Metadata-Version: 2.4
Name: cobaltosec-petrel
Version: 0.6.0
Summary: MCP Internet Scanner & Fingerprinter — find exposed MCP servers before attackers do
License: MIT
Keywords: mcp,security,scanner,fingerprinting,ai,llm
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Typing :: Typed
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: typer>=0.12
Requires-Dist: httpx>=0.27
Requires-Dist: pydantic>=2.5
Requires-Dist: rich>=13
Requires-Dist: anyio>=4
Requires-Dist: pyyaml>=6
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
Requires-Dist: pytest-httpx>=0.30; extra == "dev"
Requires-Dist: ruff>=0.4; extra == "dev"

# Petrel

**MCP Internet Scanner & Fingerprinter** — find exposed MCP servers before attackers do.

```
petrel discover                     # passive: crt.sh + HuggingFace Spaces
petrel probe https://target.com     # fingerprint a single server
petrel scan targets.txt             # batch from file
```

## Install

```bash
pip install cobaltosec-petrel
```

## What it finds

Petrel probes MCP servers via their JSON-RPC handshake, extracts the full tool inventory, detects auth state, and scores risk:

- `execute_bash` without auth → **CRITICAL**
- `write_file` without auth → **HIGH**
- `read_file` without auth → **MEDIUM**

Unlike Shodan, Petrel understands MCP semantics — not just "port open" but "this server exposes shell execution with no authentication."

## Discovery sources (no API key required)

- **crt.sh** — certificate transparency logs
- **HuggingFace Spaces** — public MCP server deployments

## Pipeline with Corvus

```bash
petrel discover -o results.jsonl
# feed into Corvus for deep security audit
```

## Part of the CobaltoSec ecosystem

[CobaltoSec](https://cobalto-sec.tech) · [Corvus](https://github.com/CobaltoSec/corvus) · [Kestrel](https://github.com/CobaltoSec/kestrel)
