----------------
🛠️ Tool
===================
A security researcher detailed an autonomous vulnerability hunting system built around Claude Code and the Model Context Protocol (MCP). The motivation stems from the overhead of context switching and tool wrangling during manual vulnerability research.
Architecture Overview
The system wraps standard research tools as callable MCP servers, allowing Claude Code to execute terminal commands with typed inputs and outputs natively. The setup consists of 8 distinct MCP servers distributed across 5 VMs, exposing over 300 tools.
Server Breakdown
• Lab Controller: Manages SSH/WinRM sessions and Proxmox VMs. Handles basic reverse engineering.
• Hunter: Dedicated to patch diffing, attack surface enumeration, fuzzing across 10 domains, and crash triage.
• RE Tools: Integrates Ghidra, radare2, and Frida for static and dynamic analysis.
• Exploit Dev: Automates shellcode generation, heap sprays, CFG bypasses, and PoC assembly.
• Debugger: Maintains persistent WinDbg/GDB sessions that survive across tool calls.
• RAG: Provides semantic search over campaign data and prior research.
• Infra: Provisions and scales fuzzing VMs on Proxmox.
• Reporting: Automates disclosure reports and CVE requests.
Technical Implementation
All 8 servers run as separate Python processes registered in a single .mcp.json file. When Claude needs to interact with a Windows target, it calls tool_surface_kernel_drivers. For decompilation, it uses tool_re_ghidra_decompile. This structured approach eliminates the need to copy-paste terminal output or switch contexts manually.
Analysis
By delegating tool execution to the AI, the researcher maintains focus on critical thinking and disclosure writing. While automated fuzzing is not new, integrating it directly with an LLM via MCP provides a structured pipeline from initial mapping to CVE submission.
🔹 mcp
#vulnerability_hunting #claude_code #fuzzing #tool
🔗 Source:
https://blog.zsec.uk/bullyingllms/
窓の杜
