Hashcat Mcp

Hashcat MCP Server

Developed By: Anil Parashar (TechChip) YouTube: @techchipnet | Website: techchip.net

Hashcat-MCP is a server implementation of the Model Context Protocol (MCP) designed to bridge large language models with the powerful capabilities of Hashcat, a widely used password recovery and hash-cracking tool. By exposing Hashcat’s functionality through a structured, machine-readable interface, Hashcat-MCP allows AI systems to securely invoke, control, and automate complex cracking workflows.

With Hashcat-MCP, language models can perform tasks such as identifying hash types, configuring attack modes (dictionary, brute-force, hybrid, and rule-based attacks), managing wordlists and masks, and monitoring cracking progress in real time. This integration enables more efficient, context-aware automation of security auditing, penetration testing, and forensic analysis processes.

The system is particularly useful for cybersecurity professionals, researchers, and developers who want to incorporate intelligent automation into password recovery tasks, while maintaining fine-grained control over execution parameters. By combining the reasoning capabilities of large language models with Hashcat’s high-performance computation, Hashcat-MCP streamlines workflows that would otherwise require significant manual setup and expertise.

Prerequisites

| Requirement | Details | |---|---| | Python | 3.10+ | | hashcat | Must be installed and in $PATH | | OS | Linux/Windows/macOS |

Available Tools

| Tool | Description | |---|---| | identify_hash | Built-in tool to identify hash types and suggest hashcat -m mode | | dictionary_attack | Wordlist/dictionary attack against hashes (-a 0) | | combination_attack | Combine words from two wordlists (-a 1) | | bruteforce_attack | Brute-force using mask patterns (-a 3) | | hybrid_wordlist_mask | Wordlist + mask (-a 6) | | hybrid_mask_wordlist | Mask + wordlist (-a 7) | | rule_attack | Dictionary + rule file for word mutations (-a 0 -r) | | restore_session | Resume a paused/interrupted session (--restore) | | show_cracked | Show already-cracked hashes (--show) | | show_uncracked | Show remaining uncracked hashes (--left) | | benchmark | Benchmark hash speed (-b) | | list_devices | List OpenCL/CUDA devices (-I) | | check_hashcat | Verify hashcat version | | verify_hash_file | Validate hash file format & count hashes | | extract_hashes | Extract hashes from common file formats | | list_hash_modes | Search supported hash modes | | potfile_lookup | Search potfile for specific hashes | | generate_mask | Generate mask pattern suggestions |

Usage

Run the server directly

python3 hashcatmcp.py

The server reads JSON-RPC 2.0 messages from stdin and writes responses to stdout.

MCP Client Configuration

Add this to your MCP client config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "hashcat": {
      "command": "python3",
      "args": [
        "/absolute/path/to/hashcat-mcp/hashcatmcp.py"
      ]
    }
  }
}

Security

• No External Dependency for Hash ID: Built-in regex engine.
• File Validation: File paths are checked for existence before use.
• Timeouts: Long-running attacks have configurable timeouts.
• No Shell Execution: Commands use list-based subprocess.run() (no shell injection).

---

> ⚠️ Legal Disclaimer: This tool is for authorized penetration testing and security research only. Unauthorized access to computer networks is illegal. Always obtain written permission before testing.

---

Developed with ❤️ by Anil Parashar (TechChip)

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: techchipnet
• Source: techchipnet/hashcat-mcp
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.