150,000+ agents registered. Trust scores show their math.Explore →
Explorer/MCP/horizonfps/the-box-mcp
LOCAL

The Box

horizonfps/the-box-mcp

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

↗horizonfps/the-box-mcpExternal link; availability not verifiedLicenseMIT LicenseLocal-only
The Ghost
This server runs locally on your machine. We can't scan it remotely; review the source code before installing.
Time indexed (2mo)
0toolsLocal/ STDIO2moindexed
Checked Aug 4, 2026
The scanner shows
This server runs locally. We can't scan it remotely; review the source code before installing.
First indexed Aug 4, 2026
Server Profile
⚙
Tools catalogued
0
No tools reported by this server.
☁
Hosting
Local / STDIO
Runs on your machine. Has access to your filesystem, SSH keys, and environment variables.
○
Registry presence
Not verified
Not yet verified by the Official MCP Registry.
●
Liveness
—
No liveness checks recorded yet.
Publisher Verification
Not listed on the Official MCP Registry.
Source repository is available for review.
↗horizonfps/the-box-mcpExternal link; availability not verified
Environment variables (19)
NVD_API_KEYstringOPTIONAL
Higher NVD rate limit during intel ingest.
THEBOX_LOGS_DIRstringOPTIONALdefault: ~/.thebox/logs
Bridge, tool and intel logs.
THEBOX_STATE_DIRstringOPTIONALdefault: ~/.thebox/state
Databases, token, sessions.
WPSCAN_API_TOKENstringOPTIONAL
WPScan vulnerability database token.
ANTHROPIC_BASE_URLstringOPTIONAL
Base URL for Anthropic-compatible endpoint (default: https://api.anthropic.com).
Show all 19 environment variables
THEBOX_BRIDGE_HOSTstringOPTIONALdefault: 127.0.0.1
Bind address. Leave it local.
THEBOX_BRIDGE_PORTstringOPTIONALdefault: 7070
Daemon port.
THEBOX_SCRATCH_DIRstringOPTIONALdefault: ~/.thebox/scratch
Per-target working directories.
THEBOX_BROWSER_MODEstringOPTIONAL
Launch a browser or attach to one.
ANTHROPIC_AUTH_TOKENstringOPTIONAL
Authentication token for Anthropic-compatible endpoint (required for subagent tools).
THEBOX_BROWSER_CDP_URLstringOPTIONAL
CDP URL to attach to an existing browser instance.
THEBOX_INTEL_EMBED_GPUstringOPTIONALdefault: 0
GPU acceleration for embeddings.
THEBOX_INTEL_LANCE_DIRstringOPTIONAL
Vector store location.
THEBOX_ADVERSARIAL_REVIEWstringOPTIONALdefault: on
Adversarial refuter panel before a finding ships.
THEBOX_TOOL_LOOP_MAX_ITERstringOPTIONALdefault: 0
Cap on the internal tool loop (0 means unlimited).
THEBOX_OOB_PUBLIC_DNS_BINDstringOPTIONAL
Bind address for the public DNS listener.
THEBOX_PROXY_IMPERSONATE_BINstringOPTIONAL
Path to curl-impersonate for TLS parity.
THEBOX_PROXY_PASSTHROUGH_HOSTSstringOPTIONAL
Hosts the MITM proxy must not intercept.
THEBOX_OOB_PUBLIC_TRUSTED_PROXYstringOPTIONAL
Upstream proxy allowed to set forwarded headers.

Is this your server?

Create a free RNWY account to connect your on-chain identity to this server. MCP server claiming is coming; register now and you'll be first in line.

Create your account →
Similar servers
io.github.savecharlie/touchstone
Verifiable text/code/measurement tools for agents, each reproducing a named authority.
Lodestar MCP Server
This is an MCP server that facilitates building tools for interacting with various APIs and workflows, supporting Python-based development with potential for customizable prompts and user configurations.
Jina AI Remote MCP Server
This MCP server provides access to Jina Reader, Embeddings, and Reranker APIs, enabling URL-to-markdown extraction, web and image search, and embeddings/reranking tools.
Weather and Tasks MCP Server
Enables AI to read live weather data and manage a persistent to-do list through MCP tools, demonstrating both read and write capabilities without API keys.
Dwds
DWDS German Digital Dictionary (snippet/lemma/concordance/kwic)
Unified MCP Server
Protocol-enforced learning system combining memory-augmented reasoning with workflow automation to improve AI assistant reliability by ensuring they learn from past experiences before making code changes.
Indexed from Glama · Updates nightly