{
  "_W003_ARCHIVE_NOTICE": [
    "This file is ARCHIVED and NOT used at runtime.",
    "The runtime MCP config is generated by write_mcp_config() in app.py",
    "and written to /tmp/mcp_runtime.json at the start of every audit.",
    "Removed entries (kept here for historical reference only):",
    "  - aider-patcher       (replaced by OpenClaude)",
    "  - postgres-intelligence (npm package 404)",
    "  - atheris-fuzzer      (requires Clang+libFuzzer, unavailable on HF Spaces)",
    "Resolves W-003 (HIGH) from FOUNDER_PLAYBOOK.md section 10."
  ],
  "_comment": [
    "TEMPLATE ONLY \u2014 contains NO secrets.",
    "Actual runtime config is written to /tmp/mcp_runtime.json at startup.",
    "Secrets injected from HF Space env vars \u2014 never committed.",
    "FETCH_ALLOWED_DOMAINS prevents SSRF against internal services.",
    "Rhodawk AI v6.0 \u2014 37 cybersecurity MCP server suite (12 new in v6 per Masterplan \u00a78)."
  ],
  "mcpServers": {
    "fetch-docs": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch"
      ],
      "description": "Fetch security docs, CVE advisories, exploit PoCs, and vendor bulletins",
      "env": {
        "FETCH_ALLOWED_DOMAINS": "docs.python.org,pypi.org,docs.github.com,packaging.python.org,peps.python.org,cwe.mitre.org,nvd.nist.gov,owasp.org,portswigger.net,hackerone.com,bugcrowd.com,cve.org,exploit-db.com,docs.rs,go.dev,nodejs.org,developer.mozilla.org,shodan.io,virustotal.com,osv.dev,snyk.io,vulners.com,seclists.org,packetstormsecurity.com,securityfocus.com,cisa.gov,zerodayinitiative.com,huntr.com,intigriti.com,yeswehack.com,vdp.hackerone.com,api.github.com,raw.githubusercontent.com,archive.org,web.archive.org,semgrep.dev,rules.semgrep.dev,github.com,security.snyk.io,opencve.io,vuldb.com,rapid7.com,metasploit.com,www.rapid7.com"
      }
    },
    "github-manager": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "description": "GitHub API: create PRs, open security advisories, manage issues, query commit history",
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "filesystem-research": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/data/repo",
        "/tmp/research",
        "/tmp/findings"
      ],
      "description": "Read-only access to cloned repos, research scratch space, and findings output"
    },
    "memory-store": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-memory"
      ],
      "description": "Persistent knowledge graph \u2014 stores exploit chains, CWE patterns, and cross-session vulnerability memory"
    },
    "sequential-thinking": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sequential-thinking"
      ],
      "description": "Structured chain-of-thought for complex multi-step vulnerability analysis and exploit reasoning"
    },
    "web-search": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-brave-search"
      ],
      "description": "Search CVEs, exploit PoCs, vendor advisories, bug bounty writeups, and security research papers",
      "env": {
        "BRAVE_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "git-forensics": {
      "command": "mcp-server-git",
      "args": [
        "--repository",
        "/data/repo"
      ],
      "description": "Deep git history analysis: silent security patches (CAD), blame tracking, commit anomaly detection"
    },
    "postgres-intelligence": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-postgres"
      ],
      "description": "Query findings DB, scan history, and vulnerability intelligence store",
      "env": {
        "DATABASE_URL": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "sqlite-findings": {
      "command": "mcp-server-sqlite",
      "args": [
        "--db-path",
        "/data/rhodawk_findings.db"
      ],
      "description": "Local findings store \u2014 fast queries on vulnerability metadata, CVSS scores, and bounty estimates"
    },
    "nuclei-scanner": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "nuclei,nuclei-templates"
      ],
      "description": "Nuclei template-based vulnerability scanner \u2014 DAST, CVE detection, misconfig scanning",
      "env": {
        "NUCLEI_TEMPLATES_PATH": "/data/nuclei-templates",
        "NUCLEI_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "semgrep-sast": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "semgrep"
      ],
      "description": "Semgrep SAST \u2014 taint analysis, CWE pattern matching, secrets detection across 30+ languages",
      "env": {
        "SEMGREP_APP_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "trufflehog-secrets": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "trufflehog"
      ],
      "description": "TruffleHog v3 \u2014 high-signal secret scanning with 700+ detectors across git history"
    },
    "bandit-sast": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "bandit"
      ],
      "description": "Bandit Python SAST \u2014 AST-level detection of dangerous patterns, injection sinks, insecure APIs"
    },
    "pip-audit-sca": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "pip-audit,pip"
      ],
      "description": "pip-audit SCA \u2014 known vulnerabilities in Python dependencies via OSV and PyPI Advisory DB"
    },
    "osv-scanner": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "osv-scanner"
      ],
      "description": "OSV Scanner \u2014 multi-ecosystem SCA using the Open Source Vulnerability database (Google)"
    },
    "z3-formal-verifier": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "python3"
      ],
      "description": "Z3 SMT solver \u2014 formal verification of integer bounds, overflow invariants, protocol properties"
    },
    "hypothesis-fuzzer": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "python3,pytest,hypothesis"
      ],
      "description": "Hypothesis PBT fuzzer \u2014 property-based testing for arithmetic overflow, encoding, aliasing bugs"
    },
    "atheris-fuzzer": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "python3,atheris"
      ],
      "description": "Atheris coverage-guided fuzzer \u2014 libFuzzer-backed Python fuzzing for parser and protocol bugs"
    },
    "angr-symbolic": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "python3"
      ],
      "description": "angr symbolic execution \u2014 binary analysis, path exploration, constraint solving for native exploits"
    },
    "radon-complexity": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "radon"
      ],
      "description": "Radon AST complexity analysis \u2014 cyclomatic complexity, Halstead metrics, attack surface ranking"
    },
    "ruff-linter": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "ruff"
      ],
      "description": "Ruff ultra-fast Python linter \u2014 detects anti-patterns that correlate with security bugs"
    },
    "aider-patcher": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "aider"
      ],
      "description": "Aider AI code editor \u2014 applies LLM-generated patches with diff verification and test re-run",
      "env": {
        "OPENROUTER_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "cve-intelligence": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch"
      ],
      "description": "NVD/NIST CVE API \u2014 fetch full CVE details, CVSS vectors, CWE mappings, affected versions",
      "env": {
        "FETCH_ALLOWED_DOMAINS": "nvd.nist.gov,cve.org,cve.mitre.org,www.cvedetails.com,vulners.com,osv.dev,opencve.io",
        "NVD_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "bounty-platform": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch"
      ],
      "description": "Bug bounty platform APIs \u2014 HackerOne report submission, GitHub Security Advisories, Bugcrowd",
      "env": {
        "FETCH_ALLOWED_DOMAINS": "api.hackerone.com,api.bugcrowd.com,api.intigriti.com,api.yeswehack.com,api.github.com",
        "HACKERONE_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__",
        "HACKERONE_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "supply-chain-monitor": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch"
      ],
      "description": "Supply chain security \u2014 PyPI typosquatting, dependency confusion, malicious package detection",
      "env": {
        "FETCH_ALLOWED_DOMAINS": "pypi.org,api.pypi.org,registry.npmjs.org,crates.io,deps.dev,socket.dev,api.socket.dev"
      }
    },
    "reconnaissance-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.reconnaissance_mcp"
      ],
      "description": "Mythos: language/framework/dependency fingerprinting + attack-surface enumeration"
    },
    "static-analysis-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.static_analysis_mcp"
      ],
      "description": "Mythos: Tree-sitter CPG, Joern, CodeQL, Semgrep \u2014 deep semantic static analysis"
    },
    "dynamic-analysis-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.dynamic_analysis_mcp"
      ],
      "description": "Mythos: AFL++, KLEE, QEMU, Frida, GDB \u2014 coverage-guided + symbolic + instrumented dynamic analysis"
    },
    "exploit-generation-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.exploit_generation_mcp"
      ],
      "description": "Mythos: Pwntools, ROPGadget, heap kit, privesc KB \u2014 autonomous PoC synthesis"
    },
    "vulnerability-database-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.vulnerability_database_mcp"
      ],
      "description": "Mythos: NVD, OSV, Exploit-DB lookup for prior-art correlation"
    },
    "web-security-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.web_security_mcp"
      ],
      "description": "Mythos: OWASP ZAP, nuclei, sqlmap orchestration for web targets"
    },
    "browser-agent-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.browser_agent_mcp"
      ],
      "description": "ARCHITECT: Playwright-driven live browser for web app testing (navigate/click/inject/screenshot)"
    },
    "scope-parser-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.scope_parser_mcp"
      ],
      "description": "ARCHITECT: HackerOne / Bugcrowd / Intigriti scope ingestion for night-mode",
      "env": {
        "HACKERONE_USERNAME": "__INJECTED_BY_APP_AT_RUNTIME__",
        "HACKERONE_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__",
        "BUGCROWD_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__",
        "INTIGRITI_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "subdomain-enum-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.subdomain_enum_mcp"
      ],
      "description": "ARCHITECT: subfinder + amass + dnsx + crt.sh subdomain enumeration"
    },
    "httpx-probe-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.httpx_probe_mcp"
      ],
      "description": "ARCHITECT: httpx live-host probe + tech fingerprint"
    },
    "shodan-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.shodan_mcp"
      ],
      "description": "ARCHITECT: Shodan internet-exposure lookup",
      "env": {
        "SHODAN_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
      }
    },
    "wayback-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.wayback_mcp"
      ],
      "description": "ARCHITECT: Wayback / CommonCrawl historical URL recall"
    },
    "frida-runtime-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.frida_runtime_mcp"
      ],
      "description": "ARCHITECT: live Frida instrumentation sessions (mobile / native runtime)"
    },
    "ghidra-bridge-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.ghidra_bridge_mcp"
      ],
      "description": "ARCHITECT: headless Ghidra / radare2 binary analysis bridge"
    },
    "can-bus-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.can_bus_mcp"
      ],
      "description": "ARCHITECT: automotive CAN-bus + UDS (ISO 14229) wrapper"
    },
    "sdr-analysis-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.sdr_analysis_mcp"
      ],
      "description": "ARCHITECT: GNU Radio / rtl_sdr scripted RF capture & analysis"
    },
    "skill-selector-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.skill_selector_mcp"
      ],
      "description": "Rhodawk: semantic skill selection (MiniLM) \u2014 brain extension on demand"
    },
    "trufflehog-deep-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "trufflehog,git"
      ],
      "description": "TruffleHog deep scan over full git history (all commit depths)"
    },
    "gitleaks-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "gitleaks,git"
      ],
      "description": "Gitleaks \u2014 complementary secret scanner with custom rules"
    },
    "semgrep-pro-patterns-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "semgrep"
      ],
      "description": "Semgrep with p/security-audit + p/owasp-top-ten + p/cwe-top-25 rulesets",
      "env": {
        "SEMGREP_RULES": "p/security-audit p/owasp-top-ten p/cwe-top-25 p/r2c-security-audit"
      }
    },
    "jwt-analyzer-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.jwt_analyzer_mcp"
      ],
      "description": "JWT alg:none, weak-secret brute, key confusion, missing exp/nbf"
    },
    "api-fuzzer-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "restler,dredd,schemathesis"
      ],
      "description": "Stateful REST/GraphQL API fuzzer (RESTler/Dredd/Schemathesis)"
    },
    "solidity-auditor-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "slither,myth,solc"
      ],
      "description": "Smart-contract static analysis: Slither + Mythril"
    },
    "dependency-confusion-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.dep_confusion_mcp"
      ],
      "description": "Detect dependency-confusion vectors (npm + PyPI manifests)"
    },
    "git-forensics-deep-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-shell",
        "--allow-commands",
        "git-dumper,git"
      ],
      "description": "Exposed .git directories + incomplete .gitignore detection"
    },
    "openapi-analyzer-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.openapi_analyzer_mcp"
      ],
      "description": "Parse OpenAPI/Swagger and enumerate attack surface"
    },
    "cors-analyzer-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.cors_analyzer_mcp"
      ],
      "description": "CORS misconfiguration: origin reflection, null origin, wildcard+credentials"
    },
    "prototype-pollution-mcp": {
      "command": "python",
      "args": [
        "-m",
        "mythos.mcp.prototype_pollution_mcp"
      ],
      "description": "JS prototype-pollution sink scanner (AST-style grep)"
    }
  }
}