Affected by GO-2024-2993 and 5 other vulnerabilities

GO-2024-2993: Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver

GO-2026-4280: Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver

GO-2026-4466: Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver

GO-2026-4609: Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers in github.com/bishopfox/sliver

GO-2026-4723: Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports in github.com/bishopfox/sliver

GO-2026-4899: Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted in github.com/bishopfox/sliver

mcp

package

v1.7.5 Latest Latest Go to latest Published: Mar 31, 2026 License: GPL-3.0 Imports: 28 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bishopfox/sliver

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func AuthConfigPath() string
func AuthHeaderName() string
func ServeStdio(cfg Config, rpc rpcpb.SliverRPCClient) error
func Start(cfg Config, rpc rpcpb.SliverRPCClient) error
func Stop(ctx context.Context) error
type AuthInfo
- func LoadAuthInfo() (AuthInfo, error)
- func ResolveAuthInfo() (AuthInfo, bool, error)
type Config
- func DefaultConfig() Config
type SliverMCPServer
type Status
- func GetStatus() Status
type Transport
- func ParseTransport(raw string) (Transport, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrAlreadyRunning = errors.New("mcp server already running")
	ErrNotRunning     = errors.New("mcp server not running")
)

Functions ¶

func AuthConfigPath ¶ added in v1.7.4

func AuthConfigPath() string

AuthConfigPath returns the MCP auth config path in the client app directory.

func AuthHeaderName ¶ added in v1.7.4

func AuthHeaderName() string

AuthHeaderName returns the required header name for MCP HTTP/SSE requests.

func ServeStdio ¶

func ServeStdio(cfg Config, rpc rpcpb.SliverRPCClient) error

ServeStdio runs the MCP server over stdio using the provided configuration.

func Start ¶

func Start(cfg Config, rpc rpcpb.SliverRPCClient) error

Start launches the MCP server using the provided configuration.

func Stop ¶

func Stop(ctx context.Context) error

Stop shuts down the MCP server.

Types ¶

type AuthInfo ¶ added in v1.7.4

type AuthInfo struct {
	Header     string
	Token      string
	ConfigPath string
}

AuthInfo describes the persisted MCP HTTP/SSE authentication settings.

func LoadAuthInfo ¶ added in v1.7.4

func LoadAuthInfo() (AuthInfo, error)

LoadAuthInfo loads the persisted MCP auth configuration without creating it.

func ResolveAuthInfo ¶ added in v1.7.4

func ResolveAuthInfo() (AuthInfo, bool, error)

ResolveAuthInfo loads the persisted auth token or creates and saves one on first use.

type Config ¶

type Config struct {
	Transport     Transport
	ListenAddress string
	ServerName    string
	ServerVersion string
}

Config controls the local MCP server settings.

func DefaultConfig ¶

func DefaultConfig() Config

DefaultConfig returns the baseline MCP configuration.

func (Config) EndpointURL ¶

func (c Config) EndpointURL() (string, error)

EndpointURL returns the base URL for clients to connect.

func (Config) Validate ¶

func (c Config) Validate() error

Validate ensures the configuration can be used for a server start.

func (Config) WithDefaults ¶

func (c Config) WithDefaults() Config

WithDefaults fills any empty fields with defaults.

type SliverMCPServer ¶

type SliverMCPServer struct {
	Rpc rpcpb.SliverRPCClient
	// contains filtered or unexported fields
}

SliverMCPServer wraps the MCP server with Sliver RPC access for handlers.

type Status ¶

type Status struct {
	Running        bool
	StartedAt      time.Time
	Config         Config
	LastError      string
	AuthHeader     string
	AuthToken      string
	AuthConfigPath string
}

Status describes the running state of the MCP server.

func GetStatus ¶

func GetStatus() Status

GetStatus returns the current MCP server state.

type Transport ¶

type Transport string

Transport identifies the MCP server transport to expose.

const (
	TransportHTTP Transport = "http"
	TransportSSE  Transport = "sse"
)

func ParseTransport ¶

func ParseTransport(raw string) (Transport, error)

ParseTransport validates an input transport string.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL