Loading ToolBench
MCP server for interacting with Mythic command and control framework. Provides tools for managing callbacks, issuing tasks, querying MITRE ATT&CK techniques, managing payloads, C2 profiles, and other Mythic operations.
40 tools with consistent naming (verb_noun pattern) and descriptions present. However, input schemas are largely absent from visible code, tools registered via mcp.AddTool() show Name and Description only, with no explicit InputSchema field. Parameter types and descriptions exist in Go struct tags (jsonschema annotations) but are not visible in the registration calls shown. This creates a critical gap: the MCP protocol requires explicit JSON Schema in tool definitions, and without seeing the schema marshaling, we cannot verify schemas are properly exposed to clients. Descriptions are adequate (50 - 200 chars typical) but lack actionable context (e.g., 'when to use', 'prerequisites', 'what it returns'). Error handling is delegated to translateError() but recovery guidance is not visible. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite many tools being read-only or destructive.
Add a P2P connection between two callbacks in the callback graph
Get indicators of compromise (IOCs) generated by a C2 profile
Host a file on a C2 profile for agent download. Requires the C2 profile ID (from mythic_get_c2_profiles), the file UUID, and the URL path where the file will be served.
Get a sample C2 message for a specific message type
Create a new API token for programmatic access
Create a named C2 profile configuration instance. Note: most users do NOT need this — C2 profiles are already installed and just need to be STARTED with mythic_start_c2_profile. Only use this to create additional named configurations of an existing profile.
Input schemas not visible in tool registration. Tools registered via mcp.AddTool() show Name and Description only; no explicit InputSchema field is present in the visible code. Parameter types exist in Go struct tags but are not verified to be marshaled into the MCP protocol response.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications. 27 tools are READ_ONLY, 8 are WRITE, 5 are DESTRUCTIVE, these should be annotated in the MCP schema to guide agent behavior.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Delete an existing API token
Delete one or more callbacks from Mythic. Admin users perform a hard delete (removes callbacks and tasks from the database). Non-admin users perform a soft delete (sets active=false, dead=true), since hard deletion requires the mythic_admin role.
Export a callback's configuration as JSON. IMPORTANT: The agent_callback_id parameter requires the callback's UUID string (e.g. 'eebbb756-3e16-42b4-88d8-1a01f3e5e320'), NOT the display_id number. Use mythic_get_callbacks to find the agent_callback_id (UUID) for a callback.
Get a list of all active callbacks
Get a list of all callbacks (active agent connections) in Mythic
Get MITRE ATT&CK techniques associated with a specific command
Get MITRE ATT&CK techniques associated with a specific task
Get details of a specific MITRE ATT&CK technique by internal ID
Get details of a specific MITRE ATT&CK technique by T-number (e.g., T1055)
Get a list of all MITRE ATT&CK techniques available in Mythic
Get all MITRE ATT&CK techniques used in an operation
Get details of a specific C2 profile by ID, including its current configuration parameter values (callback_host, callback_port, etc.) and whether it is currently running.
Get the stdout/stderr output from a C2 profile instance
List all installed C2 communication profiles (e.g. http, httpx, smb, tcp). Each profile acts as a listener/handler for agent callbacks. IMPORTANT: A C2 profile must be STARTED (running=true) before payloads using it can callback. Not all agents support all C2 profiles — check the 'supported_agents' field. Typical workflow: 1) list profiles, 2) start the profile, 3) get profile parameters, 4) create payload with those parameters.
Get details of a specific callback by its display_id (the number shown in the Mythic UI)
Get list of tokens associated with a callback
Get a list of all command parameters across all commands
Get details of a specific command including its parameters and helper methods
Get a list of all commands available in Mythic
Get information about the current authenticated user
Get all commands loaded in a callback, including both the agent's built-in commands and any dynamically loaded commands (e.g. forge script_only commands). Each command includes its payload_type_name (which agent it belongs to) and script_only flag (whether it runs server-side or on the agent). Use mythic_get_payload_type_commands to see all commands for a payload type without needing a callback.
Retrieve multiple tasks by their display IDs in a single call. Efficient alternative to calling mythic_get_task repeatedly. Tasks that don't exist are silently omitted from the results.
Import a C2 profile instance from configuration JSON
Import a callback configuration from JSON
Check if currently authenticated with Mythic server
Issue the same command to multiple callbacks in parallel. Useful for running enumeration commands (ps, ifconfig, ls) across many agents simultaneously. Returns results for each callback including successes and failures. Maximum 50 callbacks per call.
Authenticate with Mythic server using username and password
End the current Mythic session and clear authentication
Refresh the current access token to extend session
Remove a P2P connection between callbacks
Search for tasks across all callbacks with flexible filters. Filter by command name, status, callback, or any combination. Useful for reviewing operations, finding specific command executions, or checking completion status of multiple tasks.
Start a C2 profile, which begins listening for agent callbacks. This is REQUIRED before deploying any payload — without a running C2 profile, agents cannot call back. Use mythic_get_c2_profiles first to find the profile ID and check if it is already running.
Stop a running C2 profile listener. WARNING: This will prevent any agents using this profile from calling back.
Update a callback's properties (description, active status, etc.)
Descriptions lack actionable context. Most descriptions state WHAT the tool does but omit WHEN to use it, prerequisites, or what it returns. E.g., 'Get a list of all MITRE ATT&CK techniques' does not explain when to call this vs. mythic_get_attack_by_task.
Parameter descriptions are minimal or missing context. E.g., 'callback_id' is described as 'Callback display_id (the number shown in the Mythic UI, not the internal database id)', good, but many params lack this level of clarity. No enum constraints visible for status, command, or profile_type parameters.
Error handling and recovery guidance not visible. translateError() is called but its implementation is not shown. No evidence of actionable error messages (e.g., 'User not found. Try search_users() first') or error classification (retryable vs. fatal).