Sn1per MCP Server - Drive Sn1per From Your AI Assistant

Drive your self-hosted Sn1per from your AI assistant: scoped, audited, for authorized testing.

Status: beta. This page is an overview. The canonical documentation, including install commands, the configuration reference and the tool reference, lives in the Sn1per MCP Server repository on GitHub, so it always matches the release you install.

For authorized security testing only. Use the Sn1per MCP Server only against systems you own or are explicitly permitted, in writing, to test, and within the scope of that permission.

Overview

Sn1per does the scanning. The Sn1per MCP Server lets the AI assistant you already use drive it.

Sn1per MCP Server connects the AI assistant you already use to the Sn1per installation on your own Linux host. It runs locally over stdio beside Sn1per, refuses scan requests for targets outside the scope you configure (see the limits), records every scan, cancel, delete and export request it acts on in a local audit log, and returns Sn1per’s findings, open ports, subdomains and technologies as structured data with secrets redacted by default. It supports Sn1per Community Edition 9.x and the 11.x engine used by SE, Professional and Enterprise; the edition matrix lists what has been verified. It is free and open source under the Apache-2.0 license, and is intended for authorized security testing only.

The server runs beside Sn1per on your host: loot stays there, and tool results leave the host only through your MCP client and the model service it uses. Read Data handling and privacy for what does leave the host.

What it is not

Not a scanner by itself. It launches and reads the Sn1per installation that is already on your host.
Not a copy of Sn1per. It does not include Sn1per. Install Sn1per Community Edition, or Sn1per Professional or Sn1per Enterprise from your license, first.
Not for shared multi-user hosts. Run it on a dedicated, single-user scanning VM or container.

Authorized use

The Sn1per MCP Server lets an AI agent launch active security scans. Scans send traffic to the target, can be intrusive, and run with root privileges through sudo.

Use it only against systems you own or are explicitly authorized, in writing, to test, and only within the scope and rules of engagement of that authorization. Unauthorized scanning is illegal in many jurisdictions.
You, the operator, are responsible for every action your agent takes, including actions triggered by content the agent reads (for example prompt injection in a web page or in scan output).
Configure the target scope before you use the scan tools. With no scope, every scan request is refused unless the lab override is set (see the limits).
Brute-force and exploitation modes and destructive tools are off by default. Turn intrusive modes on only when your rules of engagement allow credential brute force and exploitation.
The server records every scan, cancel, delete and export request it acts on in a local audit log. Keep that log with your engagement evidence.
Sn1per Community Edition is governed by its own EULA, which also prohibits scanning without permission.

Requirements

Requirement	Details
Scanning host	Linux, with Sn1per Community Edition 9.x or the 11.x engine (Sn1per SE, Sn1per Professional or Sn1per Enterprise) installed. macOS and Windows can be the client host, not the server host.
Python	Python 3.11 or later. The install guide lists the supported versions; some older distributions need a uv-managed Python.
Privileges	Root, or a passwordless sudo rule for the Sn1per CLI. That rule is equivalent to full root access for the user it names; read the security model before you add it.
MCP client	An MCP client that runs local stdio servers. Web, mobile and remote-connector clients are not supported in the beta (stdio only).

Install and set up

Install commands are pinned to an exact release, so they live in the repository and change with every release. Follow these guides:

Install guide: install the package, set up privileges, upgrade, roll back and uninstall.
Client setup: the MCP clients that passed testing, their configuration, and the recommended approval settings.
Configuration reference: the target scope, intrusive modes, destructive tools and redaction.
Remote use: a client on macOS, Windows or another Linux host, Sn1per on a separate scanning host, and container setups.
Troubleshooting: common problems and error codes.

In outline, setup has six steps:

Install the server as the user who runs your MCP client (never with sudo).
Create an env file, readable only by that user, that lists the targets you are authorized to test (hardened setups use a root-owned file; see the security model).
Run the server’s configuration check. It prints the path of the Sn1per CLI that the sudo rule must name.
Add the sudoers drop-in for that path (not needed when the client runs as root).
Register the server with your MCP client.
Start a new client session and ask: “Run sniper_status”.

Editions

The server detects the edition and engine from the Sn1per CLI on the host. It supports Sn1per Community Edition 9.x and the 11.x engine used by SE, Professional and Enterprise; the edition matrix lists what has been verified. The authoritative, dated matrix, the mode tables and the per-edition notes are in docs/editions.md.

Edition	Engine dialect	Status
Sn1per Community Edition 9.2 (repository `master` at `a5450bc`)	9.x	verified 2026-10-12, with the server running as root
Later Sn1per Community Edition 9.x releases	9.x	expected
Sn1per SE 11.0 and 11.1	11.x	verified 2026-10-12 (11.0 as root and as a normal user through sudo, 11.1 as root)
Sn1per Enterprise, 11.3 development build	11.x	verified 2026-10-12, as a normal user through sudo
Other 11.x releases, including 11.2	11.x	expected
Sn1per Professional 2026	11.x	uses the same 11.x engine as SE and Enterprise; not yet run on a Professional install
Sn1per Community Edition below 9.2	–	not supported

Matrix as of 2026-10-12. “Verified” means exercised by the verification run on that date; “expected” means no known blocker, but not exercised. The repository’s matrix also lists the per-tool exceptions and the fixes made after the run. If this table and the repository disagree, the repository is correct.

Sn1per Enterprise users: the Configuration Editor’s MCP Servers tab configures MCP servers that Sn1per itself uses. It is not the Sn1per MCP Server, which lets your AI assistant use Sn1per.

Tools

Tool names are stable identifiers. Parameters, example results and error codes are in the tool reference.

Group	Tools	Default
Status and results (read-only)	`sniper_status`, `list_workspaces`, `scan_status`, `get_findings`, `get_ports`, `get_subdomains`, `get_technologies`, `grep_loot`	Always available
Scans (change state; `sniper_scan` sends traffic to the target)	`sniper_scan`, `cancel_scan`	Always registered; every scan request is refused until you configure a scope, unless the lab override is set
Destructive (change state)	`delete_workspace`, `export_workspace`	Off by default. Available only after an explicit opt-in, and only in MCP clients that support elicitation: the server asks you to type the workspace name to confirm. Some agent clients can answer that prompt themselves; see the security model.

Security model

The server is a set of controls around a root-capable engine, not a security boundary. Read the full security model before you deploy it. In short:

Root-equivalent privilege. The passwordless sudo rule for the Sn1per CLI is equivalent to full root access for that user.
Scope covers the requested target at launch time. Sn1per resolves names again during the scan, may contact third-party services, and some modes scan hosts they discover. Use an egress filter on the scanning host.
Not a boundary against an agent with shell access. These controls do not stop an agent that also has shell or file-write access as the same user. Keep the scope and env files in a root-owned location and deny those tools for them.
Confirmation prompts. The destructive tools ask you to type the workspace name before they act, but some agent clients can answer that prompt themselves instead of asking you. The explicit opt-in is the primary control; the prompt is the second.
Untrusted results. Everything read from loot, logs and searches is returned as untrusted data, because scanned systems control it.
Audit log. The audit log is hash-chained per session, which makes edits detectable, but the same user can rewrite or delete it. The security model shows how to make it append-only where that matters.
Redaction. The server redacts secrets in results by default. Redaction is pattern-based; it is not data-loss prevention, and job logs and exports on disk are not redacted.
Dedicated host. Sn1per Community Edition makes its install tree world-writable on every scan, so use a dedicated single-user VM or container.

Data handling and privacy

The MCP server itself sends no telemetry. Its only network activity is the DNS lookups it makes to check hostname targets against your scope.
Sn1per runs its own update and license checks every time a scan starts, including scans launched through the MCP server. Sn1per Community Edition sends the host machine-id. Sn1per SE, Professional and Enterprise send the license key, the machine-id and usage statistics, and run the update server’s response as root; Professional license checks can stop every running scan or remove the install. The MCP server never suppresses these checks.
Scans send traffic to the target and, depending on the mode, to third-party services such as OSINT APIs, web archives, certificate and DNS datasets and whois.
Tool results, which may include personal data such as harvested e-mail addresses, are returned to your MCP client and from there to the model service it uses. Some clients route model traffic through the client vendor’s own backend, and transcripts may be stored or synced in the vendor’s cloud. Make sure your engagement contract and data-protection obligations allow this, or use a locally hosted model.

The full text is in the data handling and privacy section of the README.

Support and security reports

Questions and bug reports: SUPPORT.md in the repository.
Vulnerabilities: report them privately as described in SECURITY.md. Do not open a public issue for a vulnerability.
Sn1per Professional and Sn1per Enterprise customers can also email [email protected].

Frequently asked questions

What is the Sn1per MCP Server?

A Model Context Protocol (MCP) server for Sn1per. It runs as a local stdio server beside your self-hosted Sn1per and lets the AI assistant you already use launch Sn1per scans of targets in the scope you configure, for authorized security testing, and read the results as structured data. It is in beta.

How is it different from a generic MCP server that runs security tools?

Generic tool-runner MCP servers expose individual commands. The Sn1per MCP Server drives Sn1per’s orchestrated scan modes and returns its structured results, with scope enforcement and an audit log.

Is it free, and which Sn1per editions does it work with?

The Sn1per MCP Server is free for every edition and open source under the Apache-2.0 license. It supports Sn1per Community Edition 9.x and the 11.x engine used by SE, Professional and Enterprise; the edition matrix lists what has been verified. The Apache-2.0 license covers the MCP server only: Sn1per Community Edition is source-available under its own EULA, and Sn1per Professional and Sn1per Enterprise are licensed separately.

Which AI assistants can use it?

MCP clients that run local stdio servers. Tested so far: Claude Code, and Codex CLI in its non-interactive codex exec mode. The clients that passed testing, with their configuration and approval settings, are listed in docs/clients.md. Web, mobile and remote-connector clients (for example claude.ai or ChatGPT connectors) are not supported in the beta (stdio only). If your client runs on macOS or Windows and Sn1per runs on a Linux host, use the SSH setup in docs/remote.md.

Can the AI assistant scan any target it wants?

Not by default. With no target scope configured, every scan request is refused unless the lab override is set. The server refuses scan requests for targets outside the scope you configure (see the limits: the lab override, follow-up traffic from the engine, and agents that also have shell access). Brute-force and exploitation modes and destructive tools are off by default. Configure your MCP client to ask for your approval before every scan, cancel, delete and export.

Does my scan data leave my host?

Loot stays on your host. Tool results leave the host only through your MCP client and the model service it uses, and the engine’s own update checks and scan traffic leave the host as described in Data handling and privacy.

Does the MCP server send telemetry?

The MCP server itself sends no telemetry. Sn1per’s own update and license checks still run on every scan, including scans launched through the MCP server; see Data handling and privacy for what each edition sends.

Is this the MCP Servers tab in Sn1per Enterprise?

No. The Configuration Editor’s MCP Servers tab configures MCP servers that Sn1per itself uses. The Sn1per MCP Server works the other way round: it lets your AI assistant use Sn1per.

What does beta mean for the Sn1per MCP Server?

The server is under active development and has not reached a 1.x release. Tool names, parameters and output fields follow a published compatibility promise for beta releases: patch releases never rename or remove anything, a tool or setting renamed or removed in a minor release keeps a deprecation alias for at least one minor release, and changes that refuse something previously accepted are announced in the changelog’s upgrade notes. Install commands pin an exact version, so watch the repository’s releases and security advisories to hear about fixes.