DryHack-MCP - an MCP server providing offensive-security tooling (curl, python, shell, Playwright browser) and a scope-gated authorize engine for authorized penetration testing.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"dryhack-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# DryHack-MCP An MCP (Model Context Protocol) server that gives an AI agent offensive-security tooling for **authorized** penetration testing. It exposes four tools: | Tool | Purpose | |------|---------| | `curl` | Raw HTTP interaction for web recon/exploitation | | `python` | Run ad-hoc Python snippets for scripted probing | | `shell` | Run shell commands (`nmap`, `ffuf`, `nc`, `sqlmap`, …) | | `browser` | Full Playwright browser automation: navigation, DOM interaction, JavaScript injection, screenshots/PDF, cookies/headers, multi-step chains | | `authorize` | Checks target membership in the per-call `scope` parameter; does not verify permission (no external API, no creds) | > ⚠️ **Legal notice.** Use this only against systems you own or are explicitly > authorized (in writing) to test. You are responsible for staying within scope. ## Install ```bash python3 -m pip install . ``` This installs the `dryhack-mcp` console script (the MCP server). ### Run without installing (uvx) With [uv](https://docs.astral.sh/uv/) you can run the server directly from PyPI — no manual install needed: ```bash # recommended: pull the browser extra so the `browser` tool is guaranteed uvx --from 'dryhack-mcp[browser]' dryhack-mcp # http transport uvx --from 'dryhack-mcp[browser]' dryhack-mcp --transport http --host 0.0.0.0 --port 8000 # pin a version uvx --from 'dryhack-mcp[browser]==2.3.2' dryhack-mcp ``` > `uvx dryhack-mcp` (without `--from`) also works — Playwright is a core > dependency — but the explicit `--from 'dryhack-mcp[browser]'` form is the > recommended, unambiguous way to get everything the `browser` tool needs even > if a stale cache is involved. For development: ```bash python3 -m pip install -e ".[dev]" ``` ### Browser tool (Playwright) Playwright is a **core dependency**, so a plain `pip install dryhack-mcp` / `uvx dryhack-mcp` already ships it. For MCP clients using uvx, the recommended, unambiguous invocation is: ```bash uvx --from 'dryhack-mcp[browser]…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.