MCPhantom is a local web dashboard for MCP endpoint recon. Discover resources, templates, tools, and prompts, then interact with them from a security console.
MCPhantom is a local web dashboard for MCP endpoint reconnaissance and exploitation. Point it at any MCP URL, discover exposed resources, templates, tools, and prompts, then interact with them from a clean security console UI. Runs locally at 127.0.0.1:1337; no cloud, no setup beyond Python. Project's Documentation can be found here.
[!WARNING] MCPhantom is an extensible security auditing framework; not a turnkey, universal scanner. It provides a solid foundation for MCP focused reconnaissance and vulnerability testing, but it is intentionally designed as a starting skeleton that you are expected to adapt to your targets, environments, and methodology. - Not guaranteed to work out of the box on every MCP server : Capabilities, schemas, transports, and response formats vary widely across implementations. Classification, payload delivery, and proof detection may need tuning per target. - Payload coverage is deliberately limited : MCPhantom includes representative probes for classes such as SQL injection, command injection, SSRF, path traversal, IDOR, and information disclosure, but it does not ship exhaustive wordlists or engine scale fuzzing comparable to tools like sqlmap, Burp Intruder, or commercial DAST platforms. - Proof heuristics are best-effort : Findings are scored from response signals (errors, data leaks, version strings, reflected output, etc.). False positives and false negatives are possible without target-specific customization. This is exactly why the framework also allows you to do manual auditing. - You are encouraged to extend it : The project is open sou
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/Dragkob--MCPhantom.html)
Give the agent "this" and he gets a real PC.
KB-perByte/hiveshareCollaborative AI memory for engineering teams - share context across Claude Code, Cursor, and teammates
cumakurt/SonarQubeCE-setupSonarQube Community Build (universal setup)
The-Swarm-Corporation/mcp-scribePoint it at an OpenAPI schema. Get an MCP server.
LeastAction-Labs/LeastAction-LiteOne platform to build, run, and operate every data workflow your team touches. Source-available, self-hosted.
codeztech-atique/500-AI-Agents-ProjectsThe 500 AI Agents Projects is a curated collection of AI agent use cases across various industries. It showcases practical applications and provides links to open-source projects for implementation, i
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.