Get the FREE Ultimate OpenClaw Setup Guide →

MCPHammer

MCP security testing framework for evaluating Model Context Protocol server vulnerabilities

Installation
Run this command in your terminal to add the MCP server to Claude Code.
Run in terminal:
Command
claude mcp add praetorian-inc-mcphammer

How to use

MCPHammer is a Python-based MCP server that exposes a set of tools through the MCP protocol, with a web-based management UI and remote configuration capabilities. It integrates Claude AI via Anthropic’s API, supports text injection to augment tool responses, and includes server health, telemetry, and remote management features. Clients can call tools such as init (downloads and opens a file from a configurable URL), hello_world (returns a greeting with optional injected text), ask_claude (queries Claude models), get_server_info (returns server state), execute_file (runs a local file), and download_and_execute (downloads a file and optionally executes it). The server also provides HTTP endpoints for health, info, tool prompts, and management tasks, and can be managed remotely via a configuration management server.

To use MCPHammer, ensure you have a valid Anthropic API key for Claude integration and set up the required environment variables. Start the server with python MCPHammer.py, and connect a MCP client to the MCP HTTP endpoint (default http://localhost:3000/). You can adjust the server’s configuration at runtime via the management UI or remote config server, including the init URL, extra notes, and per-instance injection text. The available tools and endpoints let you monitor health, fetch server info, view and push injection updates, and perform remote management across multiple MCPHammer instances.

How to install

Prerequisites:

  • Python 3.10 or higher
  • pip (Python package manager)
  • An Anthropic API key for Claude integration
  1. Clone the repository
git clone https://github.com/praetorian-inc/MCPHammer
cd MCPHammer
  1. Create and activate a virtual environment (recommended)
python3 -m venv venv
# macOS/Linux
source venv/bin/activate
# Windows
venv\Scripts\activate
  1. Install dependencies
pip install -r requirements.txt
  1. Set up Anthropic API key (required for ask_claude tool)
  • Linux/macOS:
export ANTHROPIC_API_KEY="your-api-key-here"
  • Windows (Command Prompt):
set ANTHROPIC_API_KEY=your-api-key-here
  • Windows (PowerShell):
$env:ANTHROPIC_API_KEY = "your-api-key-here"
  1. Run the MCPHammer server
python MCPHammer.py

Optional: configure remote management and config sync as described in the README, using environment variables or command-line options.

Additional notes

Notes and tips:

  • Ensure ANTHROPIC_API_KEY is kept secret and not checked into version control.
  • The CONFIG_SYNC_URL (remote management) enables centralized injection text management across instances.
  • If you plan to run multiple MCPHammer instances behind a load balancer, set MCPHAMMER_PUBLIC_URL so remote push/update can reach each instance.
  • The init tool downloads and opens a file from a configurable URL; manage that URL via the web UI or API to control what gets downloaded.
  • For security, be mindful of executing downloaded files via execute_file or download_and_execute; scope and permissions should be tightly controlled.
  • Monitor health via the /health endpoint and inspect /info for current injection settings and server state.

Related MCP Servers

Sponsor this space

Reach thousands of developers