Cybermes combines an MCP toolbelt with an offensive workflow
Cybermes is meant for authorized bug-bounty and security work. Its Go MCP server exposes knowledge search, scope validation, HTTP probing, crawling, secret scanning, finding records, and report aggregation to clients such as Claude Code and Cursor. A larger Python workflow coordinates recon tools, playbooks, proof files, and reports. The repository describes more than 200 offensive procedures for web, API, cloud, and authentication problems.
That scope explains the 4,673 files and roughly 274,667 source lines in our checkout. Cybermes includes research material, utilities, installation scripts, reporting code, and workspace templates. It can produce Markdown, JSON, HTML, and PDF artifacts under a target directory. There is far more to audit here than a single scanner binary.
The MCP server is the cleanest entry point
The shortest start is npx -y cybermes-mcp. The package downloads a platform binary and runs a JSON-RPC MCP server over standard input and output. Its installer detects supported AI clients, backs up their configuration, and adds the server. A dry-run flag previews the changes. Manual configuration is also documented and is safer on controlled workstations.
Our Node 22 install took 24 seconds, pulled 252 packages, and occupied 89 MB. The server remains an offensive interface inside an AI client. Tool approvals matter more here than for a read-only documentation server, especially when crawling, probing, or recording evidence against a real host.
What happened when we ran it
In our sandbox, npm installation succeeded in 24 seconds. The audit reported six known vulnerabilities, all high severity, with no critical, moderate, or low findings. We did not infer which package was exploitable. Reproduce the audit against the deployed lockfile and determine whether affected code is reachable before using the MCP package on a sensitive workstation.
The repository did not define an npm build script or test script, so our harness skipped both. It also found no tests directory, despite three CI workflow files. This does not mean tests failed. Our generic npm runner had no repository-level suite to execute. Docker and compose files provide deployment paths, but they do not replace behavioral checks for target scope and command execution.
The full framework needs more than the 89 MB npm tree
Standalone installation introduces Python 3.11 or newer and Go 1.22 or newer, plus subfinder, httpx, katana, ffuf, nuclei, and sqlmap. The environment file expects an LLM provider or local endpoint. Telegram adds a bot token, allowed-user IDs, and gateway settings. PDF generation may need Playwright and Chromium.
doctor.py checks dependencies, paths, and tool integrity, while doctor.py --fix attempts repairs. The troubleshooting guide covers architecture-mismatched binaries, Docker bind-mount mistakes, report ownership, model errors, and missing Chromium. The 215.9 MB checkout is an environment to administer, not a disposable prompt extension.
Wildcard scope defaults require intervention
The troubleshooting guide states that dynamic_target_override: true with targets: ["*"] is enabled by default and says a requested URL is automatically authorized. The sample environment also sets HERMES_YOLO_MODE=1. Change those defaults, pin an explicit allowed scope, and require confirmation around active tools before connecting an agent.
Cybermes requires a standalone, non-destructive proof script and raw HTTP traces before logging a finding. That recordkeeping rule cannot grant permission to test a system. With 200-plus playbooks, an incorrect scope decision can trigger many downstream actions. Keep the framework inside the engagement boundary and review generated proofs as untrusted code.
Target folders make evidence easier to inspect
Cybermes creates separate reports and recon trees for each target. Findings, proof scripts, raw evidence, metadata, and an executive summary stay together. smart_pipe archives raw output while returning selected signals to the model, avoiding a crawler's full stream in the model context. Report aggregation turns accepted records into several formats.
The 274,667-line source count matters because a result must pass through filtering, agent interpretation, proof generation, validation, and report compilation. Since our npm path had no test target, rehearse that chain against the bundled mock vulnerable application and inspect each artifact before relying on a generated report.
Version 3.0.0 arrived on August 25, 2026
Version 3.0.0 was released on August 25, 2026, and the repository was pushed later that day. GitHub showed no open issues or pull requests. The release added the Go MCP server, installer, scope engine, HTTP inspector, crawler, and precompiled binaries with checksums. The empty queue says little about behavior across every supported client and operating system.
Cybermes uses Apache 2.0, while third-party datasets and tools retain their own licenses. The documentation credits outside work around PDF rendering, Windows setup, and Docker diagnostics. Examine the attribution file and bundled material before redistributing the 215.9 MB checkout.
Use it as a supervised workspace
Cybermes fits experienced testers who want MCP access, local playbooks, evidence directories, and report assembly around tools they understand. Nuclei is easier to inspect for template scanning, while Amass is a better fit for asset discovery alone. Strix is the closer comparison for agent-led testing.
The six high-severity advisories and absent npm test target prevent a casual recommendation. The wildcard scope described in the guide is too permissive for unsupervised use. Lock the target list, disable broad approval behavior, isolate the runtime, and keep a human responsible for every active request. The 252-package install is secondary to those controls.