Vulnerabilities
Test MCP agents for context-worm propagation
Black Hat Arsenal MCP context-worm testing: channel inventory by default, a gated kill chain on request.
overview
What mcparasite does
mcparasite tests whether an LLM agent will carry a malicious instruction across the Model Context Protocol boundary. A context worm plants an instruction in one place an agent reads, a repo file, a chat message, a tool result, and relies on the agent to copy it into the next place it writes. The tool models that behaviour as a set of propagation channels and attack scenarios you can enumerate before you exercise any of them.
Two modes decide what the node does. The default, mode=list, produces a booth-safe inventory of the channels and scenarios the framework supports and needs no credentials at all. Setting mode=run executes a kill chain against a real provider, so it requires an LLM API key on the vault ports; an ungated run is blocked rather than silently skipped.
The Trickest node writes findings.jsonl into a folder, which is what makes the inventory schedulable. The MCP Trust Boundary Suite runs it beside HoneyMCP and correlates both outputs, so a change in the channel surface shows up as a retest delta instead of a rerun you have to read by eye.
use cases
Where mcparasite fits
Inventory MCP propagation channels
Run the default list mode to record which channels and scenarios the framework covers, with no provider key and no live agent traffic.
Exercise a kill chain against your own agent
Set mode=run with a channel, a scenario, and a vault LLM key to see whether your agent copies a planted instruction from one surface into another.
Baseline an MCP surface before you widen it
Capture the inventory before adding a server or a tool, then diff the next run to see what the new integration reached.
Pair deception with active testing
Run it beside HoneyMCP in the MCP Trust Boundary Suite so ghost-tool detections and channel coverage land in one correlated report.
reference
mcparasite inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | --mode | list (default booth inventory) | run (kill-chain, needs LLM key) |
| channel | STRING | --channel | Propagation channel for mode=run (local, slack, github, ...) |
| scenario | STRING | --scenario | Attack scenario for mode=run (for example rce_chain) |
| provider | STRING | --provider | LLM provider name (openai, claude, ...) |
Showing key inputs. mcparasite exposes 6 inputs in total.
Full flag reference (6 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | --mode | list (default booth inventory) | run (kill-chain, needs LLM key) |
| channel | STRING | --channel | Propagation channel for mode=run (local, slack, github, ...) |
| provider | STRING | --provider | LLM provider name (openai, claude, ...) |
| scenario | STRING | --scenario | Attack scenario for mode=run (for example rce_chain) |
| openai-api-key | STRING | --openai-api-key | Vault secret BH_OPENAI_API_KEY (required for mode=run with openai) |
| anthropic-api-key | STRING | --anthropic-api-key | Vault secret BH_ANTHROPIC_API_KEY (required for mode=run with claude) |
example
Run mcparasite
# default: inventory channels and scenarios, no credentialsmcparasite --mode list # gated kill chain against your own agentmcparasite --mode run --channel github --scenario rce_chain --provider claude{ "tool": "mcparasite", "mode": "list", "channel": "github", "scenario": "rce_chain", "requires": ["llm_api_key"], "severity": "info", "note": "Channel available for mode=run; no agent traffic sent in list mode"}guidance
Choosing mcparasite
Reach for mcparasite when the question is whether an agent propagates instructions across MCP surfaces, not whether a server is reachable. Use HoneyMCP when you want the server side to detect and log exfiltration attempts, and use webagentaudit when the agent lives behind a web chat widget rather than an MCP client.
honeymcp
Deception middleware on the server side. It catches an agent reaching for a ghost tool; mcparasite is the side that tries to make the agent reach.
webagentaudit
Audits AI agents exposed through a web chat surface via browser automation. Different transport, same class of question.
nuclei
Template-driven checks across many classes. Useful next to an MCP host, but it has no model of agent-to-agent propagation.
workflows
Workflows using mcparasite
faq
mcparasite questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run mcparasite yourself
A mode and channel selection feeds mcparasite, which writes MCP channel and scenario findings for a correlate or report node.
Facts on this page come from the live Trickest tool library.