Mcp Ethical Hacking

io.github.cmpxchg16Published by GitHub account cmpxchg16v1.4.0Updated Oct 24, 2026

An MCP server that provides LinkedIn & Reddit data

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that extracts and analyzes Reddit discussions and LinkedIn profile content, presented as an educational demo of MCP security risks.

What you can do
  • Extract Reddit discussions, comments and metadata
  • Analyze LinkedIn profiles for content strategy insights
  • Run as a local stdio server (the README also mentions an SSE transport)
  • Serve as a demonstration of how MCP tools can hide code execution and data access
When to use it
Worth adding only if you want to study how MCP tools can conceal code execution, obfuscation and broad data access, or need a sample social-media content extraction tool in an isolated lab setting.
Requirements
Runs as a local process on the user's machine (desktop only, stdio transport, distributed as an mcpb package). No authentication, environment variables or headers are declared. Network access to Reddit and LinkedIn is implied by the extraction tools.
Before you install
The README states the project is educational and deliberately demonstrates hidden code execution (embedded code in images, WebAssembly modules, remote data processing), network requests to third parties and file system access. It advises reviewing the source, sandboxing, least privilege and monitoring. Scraping social platforms may violate their terms of service and requires authorization.

Installation

In SourceWeft

  1. Open Mcp Ethical Hacking in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCP Ethical Hacking

[AI "Legitimate" image]

📚 Educational Purpose

This repository is intended for educational purposes to demonstrate the potential security risks in MCP implementations, and how to recognize and prevent security issues.

This repository contains "legitimate" tools for analyzing content from social media platforms using the Model Context Protocol (MCP). It demonstrates both the capabilities and potential security implications of MCP tools.

These tools are provided for educational purposes only to demonstrate both the legitimate use cases and security considerations when developing and using MCP tools.

🛑 Disclaimer

This code is provided for educational purposes only. The authors do not endorse using these techniques for any malicious purposes. Always obtain proper authorization before analyzing content from any platform and respect their terms of service.

🔍 The "legitimate" use-cases

MCP Toolkit: Social Media Content Analysis

The MCP Toolkit provides utilities for extracting and analyzing content from:

  • Reddit: Extract discussions, comments, and metadata
  • LinkedIn: Profile analysis and content strategy insights

📋 Components

The toolkit includes:

  • Reddit Content Extractor: Extract and analyze discussions and comments
  • LinkedIn Profile Analyzer: Content strategy analysis for LinkedIn profiles
  • MCP Server Implementation: Both stdio and SSE transport methods

⚙️ Installation

See Reddit Readme :: Using embedded code in a remote image
See Linkedin Readme :: Using WebAssembly module embedded in a local image

⚠️ Security Considerations

This toolkit demonstrates several important security aspects of MCP tools:

  1. Code Execution && Obfuscation Techniques: The repository shows how MCP tools can execute code in unexpected ways, including:

    • Embedded code in images (steganography)
    • WebAssembly module execution
    • Remote data processing

  2. Data Access: Tools can access and process data beyond what might be expected:

    • Network requests to third-party services
    • File system access

🔒 Best Practices

When developing or using MCP tools:

  1. Review Code: Always review the source code of MCP tools before use (run static code analyzers as well)
  2. Sandbox Execution: Run MCP tools in isolated environments
  3. Limit Permissions: Use principle of least privilege
  4. Monitor Activity: Enable logging and monitor network/file system access
  5. Authenticate Sources: Only use tools from trusted sources

📄 License

This project is licensed under the MIT License.

👨‍💻 Author

Uri Shamay [email protected]

Source: README.md at commit 162eb76

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.4.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.