Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.daedalus/mcp-pwntools

PYPI · MCP-PWNTOOLS · SCANNED SEP 20

MCP server exposing pwntools 4.15.0 functionality for binary exploitation

Available components

0 this week 68 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 12 of 58 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 1710 tokens (~41/item across 41 items; 40 tools + 1 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: two runs of the same published version returned different tool surfaces, so we cannot tell a change in the package from a difference in our own sandbox run.Unverified
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 92% of tool parameters carry a description.Partial
  • Structured output schemas are declared (98% of tools); any adoption earns full credit.Pass
Tool Safety50
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "tube_send" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • Manipulation not yet verified: only 38 of 41 captured unit(s) of tool text has been judged so far, so we will not certify text no model has read as clean.Unverified
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.daedalus/mcp-pwntools server?

io.github.daedalus/mcp-pwntools runs locally as a PyPI package, launched with uvx mcp-pwntools. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · mcp-pwntools

# add to Claude Code
claude mcp add daedalus-mcp-pwntools -- uvx mcp-pwntools
// .cursor/mcp.json
{
  "mcpServers": {
    "daedalus-mcp-pwntools": {
      "command": "uvx",
      "args": [
        "mcp-pwntools"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "daedalus-mcp-pwntools": {
      "command": "uvx",
      "args": [
        "mcp-pwntools"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add daedalus-mcp-pwntools -- uvx mcp-pwntools
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "daedalus-mcp-pwntools": {
      "type": "local",
      "command": [
        "uvx",
        "mcp-pwntools"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add daedalus-mcp-pwntools --command uvx --arg mcp-pwntools
# ~/.hermes/config.yaml
mcp_servers:
  daedalus-mcp-pwntools:
    command: "uvx"
    args: ["mcp-pwntools"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "daedalus-mcp-pwntools": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "mcp-pwntools"
      ]
    }
  }
}
# add to Vellum
assistant mcp add daedalus-mcp-pwntools -t stdio -c uvx -a mcp-pwntools
// mcp.json
{
  "mcpServers": {
    "daedalus-mcp-pwntools": {
      "command": "uvx",
      "args": [
        "mcp-pwntools"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Sept 26 +15
    • Malware scan: unverified → pass security
  • 14 Sept 26 −15
    • Malware scan: pass → unverified security
  • 9 Sept 26 −13
    • Stability: 0.93 → unverified security
  • 7 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 5 Sept 26 −2
    • Stability: pass → 0.83 functional
  • 4 Sept 26 0
    • Stability: 0.97 → pass security
  • 3 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Sept 26 0
    • MCP protocol: Implements a current MCP spec version (2026-07-28). functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/mcp-pwntools@0.1.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 58 packages
Packages resolved 58
Stale 12
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 40 exposed · ~1,692 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
asm ~69

Assemble code to bytes.

NameTypeReqDescription
archstringArchitecture (i386, amd64, arm, mips, etc.). Uses context if not specified.
codestringyesAssembly code.
osstringOS (linux, freebsd, etc.). Uses context if not specified.
NameTypeReqDescription
resultstringyes

No examples provided.

context_get ~45

Get current pwntools context. Returns: Current context settings. Example: >>> context_get() {'arch': 'amd64', 'os': 'linux', ...}

Input schema present but exposes no named parameters.

Structured output declared, but exposes no named fields.

No examples provided.

context_set ~99

Set pwntools context.

NameTypeReqDescription
archstringArchitecture (i386, amd64, arm, mips, etc.).
endianstringEndianness (little, big).
log_levelstringLogging level (debug, info, warning, error).
osstringOS (linux, freebsd, etc.).
word_sizeintegerWord size in bits (32, 64).

Structured output declared, but exposes no named fields.

No examples provided.

cyclic ~34

Generate cyclic pattern.

NameTypeReqDescription
lengthintegeryesLength of pattern.
nintegerAlphabet size (default 256).
NameTypeReqDescription
resultstringyes

No examples provided.

cyclic_find ~27

Find offset in cyclic pattern.

NameTypeReqDescription
patternstringyesHex string of pattern to find.
NameTypeReqDescription
resultintegeryes

No examples provided.

disasm ~59

Disassemble bytes to code.

NameTypeReqDescription
archstringArchitecture. Uses context if not specified.
bitsintegerBits (32, 64). Uses context if not specified.
datastringyesHex string to disassemble.
NameTypeReqDescription
resultstringyes

No examples provided.

dynelf_resolve ~40

Dynamic ELF resolution. Note: Requires active memory leak.

NameTypeReqDescription
_elf_pathstring
_leak_funcstringyes

Structured output declared, but exposes no named fields.

No examples provided.

elf_asm ~56

Assemble code at a specific address in an ELF.

NameTypeReqDescription
addressstringyesAddress (hex string like '0x400000').
codestringyesAssembly code.
pathstringyesPath to ELF file.
NameTypeReqDescription
resultstringyes

No examples provided.

elf_load ~24

Load an ELF file.

NameTypeReqDescription
pathstringyesPath to ELF file.

Structured output declared, but exposes no named fields.

No examples provided.

elf_read ~56

Read bytes from an ELF at address.

NameTypeReqDescription
addressstringyesAddress (hex string like '0x400000').
lengthintegerNumber of bytes to read.
pathstringyesPath to ELF file.
NameTypeReqDescription
resultstringyes

No examples provided.

elf_write ~55

Write bytes to an ELF at address.

NameTypeReqDescription
addressstringyesAddress (hex string like '0x400000').
datastringyesHex string to write.
pathstringyesPath to ELF file.
NameTypeReqDescription
resultstringyes

No examples provided.

enhex ~25

Encode bytes to hex string.

NameTypeReqDescription
datastringyesHex string to encode.
NameTypeReqDescription
resultstringyes

No examples provided.

fit ~47

Fit data into buffer.

NameTypeReqDescription
dataobjectyesDictionary mapping offsets to values.
fillerstringHex string for filler bytes.
lengthintegerTotal length of buffer.
NameTypeReqDescription
resultstringyes

No examples provided.

flat ~57

Flatten arguments into bytes.

NameTypeReqDescription
argsarrayyesList of arguments to flatten (integers or hex strings).
endianstringEndianness (default from context).
signbooleanSignedness (default from context).
NameTypeReqDescription
resultstringyes

No examples provided.

fmtstr_payload ~52

Generate format string payload.

NameTypeReqDescription
nbytesintegerNumber of bytes.
offsetintegeryesOffset to format string.
writesobjectyesDict of {address: value} to write.
NameTypeReqDescription
resultstringyes

No examples provided.

fmtstr_split ~41

Split format string writes.

NameTypeReqDescription
nbytesintegerNumber of bytes.
writesobjectyesDict of {address: value} to write.

No output schema declared.

No examples provided.

hexdump ~35

Hexdump utility.

NameTypeReqDescription
beginintegerOffset to start from.
datastringyesHex string to dump.
NameTypeReqDescription
resultstringyes

No examples provided.

listen ~39

Create a listening socket.

NameTypeReqDescription
bindaddrstringAddress to bind to.
portintegerPort to listen on (0 for random).

Structured output declared, but exposes no named fields.

No examples provided.

log_debug ~23

Log debug message.

NameTypeReqDescription
msgstringyesMessage to _log.
NameTypeReqDescription
resultstringyes

No examples provided.

log_error ~23

Log error message.

NameTypeReqDescription
msgstringyesMessage to _log.
NameTypeReqDescription
resultstringyes

No examples provided.

log_info ~23

Log info message.

NameTypeReqDescription
msgstringyesMessage to _log.
NameTypeReqDescription
resultstringyes

No examples provided.

log_success ~23

Log success message.

NameTypeReqDescription
msgstringyesMessage to _log.
NameTypeReqDescription
resultstringyes

No examples provided.

log_warn ~23

Log warning message.

NameTypeReqDescription
msgstringyesMessage to _log.
NameTypeReqDescription
resultstringyes

No examples provided.

p16 ~44

Pack an integer into 2 bytes.

NameTypeReqDescription
endianstring'little' or 'big'.
nintegeryesInteger to pack (0-65535).
NameTypeReqDescription
resultstringyes

No examples provided.

p32 ~39

Pack an integer into 4 bytes.

NameTypeReqDescription
endianstring'little' or 'big'.
nintegeryesInteger to pack.
NameTypeReqDescription
resultstringyes

No examples provided.

p64 ~39

Pack an integer into 8 bytes.

NameTypeReqDescription
endianstring'little' or 'big'.
nintegeryesInteger to pack.
NameTypeReqDescription
resultstringyes

No examples provided.

p8 ~30

Pack an integer into 1 byte.

NameTypeReqDescription
nintegeryesInteger to pack (0-255).
NameTypeReqDescription
resultstringyes

No examples provided.

process_create ~84

Create and interact with a process.

NameTypeReqDescription
argvarrayyesCommand and arguments as list.
envobjectEnvironment variables dict.
stderrintegerStderr redirect.
stdinintegerStdin redirect (PIPE, STDOUT, etc.).
stdoutintegerStdout redirect.
timeoutintegerTimeout in seconds.

Structured output declared, but exposes no named fields.

No examples provided.

remote_connect ~44

Connect to a remote host.

NameTypeReqDescription
hoststringyesHostname or IP.
portintegeryesPort number.
timeoutintegerTimeout in seconds.

Structured output declared, but exposes no named fields.

No examples provided.

rop_call ~47

Generate ROP call. Note: Requires an active ROP object.

NameTypeReqDescription
_argsarray
_funcstringyes
_runtimestringyes
NameTypeReqDescription
resultstringyes

No examples provided.

rop_load ~26

Load ELF for ROP.

NameTypeReqDescription
pathstringyesPath to ELF file.

Structured output declared, but exposes no named fields.

No examples provided.

shellcraft ~69

Generate shellcode.

NameTypeReqDescription
arg1stringOptional first argument.
arg2stringOptional second argument.
shellcode_typestringyesType of shellcode (e.g., 'amd64.linux.sh', 'i386.linux.bind', 'setreuid').
NameTypeReqDescription
resultstringyes

No examples provided.

shellcraft_dupsh ~30

Generate dup shellcode with execve.

NameTypeReqDescription
fdintegerFile descriptor to dup.
NameTypeReqDescription
resultstringyes

No examples provided.

shellcraft_setreuid ~40

Generate setreuid shellcode.

NameTypeReqDescription
euidintegerEffective UID to set.
uidintegerUID to set.
NameTypeReqDescription
resultstringyes

No examples provided.

tube_send ~45

Send data through a tube. Note: This is a placeholder - actual tube handling requires state management.

NameTypeReqDescription
_datastringyes
_tube_typestring
NameTypeReqDescription
resultstringyes

No examples provided.

u16 ~42

Unpack 2 bytes to integer.

NameTypeReqDescription
datastringyesHex string of 2 bytes.
endianstring'little' or 'big'.
NameTypeReqDescription
resultintegeryes

No examples provided.

u32 ~42

Unpack 4 bytes to integer.

NameTypeReqDescription
datastringyesHex string of 4 bytes.
endianstring'little' or 'big'.
NameTypeReqDescription
resultintegeryes

No examples provided.

u64 ~42

Unpack 8 bytes to integer.

NameTypeReqDescription
datastringyesHex string of 8 bytes.
endianstring'little' or 'big'.
NameTypeReqDescription
resultintegeryes

No examples provided.

u8 ~29

Unpack 1 byte to integer.

NameTypeReqDescription
datastringyesHex string of 1 byte.
NameTypeReqDescription
resultintegeryes

No examples provided.

unhex ~25

Decode hex string to bytes.

NameTypeReqDescription
datastringyesHex string to decode.
NameTypeReqDescription
resultstringyes

No examples provided.

Common questions

What is the io.github.daedalus/mcp-pwntools server?

io.github.daedalus/mcp-pwntools is listed in the public MCP registry as io.github.daedalus/mcp-pwntools. MCP server exposing pwntools 4.15.0 functionality for binary exploitation. This page covers its PyPI package (mcp-pwntools).

Is the io.github.daedalus/mcp-pwntools server safe to use?

io.github.daedalus/mcp-pwntools scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.daedalus/mcp-pwntools server expose?

io.github.daedalus/mcp-pwntools exposes 40 tools: p8, p16, p32, p64, u8, and 35 more. Their descriptions and schemas cost roughly 1,692 tokens of context every time the server is loaded.

Is the io.github.daedalus/mcp-pwntools server still maintained?

io.github.daedalus/mcp-pwntools is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.daedalus/mcp-pwntools server under?

io.github.daedalus/mcp-pwntools declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.