
116
|
+
// Add a timeout to prevent hanging forever
|
|
117
|
+
const connectPromise = client.connect();
|
|
118
|
+
const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('Connection timeout after 30 seconds')), 30000));
|
|
119
|
+
await Promise.race([connectPromise, timeoutPromise]);
|
|
120
|
+
tui.render();
|
|
121
|
+
}
|
|
122
|
+
catch (error) {
|
|
123
|
+
// Make sure to destroy the screen before exiting
|
|
124
|
+
if (tui && tui.screen) {
|
|
125
|
+
tui.screen.destroy();
|
|
126
|
+
}
|
|
127
|
+
console.error(`\nFailed to connect: ${error}`);
|
|
128
|
+
process.exit(1);
|
|
129
|
+
}
|
|
130
|
+
});
|
|
131
|
+
program
|
|
132
|
+
.command('gen-config')
|
|
133
|
+
.description('Generate example configuration files')
|
|
134
|
+
.option('-o, --output <file>', 'Output file path', 'mcp-config.json')
|
|
135
|
+
.action((options) => {
|
|
136
|
+
const exampleConfigs = {
|
|
137
|
+
stdio: {
|
|
138
|
+
type: 'stdio',
|
|
139
|
+
command: 'npx',
|
|
140
|
+
args: ['-y', '@modelcontextprotocol/server-filesystem', '/tmp'],
|
|
141
|
+
env: {},
|
|
142
|
+
},
|
|
143
|
+
http: {
|
|
144
|
+
type: 'http',
|
|
145
|
+
url: 'http://localhost:3000/mcp',
|
|
146
|
+
proxy: {
|
|
147
|
+
host: '127.0.0.1',
|
|
148
|
+
port: 8080,
|
|
149
|
+
protocol: 'http',
|
|
150
|
+
},
|
|
151
|
+
},
|
|
152
|
+
https: {
|
|
153
|
+
type: 'https',
|
|
154
|
+
url: 'https://api.example.com/mcp',
|
|
155
|
+
proxy: {
|
|
156
|
+
host: '127.0.0.1',
|
|
157
|
+
port: 8080,
|
|
158
|
+
protocol: 'http',
|
|
159
|
+
auth: {
|
|
160
|
+
username: 'user',
|
|
161
|
+
password: 'pass',
|
|
162
|
+
},
|
|
163
|
+
},
|
|
164
|
+
},
|
|
165
|
+
websocket: {
|
|
166
|
+
type: 'wss',
|
|
167
|
+
url: 'wss://api.example.com/mcp',
|
|
168
|
+
proxy: {
|
|
169
|
+
host: '127.0.0.1',
|
|
170
|
+
port: 9050,
|
|
171
|
+
protocol: 'socks5',
|
|
172
|
+
},
|
|
173
|
+
},
|
|
174
|
+
};
|
|
175
|
+
const outputPath = path.resolve(options.output);
|
|
176
|
+
fs.writeFileSync(outputPath, JSON.stringify(exampleConfigs, null, 2), 'utf-8');
|
|
177
|
+
console.log(`Example configurations written to: ${outputPath}`);
|
|
178
|
+
console.log('\nExample usage:');
|
|
179
|
+
console.log(` mcp-pentester-cli connect --config ${outputPath} --transport stdio`);
|
|
180
|
+
console.log(' (Edit the file to select a specific config by extracting one transport)');
|
|
181
|
+
});
|
|
182
|
+
program.parse();
|
|
183
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,yCAAoC;AACpC,6CAAyC;AACzC,kCAA+B;AAE/B,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,mBAAmB,CAAC;KACzB,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,0BAA0B,CAAC;KACvC,MAAM,CAAC,wBAAwB,EAAE,6CAA6C,EAAE,OAAO,CAAC;KACxF,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;KAC9D,MAAM,CAAC,yBAAyB,EAAE,6BAA6B,CAAC;KAChE,MAAM,CAAC,sBAAsB,EAAE,6BAA6B,CAAC;KAC7D,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;KAClD,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;KAClD,MAAM,CAAC,6BAA6B,EAAE,4CAA4C,CAAC;KACnF,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;KACnD,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,MAAuB,CAAC;IAE5B,oCAAoC;IACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,MAAM,GAAG;YACP,IAAI,EAAE,OAAO,CAAC,SAAS;SACxB,CAAC;QAEF,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YACjC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,GAAG;gBACb,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACrC,QAAQ,EAAE,OAAO,CAAC,aAAa;aAChC,CAAC;YAEF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG;oBAClB,QAAQ,EAAE,OAAO,CAAC,SAAS;oBAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QACjD,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,aAAa;IACb,MAAM,GAAG,GAAG,IAAI,SAAG,EAAE,CAAC;IAEtB,4BAA4B;IAC5B,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,MAAM,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,KAAK,CAAC,CAClF,CAAC;QAEF,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iDAAiD;QACjD,IAAI,GAAG,IAAK,GAAW,CAAC,MAAM,EAAE,CAAC;YAC9B,GAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;KACpE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,MAAM,cAAc,GAAG;QACrB,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,CAAC,IAAI,EAAE,yCAAyC,EAAE,MAAM,CAAC;YAC/D,GAAG,EAAE,EAAE;SACR;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,MAAM;aACjB;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE;oBACJ,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;iBACjB;aACF;SACF;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,QAAQ;aACnB;SACF;KACF,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,EAAE,CAAC,aAAa,CACd,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EACvC,OAAO,CACR,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,wCAAwC,UAAU,oBAAoB,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
import { EventEmitter } from 'events';
|
|
2
|
+
import { TransportConfig, MCPTool, MCPResource, MCPPrompt, TrafficLog, MCPClientState } from './types';
|
|
3
|
+
export declare class MCPClient extends EventEmitter {
|
|
4
|
+
private config;
|
|
5
|
+
private transport?;
|
|
6
|
+
private state;
|
|
7
|
+
constructor(config: TransportConfig);
|
|
8
|
+
connect(): Promise<void>;
|
|
9
|
+
disconnect(): Promise<void>;
|
|
10
|
+
private initialize;
|
|
11
|
+
listTools(): Promise<MCPTool[]>;
|
|
12
|
+
callTool(name: string, args?: any): Promise<any>;
|
|
13
|
+
listResources(): Promise<MCPResource[]>;
|
|
14
|
+
readResource(uri: string): Promise<any>;
|
|
15
|
+
listPrompts(): Promise<MCPPrompt[]>;
|
|
16
|
+
getPrompt(name: string, args?: any): Promise<any>;
|
|
17
|
+
refreshAll(): Promise<void>;
|
|
18
|
+
getState(): MCPClientState;
|
|
19
|
+
getTrafficLog(): TrafficLog[];
|
|
20
|
+
clearTrafficLog(): void;
|
|
21
|
+
private logTraffic;
|
|
22
|
+
}
|
|
23
|
+
//# sourceMappingURL=mcp-client.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mcp-client.d.ts","sourceRoot":"","sources":["../src/mcp-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKtC,OAAO,EACL,eAAe,EAEf,OAAO,EACP,WAAW,EACX,SAAS,EACT,UAAU,EACV,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB,qBAAa,SAAU,SAAQ,YAAY;IAU7B,OAAO,CAAC,MAAM;IAT1B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,KAAK,CAMX;gBAEkB,MAAM,EAAE,eAAe;IAIrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoExB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAQnB,UAAU;IAqBlB,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAM/B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAOpD,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAMvC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIvC,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAMnC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAOrD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjC,QAAQ,IAAI,cAAc;IAI1B,aAAa,IAAI,UAAU,EAAE;IAI7B,eAAe,IAAI,IAAI;IAIvB,OAAO,CAAC,UAAU;CAcnB"}
|