DryHack-MCP

An MCP (Model Context Protocol) server that gives an AI agent offensive-security tooling for authorized penetration testing. It exposes four tools:

⚠️ Legal notice. Use this only against systems you own or are explicitly authorized (in writing) to test. You are responsible for staying within scope.

Install

python3 -m pip install .

This installs the dryhack-mcp console script (the MCP server).

For development:

python3 -m pip install -e ".[dev]"

Run

Two transports are supported. Select with --transport (argparse).

stdio (default)

dryhack-mcp
# or explicitly
dryhack-mcp --transport stdio
# or
python3 -m dryhack_mcp

http (streamable HTTP)

dryhack-mcp --transport http --host 0.0.0.0 --port 8000

CLI options:

-t, --transport {stdio,http}   Transport to serve on (default: stdio)
    --host HOST                HTTP bind host (http mode only, default: 127.0.0.1)
    --port PORT                HTTP bind port (http mode only, default: 8000)

MCP client config

stdio

{
  "mcpServers": {
    "dryhack": {
      "command": "dryhack-mcp",
      "env": {
        "DRYHACK_API_KEY": "sk-...",
        "DRYHACK_API_BASE": "https://api.openai.com/v1",
        "DRYHACK_MODEL": "gpt-4o-mini",
        "DRYHACK_UNRESTRICTED": "true"
      }
    }
  }
}

http

{
  "mcpServers": {
    "dryhack": {
      "url": "http://127.0.0.1:8000/mcp"
    }
  }
}

Start the server separately with dryhack-mcp --transport http.

Configuration (environment variables)

recommend_action

The recommend_action tool consults an upstream LLM ("the safeguard API") for the next offensive step. Generic safeguards often refuse legitimate, authorized red-team requests. In unrestricted mode each request is framed with an explicit authorized-engagement / lab-scope context (rules-of-engagement on file, targets owned by the requesting party) so the model answers operationally.

• Global default: DRYHACK_UNRESTRICTED=true|false
• Per-call override: recommend_action(context=..., unrestricted=true)

When unrestricted is off, requests use the plain system prompt with no authorization framing.

Example

recommend_action(
    context="nmap shows 22/tcp ssh, 80/tcp http (nginx), 443/tcp https. /login found.",
    goal="get an initial foothold",
    unrestricted=True,
)