Mythic MCP Server

An MCP server that gives AI assistants full operational control of the Mythic C2 Framework.

Documentation · Tool Reference · Lab Walkthrough

147 tools · 18 categories · Go · Mythic ≥ 3.3.0

Mythic MCP Server exposes every meaningful operation in the Mythic C2 Framework as a structured Model Context Protocol tool. Connect it to Claude, ChatGPT, or any MCP client and operate Mythic through natural language.

flowchart LR
    A["🤖 AI Assistant"] -- MCP --> B["⚡ Mythic MCP Server"]
    B -- SDK --> C["🎯 Mythic C2"]
    C -- GraphQL + REST --> B
    B -- MCP --> A

Capabilities

• Auth — login, API tokens, session management
• Payloads — build, download, inspect agents (Xenon, Poseidon, Forge, …)
• Callbacks — list, task, pivot, manage active sessions
• C2 Profiles — start/stop listeners, IOCs, configuration
• Tasks — issue commands, read output, wait for completion
• Files — upload, download, preview, bulk export
• MITRE ATT&CK — technique lookup, coverage mapping
• Operations — campaign management, event logs, global settings
• + 10 more categories — credentials, artifacts, hosts, processes, screenshots, keylogs, tags, operators, commands, documentation

Full schema for every tool: Tool Reference →

Quick Start

# Build
go build -o mythic-mcp ./cmd/mythic-mcp

# Run (stdio — Claude Desktop)
MYTHIC_URL=https://mythic.lab:7443 \
MYTHIC_API_TOKEN=your-token \
  ./mythic-mcp

# Run (HTTP/SSE — Docker / remote)
MCP_TRANSPORT=http MCP_HTTP_PORT=3333 \
MYTHIC_URL=https://mythic.lab:7443 \
MYTHIC_API_TOKEN=your-token \
  ./mythic-mcp

Docker

docker build -t mythic-mcp:latest .
docker run -d --name mythic-mcp --network mythic_default \
  -p 3333:3333 \
  -e MYTHIC_URL=https://mythic_nginx:7443 \
  -e MYTHIC_API_TOKEN=your-token \
  -e MCP_TRANSPORT=http -e MCP_HTTP_PORT=3333 \
  -e MYTHIC_SKIP_TLS_VERIFY=true \
  mythic-mcp:latest

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mythic": {
      "command": "/path/to/mythic-mcp",
      "env": {
        "MYTHIC_URL": "https://mythic.lab:7443",
        "MYTHIC_API_TOKEN": "your-token"
      }
    }
  }
}

See the full Getting Started guide for all options.

Configuration

_{¹ One of API token or username/password is required.}

Architecture

flowchart LR
    subgraph Client["MCP Client"]
        CL["Claude / ChatGPT"]
    end
    subgraph Server["Mythic MCP Server"]
        T["`147 Tools
18 Categories`"]
    end
    subgraph Mythic["Mythic C2 Framework"]
        API["GraphQL + REST"]
    end
    CL -- "MCP (stdio / HTTP)" --> T
    T -- "Go SDK" --> API
    API -- responses --> T
    T -- results --> CL

The server is a thin, type-safe translation layer. Each tool validates inputs against a JSON Schema derived from Go struct tags, calls the Mythic Go SDK, and returns structured results.

Full architecture docs: Architecture →

Documentation Site

The documentation at nbaertsch.github.io/Mythic-MCP is auto-generated and deployed on every push to main. The Tool Reference pages are built by a Go program (tools/gen-schema-docs) that parses the source code directly — tool names, descriptions, and parameter schemas are always in sync.

# Preview docs locally
pip install -r requirements-docs.txt
go run ./tools/gen-schema-docs
mkdocs serve

Contributing

git clone https://github.com/nbaertsch/Mythic-MCP.git
cd Mythic-MCP && go mod download

• Run golangci-lint run before committing
• Tool files follow the pattern in pkg/server/tools_*.go
• Tool reference pages are auto-generated — don't edit site/content/tools/*.md by hand

See Contributing →

Related Projects

License

MIT