Install

curl -fsSL https://raw.githubusercontent.com/c0tton-fluff/caido-mcp-server/main/install.sh | bash

Or download a pre-built binary from Releases (macOS, Linux, Windows - amd64/arm64).

Or install with the Go toolchain (Go 1.25+):

go install github.com/c0tton-fluff/caido-mcp-server/v4/cmd/caido-mcp-server@latest

The binary lands in $(go env GOPATH)/bin (add it to your PATH). The installed binary reports its module version via caido-mcp-server --version.

<details> <summary>Build from source</summary>

git clone https://github.com/c0tton-fluff/caido-mcp-server.git
cd caido-mcp-server
go build -ldflags "-X github.com/c0tton-fluff/caido-mcp-server/v4/internal/buildinfo.version=$(git describe --tags)" -o caido-mcp-server ./cmd/caido-mcp-server

</details>

Install

curl -fsSL https://raw.githubusercontent.com/c0tton-fluff/caido-mcp-server/main/install.sh | TOOL=cli bash

Or download from Releases.

Or install with the Go toolchain (Go 1.25+):

go install github.com/c0tton-fluff/caido-mcp-server/v4/cmd/caido-cli@latest

<details> <summary>Build from source</summary>

git clone https://github.com/c0tton-fluff/caido-mcp-server.git
cd caido-mcp-server
go build -o caido-cli ./cmd/caido-cli

</details>

Quick Start

Option A: Static access token (recommended)

This server talks to the local Caido app's GraphQL API, which authenticates with the access token from your Caido login session — not a Caido Cloud Personal Access Token. A Cloud PAT (prefixed caido_) is for the cloud/dashboard API and will not authenticate against your local instance.

Grab the access token from the Caido GUI: open developer tools (CTRL+SHIFT+I) and run this in the Console tab:

JSON.parse(localStorage.CAIDO_AUTHENTICATION).accessToken

Pass it via the CAIDO_ACCESS_TOKEN environment variable. No login command needed.

{
  "mcpServers": {
    "caido": {
      "command": "caido-mcp-server",
      "args": ["serve"],
      "env": {
        "CAIDO_URL": "http://127.0.0.1:8080",
        "CAIDO_ACCESS_TOKEN": "your-caido-access-token"
      }
    }
  }
}

Note: this token expires after ~7 days; for a long-lived setup use Option B (OAuth), which refreshes automatically. The older CAIDO_PAT variable is still accepted as a deprecated alias for CAIDO_ACCESS_TOKEN.

Option B: OAuth device flow

CAIDO_URL=http://localhost:8080 caido-mcp-server login

This opens your browser for OAuth authentication and saves the token to ~/.caido-mcp/token.json. Then configure your MCP client:

{
  "mcpServers": {
    "caido": {
      "command": "caido-mcp-server",
      "args": ["serve"],
      "env": {
        "CAIDO_URL": "http://127.0.0.1:8080"
      }
    }
  }
}

3. Use it

"List all POST requests to /api"
"Send this request with a modified user ID"
"Create a finding for this IDOR"
"Show fuzzing results from Automate session 1"
"What's in scope?"

Usage

Requires authentication - run caido-mcp-server login first to store a token. (The CLI reads the stored login token; it does not consume the CAIDO_ACCESS_TOKEN env var that the MCP server uses.)

```bash

Parallel requests via Replay (BAC sweeps, param fuzzing, endpoint sweeps)

caido-cli batch sweep https://target.com/api/profile -t "owner=eyJ1...,cross=eyJ2...,noauth" caido-cli batch fuzz "https://target.com/api/search?q=test" -p q -v "test,test',1 OR 1=1" -H "Authorization: Bearer eyJ..." caido-cli batch ep -t eyJ... https://target.com/dashboard https://target.com/admin caido-cli batch file batch.json

Troubleshooting

MCP server logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-caido/

---