# io.github.operantlabs/operant-mcp (npm · operant-mcp)

Security testing MCP server for penetration testing, forensics, and vulnerability assessment

- Trust score: 54/100 (low)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `operant-mcp`: 54/100 (this document), [markdown](https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp.md), [page](https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp)

## Channel facts

- Registry: `npm`
- Package: `operant-mcp`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 37/100
  - Malware scan not yet available for this package.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 124 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 6682 tokens (~131/item across 51 items; 51 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add operantlabs-operant-mcp -- npx -y operant-mcp
```

### Codex

```bash
codex mcp add operantlabs-operant-mcp -- npx -y operant-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "operantlabs-operant-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "operant-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add operantlabs-operant-mcp --command npx --arg -y --arg operant-mcp
```

### Hermes

```yaml
mcp_servers:
  operantlabs-operant-mcp:
    command: "npx"
    args: ["-y", "operant-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "operantlabs-operant-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "operant-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 54, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 51, +26)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-07-31 (score 25, +19)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −28)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 34)

First indexed and scored.

## MCP tools (51)

### `sqli_where_bypass` (~152 tokens)

Test WHERE clause bypass via OR 1=1 variants. Sends multiple payloads (OR 1=1--, OR '1'='1, OR 1=1/*, etc.) against the target parameter and compares response lengths to the baseline. Returns baseline_length and results array. Side effects: None (read-only GET requests). Sends 7 requests total.

Input parameters:

- `parameter` (string, required): Vulnerable query parameter name, e.g. 'category'
- `url` (string, required): Full URL with query parameter, e.g. https://target/filter?category=Gifts
- `value` (string, required): Legitimate parameter value to base the injection on, e.g. 'Gifts'

### `sqli_login_bypass` (~152 tokens)

Bypass login via SQL comment truncation (administrator'--). Extracts CSRF token from form, then POSTs with SQLi in the username field. The -- comment truncates the password check. Returns csrf_extracted, status_code, response_length, headers, likely_bypass.

Input parameters:

- `csrf_field` (string): Name of the CSRF token field in the form
- `password_field` (string): Name of the password form field
- `url` (string, required): Login form URL, e.g. https://target/login
- `username` (string): Target username to bypass auth for, e.g. 'administrator'
- `username_field` (string): Name of the username form field

### `sqli_union_extract` (~146 tokens)

Step-by-step UNION-based data extraction. 1. Finds column count via ORDER BY. 2. Identifies string-displayable columns via UNION SELECT. 3. Extracts database name and version. 4. Lists tables and columns. Returns column_count, string_columns, db_name, db_version, tables, user_columns. Side effects: Read-only GET requests. Sends ~30 requests depending on column count.

Input parameters:

- `max_columns` (number): Maximum columns to probe with ORDER BY
- `parameter` (string, required): Vulnerable query parameter name
- `url` (string, required): Full URL with injectable parameter, e.g. https://target/filter?category=Gifts

### `sqli_blind_boolean` (~144 tokens)

Boolean-based blind SQLi with binary search character enumeration. Uses ASCII(SUBSTRING(...))>N technique with binary search for efficiency. Determines true/false by comparing response lengths. Returns extracted_value, characters_found, requests_sent. Side effects: Read-only. Sends ~8 requests per character (binary search on ASCII 32-126).

Input parameters:

- `max_length` (number): Maximum string length to extract
- `parameter` (string, required): Vulnerable parameter name
- `query` (string): SQL sub-query to extract, e.g. 'database()' or '(SELECT password FROM users LIMIT 1)'
- `url` (string, required): Full URL with injectable parameter

### `sqli_blind_time` (~127 tokens)

Time-based blind SQLi detection for MySQL, PostgreSQL, and MSSQL. Sends sleep-inducing payloads and measures response time to detect injection. Returns vulnerable, dbtype, and results array with payload, response_time, triggered. Side effects: Read-only but slow (each payload waits up to delay_seconds). Sends 3 requests.

Input parameters:

- `dbtype` (string): Target database type
- `delay_seconds` (number): Sleep duration for true condition
- `parameter` (string, required): Vulnerable parameter name
- `url` (string, required): Full URL with injectable parameter

### `sqli_file_read` (~131 tokens)

Read server files via UNION SELECT LOAD_FILE(). Requires MySQL FILE privilege. Uses LOAD_FILE() in a UNION SELECT. Returns file_content, success, target_file. Errors: FILE privilege required. Returns empty if privilege denied.

Input parameters:

- `column_count` (number): Number of columns (from previous UNION discovery)
- `parameter` (string, required): Vulnerable parameter name
- `string_column` (number): 1-indexed column that displays strings
- `target_file` (string): Server-side file to read, e.g. /etc/passwd
- `url` (string, required): Full URL with injectable parameter

### `xss_reflected_test` (~123 tokens)

Test multiple reflected XSS vectors against a parameter. Sends 10 payloads (script tags, event handlers, SVG, attribute injection, case variation, template literals) and checks if they appear unescaped in the response. Returns results array with reflected/encoded/status per payload, and vulnerable_count. Side effects: Read-only GET requests. Sends 10 requests.

Input parameters:

- `parameter` (string, required): Parameter name that reflects input, e.g. 'q'
- `url` (string, required): URL with reflectable parameter, e.g. https://target/search?q=test

### `xss_payload_generate` (~115 tokens)

Generate context-appropriate XSS payloads with optional filter evasion. Returns a list of payloads tailored to the injection context and filter bypass requirements. Returns context, filter_bypass, payloads array, notes. Side effects: None. Pure payload generation, no network requests.

Input parameters:

- `callback_url` (string): Attacker-controlled URL for data exfiltration payloads
- `context` (string, required): Injection context: where the user input lands
- `filter_bypass` (string): Level of filter evasion needed

### `cmdi_test` (~168 tokens)

Test command injection using various shell operators. Tests ;, &&, ||, |, backtick, $(), and %0a (newline) operators with 'id' and 'whoami' as detection commands. Returns results array with operator, payload, status, output_snippet, likely_vulnerable. Side effects: Read-only detection commands (id, whoami). Sends ~14 requests.

Input parameters:

- `base_value` (string): Legitimate value for the parameter, e.g. '1'
- `method` (string): HTTP method
- `operators` (array): Injection operators to test. Default: all common operators.
- `parameter` (string, required): Vulnerable parameter name, e.g. 'storeId'
- `url` (string, required): Target URL that processes the parameter server-side

### `cmdi_blind_detect` (~152 tokens)

Detect blind command injection via time delay and OOB callbacks. Tests sleep-based delay detection and optional out-of-band (curl/nslookup to callback). Returns time_based results array and oob_payloads list. Side effects: Executes sleep on target if vulnerable. OOB payloads call back to callback_url.

Input parameters:

- `base_value` (string): Legitimate parameter value
- `callback_url` (string): Out-of-band callback URL for OOB detection (e.g. Burp Collaborator)
- `delay_seconds` (number): Sleep duration for time-based detection
- `method` (string): HTTP method
- `parameter` (string, required): Vulnerable parameter name
- `url` (string, required): Target URL

### `path_traversal_test` (~148 tokens)

Test path traversal with encoding variants at multiple depths. Tries plain ../, URL-encoded %2e%2e/, double-encoded %252e%252e/, and null-byte/truncation bypasses. Returns results array with payload, status, length, contains_target per attempt, and vulnerable_payloads list. Side effects: Read-only GET requests. Sends ~32 requests.

Input parameters:

- `depth` (number): Maximum directory traversal depth
- `parameter` (string, required): Parameter that accepts filenames
- `target_file` (string): Server file to attempt reading
- `url` (string, required): URL with file parameter, e.g. https://target/image?filename=photo.jpg

### `ssrf_test` (~157 tokens)

Test SSRF with localhost bypass variants. Sends 10+ representations of localhost (127.0.0.1, 0, decimal, hex, IPv6, etc.) to check if the server fetches internal resources. Returns results array with variant, payload_url, status, length, different_from_baseline per attempt. Side effects: May cause the target server to make internal requests.

Input parameters:

- `internal_target` (string): Internal resource to reach, e.g. 'http://localhost/admin'
- `method` (string): HTTP method
- `parameter` (string, required): Parameter that accepts URLs, e.g. 'url', 'src', 'redirect'
- `url` (string, required): Target URL that accepts a URL/host parameter

### `ssrf_cloud_metadata` (~122 tokens)

Test SSRF access to cloud metadata endpoints (AWS/GCP/Azure). Attempts to reach instance metadata services through the SSRF vector. Returns results array with provider, endpoint, status, length, response_snippet. Side effects: May cause target to request cloud metadata. Could expose IAM credentials if successful.

Input parameters:

- `cloud_provider` (string): Cloud provider to test metadata endpoints for
- `method` (string): HTTP method
- `parameter` (string, required): Parameter that accepts URLs
- `url` (string, required): Target URL with SSRF-vulnerable parameter

### `pcap_overview` (~59 tokens)

Get protocol hierarchy and endpoint statistics from a PCAP. Returns protocol_hierarchy, endpoints, packet_count, and capture_info. Read-only file analysis, no network access.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file

### `pcap_extract_credentials` (~73 tokens)

Extract credentials from FTP, HTTP, and SMTP traffic. Returns ftp_credentials, http_authorization_headers, http_post_data, and smtp_data. Read-only, may contain sensitive credentials.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file
- `protocol` (string): Protocol to extract credentials from

### `pcap_dns_analysis` (~72 tokens)

Extract and analyze DNS queries from a PCAP. Returns dns_queries_by_frequency, dns_servers, and ipv6_dns_endpoints. Read-only file analysis.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file
- `source_ip` (string): Filter DNS queries from a specific source IP

### `pcap_http_objects` (~75 tokens)

Export HTTP objects (files) from a PCAP to a directory. Returns exported_count, output_dir, files list, and tshark_output. Creates files in the output directory.

Input parameters:

- `output_dir` (string, required): Directory to export HTTP objects to
- `pcap_path` (string, required): Path to the PCAP file

### `pcap_detect_scan` (~57 tokens)

Detect port scans by analyzing SYN packets without ACK. Returns scanners (ip + syn_count), top_scanned_ports, and a hint. Read-only file analysis.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file

### `pcap_follow_stream` (~75 tokens)

Follow a TCP/UDP/HTTP stream in a PCAP. Returns stream_content, stream_num, and protocol. Read-only file analysis.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file
- `protocol` (string): Stream protocol
- `stream_num` (number, required): TCP stream number to follow

### `pcap_tls_analysis` (~66 tokens)

Analyze TLS handshakes, SNI values, and certificate data in a PCAP. Returns sni_values, tls_versions, server_ephemeral_keys, and client_randoms. Read-only file analysis.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file

### `pcap_llmnr_ntlm` (~64 tokens)

Detect LLMNR poisoning and extract NTLM credentials from SMB. Returns llmnr_queries, ntlm_auth_entries, counts, and poisoning_indicators. Read-only file analysis.

Input parameters:

- `pcap_path` (string, required): Path to the PCAP file

### `recon_quick` (~75 tokens)

Quick reconnaissance: robots.txt, security.txt, common dirs, response headers. Returns robots_txt, security_txt, response_headers, accessible_directories, and error_page_snippet. Read-only, sends ~10 GET requests.

Input parameters:

- `target` (string, required): Target domain or URL, e.g. example.com or https://example.com

### `recon_dns` (~65 tokens)

Full DNS enumeration: A, AAAA, MX, TXT, NS, CNAME, AXFR, BIND version. Returns records object, axfr_result, and bind_version. Read-only DNS queries.

Input parameters:

- `target` (string, required): Target domain, e.g. example.com

### `recon_vhost` (~115 tokens)

Brute-force virtual hosts by fuzzing the Host header. Returns baseline_length, results (vhost/status/length/length_delta), unique_vhosts, and tested count. Read-only, sends one request per wordlist entry.

Input parameters:

- `base_domain` (string, required): Base domain for vhost names, e.g. hackycorp.com
- `target` (string, required): Target IP or domain to send requests to
- `wordlist` (string): Path to wordlist file. Uses built-in common subdomains if not provided.

### `recon_tls_sans` (~71 tokens)

Extract Subject Alternative Names from the TLS certificate. Returns common_name, subject_alternative_names, issuer, validity, and san_count. Read-only TLS handshake.

Input parameters:

- `target` (string, required): Target domain or IP:port, e.g. example.com or 1.2.3.4:443

### `recon_directory_bruteforce` (~123 tokens)

Directory brute-force using parallel curl requests. Returns results (path/status/length), found_count, and paths_tested. Read-only GET requests, sends one request per wordlist entry per extension.

Input parameters:

- `extensions` (string): Comma-separated extensions to append, e.g. 'php,html,txt'
- `target` (string, required): Base URL, e.g. https://example.com
- `threads` (number): Concurrent request count
- `wordlist` (string): Path to wordlist file. Uses built-in common paths if not provided.

### `recon_git_secrets` (~69 tokens)

Search git history for secrets: commit messages, author info, branches, deleted files. Returns secrets_in_code_history, unique_authors, branches, deleted_files_summary, and suspicious_commit_messages. Read-only git operations on local repository.

Input parameters:

- `repo_path` (string, required): Path to the git repository

### `recon_s3_bucket` (~67 tokens)

Test an S3 bucket for public access (listing, reading). Returns bucket_url, listable, listing_snippet, and readable_files. Read-only requests to S3.

Input parameters:

- `bucket_name` (string, required): S3 bucket name to test, e.g. 'assets.example.com'

### `volatility_linux` (~106 tokens)

Run a Volatility 2 Linux plugin against a memory dump. Returns plugin, profile, success, output, and errors. Read-only analysis. Requires volatility2 (vol.py) on PATH.

Input parameters:

- `dump_path` (string, required): Path to the Linux memory dump file
- `plugin` (string, required): Volatility 2 Linux plugin to run
- `profile` (string, required): Volatility 2 profile name, e.g. 'LinuxCentOS7_7_1908x64'

### `volatility_windows` (~84 tokens)

Run a Volatility 3 Windows plugin against a memory dump. Returns plugin, success, output, and errors. Read-only analysis, Volatility 3 auto-detects OS. Requires vol3 (vol) on PATH.

Input parameters:

- `dump_path` (string, required): Path to the Windows memory dump file
- `plugin` (string, required): Volatility 3 Windows plugin to run

### `memory_detect_rootkit` (~85 tokens)

Check for rootkits via syscall table tampering and hidden kernel modules. Runs linux_check_syscall and linux_hidden_modules plugins. Returns syscall_check, hidden_modules, rootkit_indicators, and likely_compromised. Read-only analysis.

Input parameters:

- `dump_path` (string, required): Path to the Linux memory dump file
- `profile` (string, required): Volatility 2 profile name

### `maldoc_analyze` (~188 tokens)

Full malware document analysis pipeline.

1\. oledump.py — list OLE streams, identify macro-containing streams (marked 'M')
2\. olevba — extract VBA macro code
3\. Identify auto-execution triggers (Document_open, AutoOpen, Workbook_Open)
4\. Look for obfuscation patterns and base64 payloads
5\. Search for PowerShell, WMI, and shell execution indicators

Returns: {"ole_streams": str, "vba_macros": str, "auto_exec_triggers": [str], "suspicious_strings": [str], "iocs": [str]}.

Side effects: Read-only file analysis. Does NOT execute any payloads.

Errors: Requires oledump.py and olevba (pip install oletools).

Input parameters:

- `file_path` (string, required): Path to the suspicious OLE document (.doc, .xls, .bin)

### `maldoc_extract_macros` (~66 tokens)

Extract raw VBA macros from an OLE document.

Returns: {"macros": str, "stream_count": int, "macro_streams": [str]}.

Side effects: Read-only file analysis.

Input parameters:

- `file_path` (string, required): Path to the OLE document

### `cloudtrail_analyze` (~95 tokens)

Parse and analyze AWS CloudTrail logs.

Extracts event timeline, unique users, event types, and source IPs.

Returns: {"event_count": int, "unique_users": [str], "event_types": [str], "source_ips": [str], "timeline": str}.

Side effects: Read-only file analysis. Requires jq.

Input parameters:

- `log_dir` (string, required): Directory containing CloudTrail JSON log files

### `cloudtrail_find_anomalies` (~94 tokens)

Find anomalies in CloudTrail logs: non-AWS IPs, unusual API calls, role assumptions.

Returns: {"non_aws_ips": [str], "unusual_events": [str], "role_assumptions": [str], "data_exfil_indicators": [str]}.

Side effects: Read-only file analysis.

Input parameters:

- `log_dir` (string, required): Directory containing CloudTrail JSON log files

### `auth_csrf_extract` (~97 tokens)

Extract CSRF tokens from HTML forms.

Searches for the token in hidden input fields, meta tags, and script blocks.

Returns: {"tokens_found": [{"source": str, "value": str}], "cookies": [str]}.

Side effects: Single GET request.

Input parameters:

- `token_name` (string): CSRF token field name to search for
- `url` (string, required): URL of the form page containing CSRF token

### `auth_bruteforce` (~240 tokens)

Username enumeration and credential brute-force.

First enumerates valid usernames (if failure messages differ), then brute-forces passwords against confirmed usernames.

Returns: {"username_enumeration": [{"username": str, "exists": bool}], "valid_credentials": [{"username": str, "password": str}], "requests_sent": int}.

Side effects: Sends login requests. May trigger account lockout.

Errors: Rate limiting may block requests. Use realistic credentials to avoid WAF detection.

Input parameters:

- `concurrent` (number): Concurrent requests
- `content_type` (string): Request content type
- `failure_indicator` (string): String in response that indicates failure (e.g. 'invalid', 'incorrect')
- `method` (string): HTTP method
- `password_field` (string): Form field name for password
- `passwords` (array, required): Passwords to test
- `success_indicator` (string): String in response that indicates success (e.g. 'dashboard', 'welcome')
- `url` (string, required): Login form URL
- `username_field` (string): Form field name for username
- `usernames` (array, required): Usernames to test

### `auth_cookie_tamper` (~122 tokens)

Test cookie manipulation for privilege escalation.

Sends requests with tampered cookie values and checks for access.

Returns: {"results": [{"cookies": dict, "status": int, "length": int, "response_snippet": str}]}.

Side effects: Sends GET requests with manipulated cookies.

Input parameters:

- `cookies` (object, required): Cookie name-value pairs to send, e.g. {"logged_in": "true", "admin": "1"}
- `url` (string, required): URL to test with tampered cookies (e.g. /dashboard, /admin)

### `idor_test` (~269 tokens)

Test Insecure Direct Object References by iterating through IDs/GUIDs.

Sends requests with each ID and compares response status codes and lengths. Differing responses suggest IDOR — the server returns data for other users' objects without proper authorization checks.

Returns: {"baseline": dict, "results": [{"id": str, "status": int, "length": int, "different": bool, "snippet": str}], "idor_candidates": [str]}.

Side effects: Read-only requests. Sends len(id_list) + 1 requests.

Errors: ConnectionError if target unreachable.

Input parameters:

- `auth_cookie` (string): Session cookie to send (e.g. 'session=abc123'). If None, tests without auth
- `id_list` (array, required): List of IDs/GUIDs to test, e.g. ['1','2','3'] or ['abc-def-123', 'ghi-jkl-456']
- `method` (string): HTTP method to use
- `parameter` (string, required): Parameter name containing the ID, e.g. 'id'. Use '__path__' if the ID is in the URL path
- `url` (string, required): URL with ID parameter, e.g. https://target/my-account?id=123 or https://target/api/users/123

### `role_escalation_test` (~270 tokens)

Test cookie/parameter-based role escalation.

Sends requests with various role cookie values (Admin=true, roleid=2, etc.) and checks for privilege escalation. Also tests JSON body field manipulation for profile update endpoints.

Returns: {"baseline": dict, "results": [{"value": str, "status": int, "length": int, "escalated": bool}], "escalation_candidates": [str]}.

Side effects: If json_body is set, sends POST/PUT requests that may modify state.

Input parameters:

- `cookie_name` (string, required): Cookie name for role control, e.g. 'admin', 'role', 'is_admin'
- `cookie_values` (array, required): Values to test, e.g. ['true','1','admin','2','yes']
- `extra_cookies` (string): Additional cookies to include, e.g. 'session=abc123; logged_in=true'
- `json_body` (string): JSON body for POST-based role escalation, e.g. '{"roleid":2}'. Will test each value substituted
- `json_field` (string): JSON field to manipulate in json_body, e.g. 'roleid'
- `url` (string, required): Protected URL to access, e.g. https://target/admin or https://target/api/users

### `price_manipulation_test` (~216 tokens)

Test client-side price manipulation by sending modified price values.

Sends price=0, price=1, price=-1, and negative quantity variants to check if the server validates prices server-side.

Returns: {"results": [{"test_case": str, "payload": str, "status": int, "length": int, "accepted": bool, "snippet": str}]}.

Side effects: May add items to cart or create orders at manipulated prices.

Input parameters:

- `auth_cookie` (string): Session cookie for authenticated requests
- `cart_endpoint` (string): Separate cart/checkout endpoint to verify final price after manipulation
- `content_type` (string): Request content type: 'form' or 'json'
- `extra_params` (string): Additional form parameters, e.g. 'productId=1&quantity=1'
- `price_param` (string, required): Parameter name for the price, e.g. 'price', 'amount', 'total'
- `url` (string, required): URL that processes the purchase/cart action

### `coupon_abuse_test` (~187 tokens)

Test coupon stacking and alternation bypass.

Tests each coupon individually, then alternates between coupons to see if discounts compound past the intended limit.

Returns: {"individual_results": [...], "stacking_results": [...], "stacking_possible": bool}.

Side effects: Applies coupons to the cart. May modify cart totals.

Input parameters:

- `auth_cookie` (string): Session cookie for authenticated requests
- `coupon_endpoint` (string, required): Full URL for applying coupons, e.g. https://target/cart/coupon
- `coupon_param` (string): Form parameter name for the coupon code
- `coupons` (array, required): Coupon codes to test, e.g. ['NEWCUST5', 'SIGNUP30', 'FREESHIP']
- `stacking_rounds` (number): Number of alternation rounds to test for coupon stacking
- `url` (string, required): Coupon application endpoint URL

### `clickjacking_test` (~124 tokens)

Check X-Frame-Options and CSP frame-ancestors headers; generate PoC iframe HTML. Fetches response headers and checks for framing protections. If protections are missing, generates a ready-to-use PoC HTML page that embeds the target in a transparent iframe with a decoy button overlay. Returns: {headers, x_frame_options, csp_frame_ancestors, vulnerable, poc_html}. Side effects: Single HEAD/GET request.

Input parameters:

- `target_url` (string, required): URL to test for clickjacking vulnerability, e.g. https://target/my-account

### `frame_buster_bypass` (~118 tokens)

Test sandbox attribute bypass for JavaScript frame busters. Generates PoC HTML that uses iframe sandbox='allow-forms' to disable JavaScript execution (neutralizing frame-busting code) while still allowing form submission for clickjacking. Also checks if the target page contains common frame-busting patterns. Returns: {frame_buster_detected, patterns_found, sandbox_poc_html}. Side effects: Single GET request to detect frame-busting code.

Input parameters:

- `target_url` (string, required): URL that uses JavaScript frame-busting code

### `cors_test` (~164 tokens)

Test CORS misconfigurations: origin reflection, null origin trust, subdomain wildcards. Sends requests with various Origin headers and checks Access-Control-Allow-Origin and Access-Control-Allow-Credentials in the response. Misconfigurations allow attacker sites to read authenticated API responses. Returns: {results: [{test, origin_sent, acao, acac, vulnerable}], exploit_html}. Side effects: Read-only requests with custom Origin headers. Sends ~8 requests.

Input parameters:

- `api_endpoint` (string, required): API endpoint to test CORS on, e.g. /api/account or /api/users/me
- `auth_cookie` (string): Session cookie to include for authenticated CORS tests
- `url` (string, required): Base URL of the target application, e.g. https://target.com

### `file_upload_test` (~291 tokens)

Test web shell upload with Content-Type bypass variants. Attempts to upload a PHP web shell using various techniques: 1) Direct .php upload 2) .php with image/jpeg Content-Type (Content-Type bypass) 3) Alternative extensions (.php5, .phtml, .phar, .php7, .phps) 4) Double extension (.php.jpg) 5) Null byte (.php%00.jpg). After each upload, attempts to access the uploaded file to check execution. Returns: {results: [{technique, upload_status, execution_status, output, successful}]}. Side effects: Uploads files to the server. May achieve remote code execution.

Input parameters:

- `auth_cookie` (string): Session cookie for authenticated uploads
- `extra_fields` (string): Additional form fields, e.g. 'user=test&csrf=abc123'
- `shell_command` (string): Command the PHP shell should execute
- `upload_endpoint` (string, required): Upload endpoint path, e.g. /my-account/avatar or /api/upload
- `upload_field` (string): Form field name for the file upload, e.g. 'avatar', 'file', 'upload'
- `upload_path_prefix` (string): Path where uploaded files are accessible, e.g. /files/avatars/
- `url` (string, required): Base URL of the target application, e.g. https://target.com

### `nosqli_auth_bypass` (~178 tokens)

Test NoSQL operator injection ($ne, $gt, $regex) for authentication bypass. Sends payloads that abuse MongoDB query operators to bypass password checks. E.g., {"username":"admin","password":{"$ne":""}} matches any non-empty password. Returns: {results: [{payload_name, status, length, likely_bypass, snippet}]}. Side effects: Sends POST requests to the login endpoint. May create sessions.

Input parameters:

- `password_param` (string): JSON field name for password
- `target_username` (string): Username to bypass auth for, e.g. 'admin'
- `url` (string, required): Login endpoint URL, e.g. https://target/login or https://target/api/auth
- `username_param` (string): JSON field name for username, e.g. 'username' or 'email'

### `nosqli_detect` (~150 tokens)

Test NoSQL injection detection in query parameters. Tests MongoDB operator injection ($ne, $gt, $regex, $where) in GET parameters and JSON body to detect NoSQL injection points. Returns: {baseline, results: [{payload_name, status, length, different}], injectable}. Side effects: Read-only. Sends ~10 requests.

Input parameters:

- `content_type` (string): 'query' for URL params, 'json' for JSON body
- `method` (string): HTTP method
- `parameter` (string, required): Parameter name to test for NoSQL injection
- `url` (string, required): URL with query parameter to test, e.g. https://target/api/products?category=Gifts

### `deserialization_test` (~190 tokens)

Detect and manipulate serialized objects in cookies. Analyzes cookie values for serialization patterns (PHP serialize, Java, .NET ViewState, base64-encoded JSON). If a serialized format is detected, attempts privilege escalation by modifying fields (admin=1, role=admin). Returns: {detection: {format, decoded, fields}, manipulation_results: [...]}. Side effects: Sends requests with modified cookies. May escalate privileges if successful.

Input parameters:

- `auth_cookie` (string): Additional auth cookies to send, e.g. 'session=abc123'
- `cookie_name` (string, required): Cookie name that may contain serialized data, e.g. 'session', 'user', 'data'
- `cookie_value` (string): Current cookie value to analyze. If not provided, fetches from the target URL
- `url` (string, required): Target URL to test, e.g. https://target/my-account

### `graphql_introspect` (~150 tokens)

Run introspection query to enumerate all types, fields, and mutations. Sends the standard GraphQL introspection query (__schema) to discover the full API schema including hidden/undocumented fields, mutations, and types. Returns: {introspection_enabled, types: [{name, kind, fields: [str]}], mutations: [str], queries: [str]}. Side effects: Single POST request. Read-only.

Input parameters:

- `auth_cookie` (string): Session cookie for authenticated requests
- `auth_header` (string): Authorization header value, e.g. 'Bearer abc123'
- `url` (string, required): GraphQL endpoint URL, e.g. https://target/graphql or https://target/api

### `graphql_find_hidden` (~235 tokens)

Find hidden/undocumented fields on a GraphQL type using field suggestion errors. Sends queries with intentionally misspelled field names to trigger GraphQL's field suggestion feature, which reveals valid field names. Also tries common sensitive field names directly. Returns: {discovered_fields: [str], suggestion_results: [...], direct_probe_results: [...]}. Side effects: Read-only POST requests. Sends ~25 requests.

Input parameters:

- `auth_cookie` (string): Session cookie
- `auth_header` (string): Authorization header value
- `known_field` (string): A known field on this type to use in queries, e.g. 'id' or 'title'
- `query_arg` (string): Query argument, e.g. 'id: 1' or 'slug: "test"'
- `query_name` (string): Query name to use for fetching objects, e.g. 'getUser' or 'getBlogPost'
- `type_name` (string, required): GraphQL type to probe for hidden fields, e.g. 'User', 'Post', 'BlogPost'
- `url` (string, required): GraphQL endpoint URL

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp#diagnostics

## Score history

- 2026-08-03: 54
- 2026-08-02: 51
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 6
- 2026-07-28: 34
- 2026-07-27: 34

## Links

- npm package: https://www.npmjs.com/package/operant-mcp
- Socket report: https://socket.dev/npm/package/operant-mcp
- Repository: https://github.com/operantlabs/operant-mcp
- Changelog RSS feed: https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/operantlabs-operant-mcp/operant-mcp