Give your AI agent Red Team superpowers
24 tools · 6 databases · 1,234 techniques.
LOLBAS · GTFOBins · WADComs · LOLDrivers — one MCP server.
Try it now
Try all 24 tools now
No API key required. Add CodeRed to your MCP client and start exploring instantly.
Rate limited: 5 requests/second globally. Perfect for exploring all capabilities.
Try Playground →{
"servers": {
"codered": {
"type": "http",
"url": "https://codered.hackfluency.com/mcp"
}
}
}Browser-based playground with all tools. For production, get a personal API key.
Intelligence Engine Upgrade
Smarter scoring, context-aware kill chains, and actionable evasion guidance.
- Normalized 0–100 risk scoring across all databases
- New strict_mode for EDR/SIEM-active environments
- Automatic low-risk alternative suggestions when score is high
- Detection-specific evasion hints in every result
- Auto-detects AD, cloud, web, and OT context from your objective
- Command previews with placeholder variables in every phase
- Linux engagements now include linPEAS recon modules
- Web engagements pull in relevant payload categories automatically
- Chain-level stealth score and confidence metrics
24 tools · 8 categories
Complete Red Team arsenal
Every database, every technique, every platform — unified under a single MCP interface your AI agent can call directly.
- lolbas_search
- lolbas_get_binary
- lolbas_list_categories
- lolbas_build_payload
- gtfobins_search
- gtfobins_get_binary
- gtfobins_build_payload
- wadcoms_search
- wadcoms_get_command
- loldrivers_search
- loldrivers_get_driver
- search_by_mitre
- search_by_capability
- cross_reference
- detection_context
- generate_payload_template
- attack_chain
- evasion_score
- op_new
- op_log
- op_status
- op_list
- pat_search
- peass_modules
Why CodeRed
Built for real engagements
Not a toy. Purpose-built for red teamers who need accurate, actionable intelligence on demand.
Attack Chain Builder
attack_chainDescribe an objective in plain English. CodeRed builds a complete multi-phase kill chain with stealth scores, MITRE mappings, and ready-to-use payloads.
Detection Context
detection_contextEvery technique comes with Sigma rules, Elastic queries, and Splunk SPL. Know exactly what your SOC will see before you execute.
Operation Tracking
op_logPersistent SQLite-backed op log. Create operations, log executions, track timelines — then retrieve the full audit trail anytime.
Cross-DB Intelligence
search_by_mitreSearch by MITRE ATT&CK ID or capability keyword and get matching techniques from all 6 databases simultaneously.
API-Key Auth
authProduction-grade Unkey.dev middleware. Every request is authenticated, rate-limited, and audited — no infrastructure overhead.
MCP-Native
mcpWorks out-of-the-box with Claude, GPT-4o, Cursor, Windsurf — any MCP-compatible client. No custom plugins needed.
…typical of mature red teams or elite consultancies like Mandiant.
Get started in 60 seconds
Ready to arm your AI agent?
Drop CodeRed into any MCP-compatible client. Add your key and start querying 1,234 Red Team techniques instantly.
{"servers":{"codered":{"type":"http","url":"https://codered.hackfluency.com/mcp","headers":{"Authorization":"Bearer <your-bearer-token>"}}}}