# Wifi Security Mcp Server > Full-spectrum wireless security MCP server — WiFi, Bluetooth, RF/SDR, NFC/RFID, Cellular/5G, IoT, MouseJack, air-gap, UWB, WIDS/WIPS, compliance. 34 tools, 9 knowledge bases. - **Type:** MCP server - **Install:** `agentstack add mcp-badchars-wifi-security-mcp-server` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [badchars](https://agentstack.voostack.com/s/badchars) - **Installs:** 0 - **Category:** [Integrations](https://agentstack.voostack.com/c/integrations) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [badchars](https://github.com/badchars) - **Source:** https://github.com/badchars/wifi-security-mcp-server - **Website:** https://www.npmjs.com/package/wifi-security-mcp-server ## Install ```sh agentstack add mcp-badchars-wifi-security-mcp-server ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी Wireless security intelligence for AI agents. WiFi (WPA/WPA2/WPA3), Bluetooth (BR/EDR, BLE), RF/SDR, NFC/RFID, Cellular/5G, IoT (Zigbee, Z-Wave, MQTT, LoRaWAN), MouseJack, Air-Gap, UWB, WiFi CSI, Miracast, WiFi Direct, Drone RF, WIDS/WIPS, Compliance — unified into a single MCP server. Your AI agent gets full-spectrum wireless security analysis on demand, powered by 9 built-in knowledge bases covering 139 individual tools. The Problem • How It's Different • Quick Start • What The AI Can Do • Tools (34) • Knowledge Bases • Architecture • Changelog • Contributing --- ## The Problem Wireless security assessment is one of the most fragmented disciplines in offensive security. WiFi auditing requires one set of tools, Bluetooth another, RF/SDR a third, IoT protocols yet another — and each domain has its own attack surface, its own vulnerabilities, its own compliance requirements. Today you run aircrack-ng for WPA, use Bettercap for BLE, fire up HackRF for SDR, consult different CVE databases for each chipset, reference NIST and PCI-DSS separately, and then spend hours manually correlating findings into a coherent assessment. ``` Traditional wireless security workflow: audit WiFi networks -> aircrack-ng / Wireshark / Kismet test Bluetooth security -> Bettercap / btlejack / Ubertooth analyze RF signals -> HackRF / GNU Radio / GQRX check NFC/RFID -> Proxmark3 / libnfc assess cellular security -> srsRAN / OpenBTS test IoT protocols -> Zigbee sniffer / Z-Wave tools / MQTT clients look up wireless CVEs -> NVD / vendor advisories (manual search) check compliance -> NIST / PCI-DSS / HIPAA docs (manual) map to MITRE ATT&CK -> ATT&CK Navigator (manual mapping) correlate everything -> copy-paste into a report ──────────────────────────────── Total: hours per assessment, most of it context-switching between tools ``` **wifi-security-mcp-server** gives your AI agent 34 composite tools backed by 9 knowledge bases covering 139 individual capabilities via the [Model Context Protocol](https://modelcontextprotocol.io). The agent analyzes networks, identifies vulnerabilities, maps attacks to MITRE ATT&CK, checks compliance, and generates actionable reports — in a single conversation. ``` With wifi-security-mcp-server: You: "Audit the wireless security of our office network running WPA2-Enterprise" Agent: -> scan_wifi_networks {encryption: "WPA2"} -> analyze_wifi_security {encryption: "WPA2-Enterprise", authentication: "EAP-PEAP"} -> find_wifi_attacks {target_type: "WPA2-Enterprise"} -> detect_wireless_attack {attack_indicators: "deauth frames"} -> audit_wireless_compliance {standard: "PCI-DSS", network_type: "WPA2-Enterprise"} -> "Your WPA2-Enterprise network has 3 critical findings: 1. EAP-PEAP without certificate pinning — vulnerable to evil twin with hostapd-mana (MITRE T1557.002) 2. No 802.11w (PMF) — susceptible to deauthentication attacks (MITRE T1498.001) 3. PMKID hash extractable without client interaction — offline cracking possible with hashcat mode 22000 PCI-DSS 4.0: 2 controls non-compliant (4.2.1, 11.2.1). Recommended: migrate to WPA3-Enterprise with SAE, enable PMF, deploy WIDS for rogue AP detection." ``` --- ## How It's Different Existing tools give you raw packet captures and protocol-specific analysis. wifi-security-mcp-server gives your AI agent the ability to **reason across all wireless domains simultaneously** with deep knowledge-base backing. Traditional Approach wifi-security-mcp-server Interface 10+ different CLIs, GUIs, and hardware tools MCP — AI agent calls tools conversationally Coverage One protocol at a time WiFi, Bluetooth, RF, NFC, Cellular, IoT — all in one server Knowledge Manual CVE lookup, manual ATT&CK mapping 9 built-in knowledge bases with 139 pre-mapped items Attack intel Google search + blog posts + conference talks 47 WiFi + 8 Bluetooth + 6 RF + 6 NFC + 6 Cellular + 6 IoT attacks catalogued with tools, mitigations, ATT&CK IDs Compliance Read NIST/PCI-DSS/HIPAA PDFs, map controls manually Agent checks against 5 compliance frameworks automatically API keys Various accounts for different services Zero API keys for core functionality — knowledge-base driven Setup Install aircrack-ng, Bettercap, HackRF, Proxmark3, Wireshark... npx wifi-security-mcp-server — one command, zero config --- ## Quick Start ### Option 1: npx (no install) ```bash npx wifi-security-mcp-server ``` All 34 tools work immediately. No API keys required — core functionality is knowledge-base driven. ### Option 2: Clone ```bash git clone https://github.com/badchars/wifi-security-mcp-server.git cd wifi-security-mcp-server bun install ``` ### Environment variables (optional) ```bash # WiGLE — wardriving database for real-world WiFi network lookups export WIGLE_API_KEY=your-key # Kismet — live wireless intrusion detection export KISMET_HOST=127.0.0.1 # Default: 127.0.0.1 export KISMET_PORT=2501 # Default: 2501 export KISMET_API_KEY=your-key ``` All API keys are optional. Without them, you still get full access to all 34 tools powered by 9 built-in knowledge bases covering WiFi attacks, Bluetooth attacks, RF/SDR, NFC/RFID, cellular, IoT, hardware databases, CVE intelligence, and compliance frameworks. ### Connect to your AI agent Claude Code ```bash # With npx claude mcp add wifi-security-mcp-server -- npx wifi-security-mcp-server # With local clone claude mcp add wifi-security-mcp-server -- bun run /path/to/wifi-security-mcp-server/src/index.ts ``` Claude Desktop Add to `~/Library/Application Support/Claude/claude_desktop_config.json`: ```json { "mcpServers": { "wifi-security": { "command": "npx", "args": ["-y", "wifi-security-mcp-server"], "env": { "WIGLE_API_KEY": "optional", "KISMET_HOST": "optional", "KISMET_PORT": "optional", "KISMET_API_KEY": "optional" } } } } ``` Cursor / Windsurf / other MCP clients Same JSON config format. Point the command to `npx wifi-security-mcp-server` or your local installation path. ### Start querying ``` You: "What attacks are possible against a WPA3-SAE network and how do I test for them?" ``` That's it. The agent looks up attacks, maps them to MITRE ATT&CK, recommends tools, and provides step-by-step methodology — all from built-in knowledge bases. --- ## What The AI Can Do ### WiFi Security Assessment ``` You: "Analyze the security of a WPA2-PSK network with WPS enabled" Agent: -> analyze_wifi_security {encryption: "WPA2-PSK", features: ["WPS"]} -> crack_wps {method: "pixie_dust"} -> analyze_pmkid {capture_method: "hcxdumptool"} -> find_wifi_attacks {target_type: "WPA2-PSK"} -> "Critical vulnerabilities found in WPA2-PSK + WPS configuration: 1. WPS Pixie Dust Attack — PIN recoverable in seconds via offline brute-force of E-S1/E-S2 nonces (Reaver + PixieWPS). Gives full PSK recovery without client interaction. 2. PMKID Attack — first packet of 4-way handshake contains PMKID hash, crackable offline with hashcat -m 22000. No deauth needed, no client needed. 3. 4-Way Handshake Capture — EAPOL frames capturable with airodump-ng + deauth, then offline dictionary attack. Priority: Disable WPS immediately (highest risk), enforce strong 20+ char PSK, consider migration to WPA3-SAE." ``` ### Bluetooth & BLE Analysis ``` You: "What are the security risks of our BLE-based access control system?" Agent: -> scan_bluetooth {scan_type: "BLE"} -> find_bluetooth_attacks {target_type: "BLE"} -> analyze_ble {feature: "GATT", pairing_method: "JustWorks"} -> "BLE access control system — 4 critical risks identified: 1. JustWorks Pairing — no MITM protection. Attacker can intercept pairing with Ubertooth One (MITRE T1040). 2. GATT Characteristic Sniffing — unlock commands sent in cleartext, replayable with gatttool (MITRE T1212). 3. BLE Relay/Replay Attack — relay legitimate unlock signal using two devices + btlejack (MITRE T1557). 4. MAC Address Tracking — static BLE MAC enables occupant tracking (MITRE T1592.002). Recommended: enforce LE Secure Connections (LESC) with Numeric Comparison, encrypt GATT characteristics, implement rolling nonces for replay protection." ``` ### IoT Wireless Audit ``` You: "Assess the wireless security of our smart building IoT deployment" Agent: -> scan_iot_wireless {protocols: ["Zigbee", "Z-Wave", "MQTT"]} -> analyze_zigbee {network_key_type: "default"} -> find_mousejack {vendor: "Logitech"} -> analyze_wifi_security {encryption: "WPA2-PSK"} -> "Smart building IoT wireless assessment — 5 findings: 1. Zigbee: Default trust center link key (ZigBeeAlliance09) allows network join interception with KillerBee (CRITICAL) 2. MQTT: Broker on port 1883 without TLS — credentials and sensor data transmitted in cleartext 3. Z-Wave: S0 security with known key exchange vulnerability — recommend S2 upgrade 4. MouseJack: 3 Logitech Unifying receivers vulnerable to keystroke injection (CVE-2016-10761) 5. WiFi: IoT devices on same VLAN as corporate — no network segmentation Priority remediation: MQTT TLS, Zigbee install codes, IoT VLAN isolation, replace vulnerable Logitech receivers." ``` ### Compliance Audit ``` You: "Check our hospital WiFi against HIPAA wireless requirements" Agent: -> audit_wireless_compliance {standard: "HIPAA", network_type: "WPA2-Enterprise"} -> analyze_medical_wireless {device_types: ["infusion_pump", "patient_monitor"]} -> detect_wireless_attack {attack_indicators: "rogue_ap"} -> "HIPAA Wireless Compliance Audit — 6 findings: 3 NON-COMPLIANT controls: - 164.312(a)(1): No wireless IDS deployed for rogue AP detection - 164.312(e)(1): Medical devices using WPA2-PSK (not Enterprise) - 164.312(e)(2): No wireless traffic encryption audit logging 3 COMPLIANT controls: - 164.310(a)(1): Physical AP locations documented - 164.312(a)(2): 802.1X with RADIUS authentication - 164.312(d): Certificate-based EAP-TLS for staff devices Remediation plan: deploy WIDS (Kismet/AirMagnet), migrate medical devices to WPA2-Enterprise with MAB, enable wireless audit logging on WLAN controller." ``` --- ## Tools Reference (34 composite tools) WiFi Core (8) — No API key | Tool | Description | |------|-------------| | `scan_wifi_networks` | Scan and analyze WiFi networks — discover SSIDs, channels, encryption types, signal strength, and security misconfigurations | | `analyze_wifi_security` | Deep analysis of WiFi security configuration — encryption strength, authentication method, known weaknesses, attack surface | | `find_wifi_attacks` | Find applicable attacks for a WiFi target — returns attack methodology, required tools, MITRE ATT&CK mapping, mitigations | | `simulate_evil_twin` | Simulate and analyze evil twin AP attack scenarios — hostapd-mana configuration, captive portal, credential capture methodology | | `analyze_deauth` | Analyze deauthentication attack vectors — 802.11w PMF status, deauth detection, countermeasures, WIDS integration | | `crack_wps` | Analyze WPS cracking attack vectors — Pixie Dust, brute force, null PIN, default PIN generation, Reaver/Bully methodology | | `analyze_pmkid` | Analyze PMKID-based attack vectors — clientless WPA/WPA2 cracking via hcxdumptool + hashcat mode 22000 | | `audit_wifi67` | Audit WiFi 6 (802.11ax) and WiFi 7 (802.11be) specific security features — OWE, SAE, Enhanced Open, Multi-Link Operation | Bluetooth (3) — No API key | Tool | Description | |------|-------------| | `scan_bluetooth` | Scan and analyze Bluetooth devices — BR/EDR classic and BLE discovery, service enumeration, pairing analysis | | `find_bluetooth_attacks` | Find applicable Bluetooth attacks — BlueBorne, KNOB, BIAS, BLE relay, MITM, with tools and mitigations | | `analyze_ble` | Deep analysis of BLE security — GATT services, pairing methods, LE Secure Connections, characteristic encryption | RF/SDR (1) — No API key | Tool | Description | |------|-------------| | `analyze_rf_signal` | Analyze RF signal security — frequency analysis, modulation identification, replay attack feasibility, SDR tool recommendations | NFC/RFID (1) — No API key | Tool | Description | |------|-------------| | `analyze_nfc_security` | Analyze NFC/RFID security — card type identification, access control weaknesses, cloning feasibility, Proxmark3 methodology | Cellular/5G (1) — No API key | Tool | Description | |------|-------------| | `analyze_cellular_security` | Analyze cellular network security — 2G/3G/4G/5G protocol weaknesses, IMSI catcher detection, fake base station analysis | IoT Wireless (3) — No API key | Tool | Description | |------|-------------| | `analyze_zigbee` | Analyze Zigbee network security — trust center policy, network key management, KillerBee attack methodology | | `scan_iot_wireless` | Scan IoT wireless protocols — Zigbee, Z-Wave, MQTT, LoRaWAN, CoAP discovery and vulnerability analysis | | `find_mousejack` | Analyze MouseJack wireless keyboard/mouse vulnerabilities — keystroke injection, unencrypted HID, vendor-specific bypasses | Advanced Wireless (6) — No API key | Tool | Description | |------|-------------| | `analyze_airgap` | Analyze air-gap exfiltration techniques — electromagnetic, acoustic, thermal, optical covert channels and countermeasures | | `analyze_uwb` | Analyze Ultra-Wideband (UWB) security — ranging manipulation, relay attacks on car key fobs and AirTags, distance fraud | | `analyze_wifi_csi` | Analyze WiFi Channel State Information (CSI) security — passive sensing, activity recognition, keystroke inference risks | | `analyze_miracast` | Analyze Miracast/WiFi Display security — WFD session hijacking, screen capture, unauthorized display access | | `analyze_wifi_direct` | Analyze WiFi Direct (P2P) security — group owner negotiation attacks, WPS vulnerabilities in P2P, rogue group formation | | `analyze_drone_rf` | Analyze drone RF security — control link hijacking, GPS spoofing, video downlink interception, counter-UAS techniques | Infrastructure (4) — No API key (KISMET_* optional for live WIDS) | Tool | Description | |------|-------------| | `audit_wlan_controller` | Audit WLAN controller configuration — Cisco WLC, Aruba, Meraki security settings, rogue AP policies, RF management | | `analyze_captive_portal` | Analyze captive portal security — bypass techniques, credential harvesting risks, network isolation, guest VLAN security | | `detect_mac_randomization` | Analyze MAC address randomization — iOS/Android/Windows implementation differences, tracking resistance, fingerprinting bypasses | | ` … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [badchars](https://github.com/badchars) - **Source:** [badchars/wifi-security-mcp-server](https://github.com/badchars/wifi-security-mcp-server) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/wifi-security-mcp-server Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-badchars-wifi-security-mcp-server - Seller: https://agentstack.voostack.com/s/badchars - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.