GTFOBins

You can query and explore GTFOBins exploitation techniques directly from Claude Desktop by using a dedicated MCP server. This server provides fast, on-demand access to GTFOBins data through a containerized workflow, enabling you to search binaries, filter by capabilities, and view detailed exploitation methods within your conversations.

How to use

Interact with GTFOBins through Claude Desktop by selecting the GTFOBins MCP server configuration and asking natural language questions. You can search for binaries by name or technique, filter by function type, and request complete exploitation details for a specific binary. Examples of typical interactions include: searching for a binary with a given capability, listing all binaries that support a certain function, and fetching detailed exploitation steps for a chosen tool.

How to install

Prerequisites you need to have before running the GTFOBins MCP server:

• Docker installed and running
• Claude Desktop installed
• Apple Silicon Mac (M1/M2/M3) or compatible system

Step-by-step setup and run:

# Create project directory
mkdir gtfobins-mcp-server
cd gtfobins-mcp-server

# Copy the following files to this directory:
# - Dockerfile
# - requirements.txt
# - server.py

# Build the image for Apple Silicon
docker build --platform linux/arm64 -t gtfobins-mcp-server .

# Test the build
docker run --rm --platform linux/arm64 gtfobins-mcp-server python -c "
import sys; sys.path.append('/app')
from server import GTFOBinsServer
server = GTFOBinsServer()
print(f'✅ Successfully loaded {len(server.binaries_data)} GTFOBins entries')
""

Configuration for Claude Desktop

Configure Claude Desktop to load the GTFOBins MCP server by pointing it to the Docker-based runtime. Create or edit your Claude Desktop MCP configuration to include the GTFOBins server entry as shown.

{
  "mcpServers": {
    "gtfobins": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "--platform",
        "linux/arm64",
        "gtfobins-mcp-server",
        "python",
        "/app/server.py"
      ],
      "env": {}
    }
  }
}

Restart Claude Desktop

After updating the MCP configuration, completely quit Claude Desktop and relaunch it to load the GTFOBins MCP server again.

Additional content

Architecture and usage notes help you understand how the GTFOBins MCP server operates and why it suits on-demand exploration. The server loads GTFOBins data, parses binary techniques, indexes results in memory, and exposes search and detail capabilities through the MCP interface. Each Claude Desktop session runs with a fresh container context to ensure clean, isolated results.

If you encounter issues, verify Docker is running, ensure Claude Desktop has the updated MCP configuration, and restart Claude Desktop. You can also test the Docker image directly to confirm the GTFOBins data loads correctly.

Security notes: using GTFOBins techniques is for authorized security testing and education. Access is read-only through the MCP server, and you should operate within your organization’s policies and applicable laws.

Available tools

search_gtfobins

Search the GTFOBins database by binary name or technique keywords with optional filtering by function type.

get_binary_details

Retrieve complete exploitation information for a specific binary, including all techniques and examples.

list_binaries_by_function

List all binaries that support a given function type such as shell, file-upload, suid, or library-load.