capabilities

Connect to BloodHound CE and Neo4j. Overrides env var defaults for this session.

Execute an arbitrary Cypher query against the BloodHound Neo4j database.

Run a named standard query from the built-in catalog.

List available standard queries with descriptions. Optionally filter by category.

Check connection status and return aggregate counts of clients, projects, and findings.

List client organizations.

Get full details for a single client including associated projects.

List projects/engagements.

Get full project details with associated findings, reports, and oplogs.

List reported findings across engagements.

Get full finding details including CVSS, remediation, and evidence.

List the finding template library.

List project objectives and their sub-tasks.

List target hosts and systems.

List scope definitions (IP ranges, domains, etc.).

List deconfliction entries.

List evidence files.

List white cards / exceptions.

List observations/notes from reports.

List reports.

Get a summary of team servers and domains (combined view).

List team servers with checkout details.

List registered domains with checkout details.

List operation activity logs (oplog entries).

List notes for a given entity type (client, project, domain, or server).

Search across clients, projects, findings, observations, and activity logs concurrently.

List Mythic callbacks (agents).

Get full details for a single callback including payload and C2 profiles.

List executed commands (tasks), most recent first.

Get decoded task output with optional line paging. Returns None if the task has no output.

List discovered credentials.

List downloaded/uploaded files.

Download a file to /tmp/mythic-readonly/ and return a preview plus the saved path.

List IOCs/artifacts generated by tasks.

List keylog captures.

List screenshot metadata (use get_file_contents with agent_file_id to fetch image bytes).

List captured process listings.

Browse captured file system data from agents.

List Windows token captures.

Set the active implant for subsequent commands (ls, execute, upload, etc.).

List all active Sliver sessions (interactive real-time connections).

List all active Sliver beacons (async callback implants).

List all active jobs (listeners) on the Sliver server.

Start a mutual TLS (mTLS) C2 listener on the Sliver server.

Start an HTTPS C2 listener on the Sliver server.

Start an HTTP C2 listener on the Sliver server.

Start a DNS C2 listener on the Sliver server.

Kill an active listener job.

Terminate a Sliver session.

Terminate a Sliver beacon.

List all stored implant builds on the Sliver server.

Regenerate a previously compiled implant by name. Returns the implant binary which can then be deployed to a target.

Execute a program on the target system.

List files and directories on the target system.

Change the implant's working directory.

Print the implant's current working directory.

Create a directory on the target system.

Remove a file or directory on the target system.

Upload a local file to the target system.

Download a file from the target and save it locally.

Download a file from the target and save it to a local temporary file. Returns name and path.

List running processes on the target.

Kill a process by PID on the target system.

List network interfaces on the target.

Show active network connections on the target.

Capture a screenshot of the target's display.

Execute a .NET assembly in-memory on the target (execute-assembly).

Inject and execute raw shellcode on the target.

Load a shared library into a sacrificial process and call an export on the target.

Get environment variables from the target system.

Get the current user context on the target system.

Impersonate a user on the target (Windows only).

Create a Windows logon token with the specified credentials.

Revert any active impersonation back to the original user context.

Run a process as a different user on the target.

Attempt to elevate to SYSTEM privileges on the target (Windows only).

Dump the memory of a process on the target (e.g. for LSASS credential extraction).

Read a value from the Windows registry on the target.

Write a value to the Windows registry on the target.

Report which extra Ghidra features load in this PyGhidra runtime.

Compute Ghidra FunctionID (FID) hashes for a function.

Decompiler dataflow summary for a function (HighFunction / P-code).

Concretely execute a function under Ghidra's emulator (Tier-3 repro).

Diff two project binaries at function granularity (#5 patch / variant diff).

Side-by-side decompilation of one matched function pair from diff_binaries.

Build or extend a local BSim signature database from project binaries (#3 fuzzy).

Query one function against a BSim database for similar functions (Tier-1 fuzzy ID, #3).

Best BSim match for every function in a binary — the annotation-queue denoiser (#3).

Probe whether the underlying CLIs and scripts this MCP relies on are reachable on this host.

Run a parallel, resumable first-pass inventory over an APK corpus.

Emit one JSONL row per (apk, component) by streaming every `androguard.json` under the inventory directory, falling back to `aapt2 dump xmltree` for APKs where Androguard errored.

Apply risk priors to each component row and emit a ranked inbox.

Classify an APK's runtime in one second using `unzip -l` only.

Detect commercial Android protectors (DexProtector, Promon Shield) and recommend a triage strategy.

Static-unpack DexProtector's libdp.so without an Android device.

Regex-extract API endpoints, generated clients, request-signing hints, feature flags, object IDs, and workflow verbs from decompiled APK sources.

Sort backend_richness summaries by score and emit an operator inbox.

Normalize, deduplicate, and render Android semantic finding hypotheses.

Check BBOT and Neo4j connectivity.

Execute a BBOT reconnaissance scan.