Mythic MCP Server¶

What is this?¶

Mythic MCP Server is a Model Context Protocol server that wraps every operation in the Mythic C2 Framework as a structured MCP tool, so AI assistants like Claude, ChatGPT, or any MCP-compatible client can:

• Authenticate with Mythic instances
• Build and deploy payloads (Xenon, Poseidon, Forge, …)
• Manage callbacks — issue tasks, read output, pivot
• Upload / download files, screenshots, keylogs
• Map MITRE ATT&CK techniques to every action
• Query operations — hosts, credentials, artifacts, processes

All through natural language — the AI translates intent into the right tool calls automatically.

Architecture¶

flowchart LR
    A["AI Assistant<br/>(Claude, etc.)"] -->|MCP Protocol| B["Mythic MCP Server"]
    B -->|Go SDK| C["Mythic C2 Framework"]
    C --> D["Agents<br/>Xenon · Poseidon · Forge"]
    C --> E["C2 Profiles<br/>httpx · tcp · http"]
    C --> F["Data<br/>Callbacks · Tasks · Files"]

    style A fill:#7c3aed,color:#fff,stroke:none
    style B fill:#4f46e5,color:#fff,stroke:none
    style C fill:#f59e0b,color:#000,stroke:none
    style D fill:#10b981,color:#fff,stroke:none
    style E fill:#10b981,color:#fff,stroke:none
    style F fill:#10b981,color:#fff,stroke:none

The server is a thin, type-safe translation layer between the MCP wire protocol and the Mythic Go SDK. Every tool validates inputs against a JSON Schema, calls the SDK, and returns structured results the AI can reason about.

Tool Categories at a Glance¶

Quick Start¶

# Build
go build -o mythic-mcp ./cmd/mythic-mcp

# Run (stdio mode for Claude Desktop)
MYTHIC_URL=https://mythic:7443 \
MYTHIC_API_TOKEN=your-token \
  ./mythic-mcp

# Run (HTTP/SSE mode for remote clients)
MCP_TRANSPORT=http MCP_HTTP_PORT=3333 \
MYTHIC_URL=https://mythic:7443 \
MYTHIC_API_TOKEN=your-token \
  ./mythic-mcp

See the Getting Started guide for full instructions.