NeuralReaper (the-artist111/NeuralReaper) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 46 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
54/100

NeuralReaper

AI-native security research platform that integrates Claude with MCP to execute real offensive security tools in an isolated Docker container, enabling natural language-driven recon, CVE scanning, Active Directory enumeration, and cryptographic posture assessment.

→ the-artist111/NeuralReaper· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

the-artist111

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — ssl_check (line 205: echo_proc = subprocess.Popen(["echo", ""], stdout=subprocess.PIPE))
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes46 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

nmap_scan

Run a full nmap scan with service and script detection.

nmap_quick

Run a fast nmap top-1000 port scan.

nmap_vuln

Run nmap with the built-in vuln script category to detect known CVEs.

masscan_scan

Run masscan for ultra-fast port discovery across all 65535 ports.

ping_check

Ping a host to check reachability.

traceroute_run

Map network hops to a target with traceroute.

dns_recon

Enumerate DNS records (A, AAAA, MX, NS, TXT) for a domain.

whois_lookup

WHOIS lookup on a domain or IP.

nikto_scan

Run Nikto web vulnerability scanner against a host or URL.

curl_probe

Probe a URL with curl to inspect HTTP headers and redirects.

ssl_check

Inspect SSL/TLS certificate details for a host.

gobuster_dir

Run gobuster directory brute-force against a URL.

gobuster_dns

Run gobuster DNS subdomain enumeration against a domain.

ffuf_fuzz

Run ffuf web fuzzer — use FUZZ keyword in URL e.g. http://target/FUZZ.

dirb_scan

Run dirb directory brute-force against a URL.

nuclei_update

Update Nuclei templates to the latest version — run this first to get newest CVEs.

nuclei_scan

Run Nuclei CVE/vulnerability scan — auto-detects known CVEs from 12000+ templates.

nuclei_cve

Run Nuclei targeting a specific CVE ID e.g. CVE-2026-41089.

nuclei_tech

Fingerprint technologies, frameworks, and services running on a target.

nuclei_misconfig

Scan for common misconfigurations — exposed panels, default creds, weak configs.

nuclei_wordlist_scan

Run Nuclei with custom tags e.g. 'xss,sqli,lfi,rce,ssrf,wordpress'.

cve_watchlist_scan

Check a target against a curated watchlist of recent high-severity CVEs via Nuclei and ExploitDB.

cve_watchlist_show

Display the current curated CVE watchlist used by cve_watchlist_scan.

xsstrike_scan

Run XSStrike XSS scanner — detects reflected, DOM, and stored XSS with WAF evasion.

sqlmap_scan

Run sqlmap SQL injection scanner against a URL.

wpscan_scan

Run WPScan WordPress vulnerability scanner.

searchsploit_query

Search ExploitDB for public exploits matching a product name or CVE.

crypto_inventory

Enumerate TLS versions, cipher suites, and key-exchange groups supported by a host.

ssh_crypto_check

Enumerate SSH key exchange, host key, and cipher algorithms supported by a host.

pqc_readiness_check

Assess Harvest-Now-Decrypt-Later exposure by classifying a host's TLS crypto as PQ-ready or quantum-vulnerable.

certipy_find

Enumerate AD CS certificate templates and flag ESC1-ESC16 misconfigurations via Certipy.

bloodhound_collect

Collect AD enumeration data (users, groups, trusts, sessions) for offline analysis in BloodHound.

bloodyad_enum

Run a bloodyAD enumeration query (e.g. 'get writable', 'get object <name>') against AD over LDAP.

kerberoast_check

Enumerate kerberoastable accounts (SPN-set users) via Impacket's GetUserSPNs.

asreproast_check

Enumerate AS-REP roastable accounts (no Kerberos pre-auth required) via Impacket's GetNPUsers.

rootkit_check

Run chkrootkit and rkhunter against the host this command executes on (see docstring note on scope).

host_hardening_audit

Run a Lynis security/hardening audit against the host this command executes on.

ransomware_exposure_check

Check external exposure of services most commonly abused for ransomware initial access (RDP, SMB, VPN).

dependency_audit

Scan a directory or manifest file for known-vulnerable dependencies via OSV-Scanner (mount your project to /scan).

fuzz_binary

Run AFL++ against a local AFL-instrumented binary for a bounded duration and report crashes found.

owasp_web_top10

Show the OWASP Top 10 web risk categories mapped to which NeuralReaper tools cover each one.

owasp_agentic_top10

Show the OWASP Top 10 for Agentic Applications — a reference checklist for assessing AI agent/MCP attack surface.

full_recon

Orchestrate DNS/WHOIS/port/tech recon into one attack-surface summary with vuln-class priorities by detected tech.

generate_report

Compile every tool call run this session into a single formatted engagement report with a severity summary.

clear_session_log

Clear the in-memory session log used by generate_report, starting a fresh engagement.

tool_help

List all available NeuralReaper tools and their descriptions.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configMAX_TOOL_RUNTIMEHard timeouts. Every tool call is bounded (, default 180s) so a hung scan can't hang the MCP session indefinitely.
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

46/46 tools missing one or more hints — nmap_scan (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); nmap_quick (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); nmap_vuln (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +43 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — ssl_check (line 205: echo_proc = subprocess.Popen(["echo", ""], stdout=subprocess.PIPE))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

38/46 tool handlers declare input schemas (83%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

36/46 tool handlers wrap calls in try/catch (78%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/the-artist111/neuralreaper?variant=verified)](https://m8ven.ai/mcp/the-artist111/neuralreaper)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 8afe00178d9d203c5c4a4728356c54143c0dd1a8
code hash: 3799105de154344fb97327a728c7b0ee4f45fb707e7124052c8e65c807eecd89
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client