✦ M I T S U ✦
Your chibi red-team companion
An agentic pentest framework that can take an engagement from recon through post-exploitation on her own.
Усильте агента
Установка от издателя. Не эндпоинт PlugMCP.
Host a copy with our keys and logs.
В реестре пока нет пакетного релиза. Следуйте README репозитория.
Удалённый URL или команда на вашем компьютере? Чем различаются два способа установки
Запустить на PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
ЗапускОт издателя
An agentic pentest framework that can take an engagement from recon through post-exploitation on her own.
Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > exploitation, and post-exploitation, armored with 165+ MCP-connected tools and live session intel. Guide every step or let her pwn autonomously. ( ◠‿◠)
Mitsu is an agentic framework client for authorized penetration-testing workflows. Given an in-scope target and objective, she can carry out reconnaissance, enumerate hosts and services, research vulnerabilities and exploits, validate findings, and continue into post-exploitation. Her MCP server connects the selected model to 165+ Red Team Armory tools, external MCP servers, and custom command wrappers.
Each session keeps its own Intel, including targets, IPs, domains, services, vulnerabilities, findings, accounts, evidence, and observations. Mitsu adds to it as the engagement progresses and uses what she learns to choose what to check next. You can also turn the session Intel into an interactive attack-surface map or an assessment report, with your chibi companion along for the work.
flowchart TD
A[Launch Mitsu] --> B{Choose a session}
B -->|New| C[Create session]
B -->|Resume| D[Load history and Intel]
C --> E[Select provider and model]
D --> E
E --> F[Set target, scope, mode, and workspace]
F --> G[Describe the assessment objective]
G --> H[Model reviews conversation and session Intel]
H --> I[Choose a focused next step]
I --> J{Need a tool, a detail, or a final answer?}
J -->|Question or choice| K[Show an interactive dialog]
K --> H
J -->|Final answer| Z[Summarize evidence and remaining gaps]
J -->|Tool| L{Mode and approval check}
L -->|Guided| M[Ask operator to choose the next action]
M -->|Continue| N[Run one focused check]
M -->|Redirect or stop| H
L -->|AutoPwn| N
L -->|Recon| O[Use permitted passive or read-only checks]
L -->|Approval required| P[Show approval or sudo dialog]
P -->|Approve| N
P -->|Decline| H
N --> Q[Run capability through MCP]
O --> Q
Q --> R[Review tool output and evidence]
R --> S[Update targets, services, IPs, domains, and observations]
S --> T{Relevant vulnerability lead?}
T -->|Yes| U[Check product, version, and prerequisites]
U --> V{Evidence supports applicability?}
V -->|No or unknown| W[Record uncertainty and choose another check]
V -->|Yes| X[Validate impact within scope]
X --> Y{Confirmed?}
Y -->|No| W
Y -->|Yes| AA[Record finding, severity, evidence, and references]
T -->|No| AB{Useful in-scope work remains?}
W --> AB
AA --> AB
AB -->|Yes| I
AB -->|No| Z
Z --> AC[Save session and review results]
AC --> AD[Generate report, map attack surface, export, or resume]
AE[Operator sends a new direction] -. interrupts active turn .-> H
Mitsu runs the selected model in a tool loop: it receives the session history and Intel, requests a tool when useful, and continues from the returned evidence. Recon, Guided, and AutoPwn apply different interaction and approval rules around that loop. A new operator message can redirect an active turn; recorded Intel keeps confirmed assets and findings alongside unresolved observations.
Mitsu requires Python 3.10 or newer. The GitHub installer uses uv to set up and manage its environment.
Install Mitsu with:
pip install mitsu
mitsu
git clone https://github.com/ARCANGEL0/Mitsu.git
cd Mitsu
./scripts/install.sh
Mitsu can identify missing tools or the local SearXNG container needed for a task and offer to install them with your approval.
From the Mitsu source directory:
uv tool install .
mitsu
To run directly from the checkout instead:
./mitsu
The first-run setup walks you through the essentials:
After that, you’re ready to start a session.
You can return to provider and model setup from the command center at any time. In a session, use /connect to change provider settings or /model to switch models. For a local Ollama server, make sure it is running and has a model available before connecting.
Switch modes with /mode. The mode controls how Mitsu interacts with targets and when she asks you to decide.
Mitsu is designed to keep moving when a lead fails: use the evidence, drop paths that no longer fit, and choose a better-supported check. AutoPwn does not expand the target scope or authorize destructive, disruptive, persistent, or unrelated actions.
Want to stay hands-off? AutoPwn lets Mitsu follow useful, evidence-backed paths within the scope you set, with minimal interruptions. Prefer to direct the engagement? In Guided, Mitsu reports what she found, lays out the next useful directions, and waits for you to choose where she goes. You’re the orchestrator; she brings the chibi rage to the target you picked.
Either way, Mitsu keeps the objective and recorded evidence in view, drops leads that stop making sense, and pauses when an action needs your approval or credentials.
Mitsu comes equipped with an Armory catalog of 165+ red-team tools across 17 categories, exposed through her MCP server with descriptions and inputs the model can use. You can expand her kit whenever you need by registering custom command wrappers or connecting additional MCP servers. When a catalogued utility is missing, Mitsu can offer to install it and wait for your approval.
OWASP Amass, Subfinder, assetfinder, theHarvester, Recon-ng, SpiderFoot, Sherlock, Maigret, DNSRecon, DNSenum, Fierce, DMitry, WHOIS, gau, waybackurls, Katana, CloudEnum, Shodan CLI, Censys CLI, ASNMap, URLFinder, tlsx
Nmap, Masscan, ZMap, RustScan, arp-scan, Netdiscover, fping, hping3, Naabu, dnsx, httpx (ProjectDiscovery), Uncover, AutoRecon, NBTScan, enum4linux, SMBMap, rpcclient, Net-SNMP Walk, Traceroute, Netcat, socat
Burp Suite Community, OWASP ZAP, WPScan, sqlmap, Nikto, Gobuster, ParamSpider, hakrawler, GoSpider, Jaeles, x8, ffuf, feroxbuster, dirsearch, DIRB, WhatWeb, WAFW00F, Arjun, Dalfox, Commix, XSStrike
JWT Tool, GraphQLmap, grpcurl, Schemathesis
NoSQLMap, sqlninja
Nuclei, testssl.sh, sslscan, SSLyze, Trivy, Vulnx, Checkov, Grype
John the Ripper, Hashcat, THC Hydra, Medusa, Ncrack, HashID, Crunch, Patator, Hash Identifier, Ophcrack, Stegseek, Crowbar, fcrackzip, CeWL
Metasploit Framework, Exploit-DB / SearchSploit, RouterSploit
NetExec, Impacket, BloodHound.py, Certipy, enum4linux-ng, Kerbrute, ldapdomaindump, ADIDNSDump, bloodyAD, Coercer, pypykatz
Evil-WinRM, Responder, Ligolo-ng, Chisel, ProxyChains-NG, sshuttle, pspy, LinPEAS, WinPEAS
tcpdump, Wireshark, TShark, dsniff, Ettercap, mitmproxy
Aircrack-ng, Bettercap, Kismet, Wifite, hcxdumptool, hcxtools
BlueZ, HackRF Tools, RTL-SDR Tools, Gqrx SDR, Ubertooth Tools
Social-Engineer Toolkit, Gophish
Prowler, ScoutSuite, kube-hunter, Pacu, ROADrecon, CloudFox, kube-bench
Apktool, JADX, Frida Tools, Objection
Ghidra, Radare2, Volatility 3, Binwalk, Foremost, ExifTool, YARA, GNU Debugger, GDB Multiarch, Rizin, checksec, ROPgadget, Ropper, pwntools, Steghide, zsteg, TestDisk / PhotoRec, The Sleuth Kit, bulk_extractor, Scalpel
Browse the catalog and manage installations from the Red Team Armory in the command center. Tool availability depends on what is installed and supported on the host; the session status shows how many selected tools are ready to use.
Mitsu includes an MCP server that connects the agent to built-in session capabilities and external tools. Configure it with /mcp or from Configure MCP Server in the command center.
The configuration supports:
A minimal configuration looks like this:
{
"servers": [
{
"name": "local-tools",
"command": "python",
"args": ["-m", "example_mcp_server"],
"env": {}
}
],
"custom_tools": [],
"armory": {
"enabled": true,
"tools": ["network-mapping", "vulnerability"]
}
}
Use absolute executable paths when a server is not available on Mitsu’s PATH. Keep credentials out of command arguments and transcripts; use the server’s supported environment configuration for secrets.
Custom tool definitions give Mitsu a named executable, documentation, and typed inputs instead of a free-form shell string.
{
"id": "staging_audit",
"name": "Staging audit",
"command": "/usr/local/bin/staging-audit",
"description": "Run the approved read-only audit against a staging host.",
"usage": "staging-audit --target HOST",
"examples": ["Audit the authorized staging host"],
"args": [],
"parameters": [
{
"name": "target",
"type": "string",
"description": "Authorized staging hostname",
"flag": "--target",
"required": true
}
],
"env": {},
"timeout_seconds": 120,
"read_only": true
}
The full configuration is saved in ~/.config/mitsu/mcp_servers.json by default. Mitsu validates tool IDs, parameter types, required fields, timeouts, and selected Armory entries before reconnecting.
Each session carries its own compact Intel dataset. Mitsu saves it inside that session’s JSON file, reloads it with the conversation, and supplies it as context while she works. It is ordinary session data, not a separate SQLite database.
The TUI keeps Intel in tabs on the right side of the session. Click a tab to view that category’s records:
┌─ Session: target assessment ─────────────────────────────┐
│ Conversation · scope · working directory │
│ │
│ Session Intel → loaded as context for Mitsu’s next turn │
│ │
│ Right-side Intel tabs │
│ [Targets] [Findings] [Services] [Exploits / Vulns] │
│ [Domains] [IPs] [Passwords / Accounts] [Manhunt] │
│ [Observations] │
│ │
│ Select a tab to browse the session’s records │
└──────────────────────────────────────────────────────────┘
By default, a session is stored at ~/.local/share/mitsu/sessions/<session-id>.json; setting XDG_DATA_HOME changes the base directory. The same file contains the conversation and session Intel, so each assessment keeps its own target context when you resume it.
Records can include their source, evidence, confidence, verification state, timestamps, and relationships to other assets. A scan output is not automatically proof that every result is exploitable: vulnerability leads stay leads until the affected version and target behavior support them.
Mitsu can read and update Intel through MCP during a session. Older session data is migrated into the current structured format when loaded.
Mitsu connects to the OpenAI and Anthropic APIs directly. Other built-in connections include OpenRouter, NVIDIA NIM, Ollama, DeepSeek, and Moonshot (Kimi) through OpenAI-compatible APIs, plus Cloudflare Models through a Cloudflare account endpoint. You can also configure a custom endpoint that follows either the OpenAI or Anthropic API format.
Image input is supported for models that accept vision. Paste an image into chat or attach one from the session workspace; Mitsu checks the selected model’s image capability before sending it. Supported formats include PNG, JPEG, WebP, and GIF. Image support depends on the provider and specific model, so choose a vision-capable model when working from screenshots or other images.
API keys and provider profiles are stored in your local Mitsu configuration. When using a hosted provider, prompts, tool results, Intel context, and any attached images needed for the request are sent to that provider.
Configure search sources with /config. Mitsu can query multiple configured engines and combine results. Available options include direct search providers, API-backed engines, and SearXNG. Some engines require an API key; SearXNG requires Docker for Mitsu’s managed local setup.
Web search is useful for current documentation, public records, and vulnerability references. Search results are leads: confirm affected versions and target-side behavior before treating a CVE as applicable.
Use /vulnsearch <query> to look for vulnerability and exploit references. With no query, Mitsu can search using product and version clues already recorded in Intel. Sources can include:
The results are presented as findings and references. A match is not proof that the target is vulnerable, and the search does not run an exploit.
Start a new session from the command center and describe the task in plain language. Include the authorized scope, any known addresses or domains, and the objective. You can attach useful context or point Mitsu to files in the session workspace.
Example:
I’m assessing the authorized host at 192.0.2.25. Start with the exposed services, record confirmed ports and versions in Intel, then suggest the most relevant next check.
Set the working directory before asking Mitsu to create or inspect engagement files:
/workdir /path/to/engagement
The working directory is stored with that session and becomes its primary workspace for file and shell operations. Mitsu starts in the project’s current directory when a session has no custom workdir configured.
During a run, the chat shows tool activity and expandable command output. You can stop a response, copy messages or code blocks, rewind to an earlier conversation point, and search the chat. Image attachments can be added through paste or file references.
Tool results appear alongside the conversation, with long command output expandable in place. Click a marked code value, such as a flag, to copy just that value; right-click a message to copy it or rewind the conversation and captured workspace changes to that point.
The command center sorts saved sessions by most recent activity and shows their creation and last-updated times. Mitsu can name a new session from the opening request; you can rename it at any time.
I’ll admit I didn’t have much creativity when I first came up with Mitsu’s face. I’d recently watched WorldEnd, so I chose a chibi Chtholly as her main companion. Mitsu also comes with other companions already installed; switch between them anytime with /pet during a session or from the command center.
Change Mitsu’s color palette from the command center or mid-session with /theme; several themes are already included.
Future TODO: I’ll add an installer for custom pets from Codex directories or similar sources, and expand the options for customizing color palettes and Mitsu’s appearance.
Type / in the session input to browse available commands. Open the list below for a quick reference.
Mitsu follows the XDG directories when configured. Otherwise:
Session files and credentials stay on the local machine unless you send their contents to a configured model provider or external tool. A provider request may include conversation history, the current Intel context, tool results, and attachments needed for the task.
To use alternate locations, set XDG_CONFIG_HOME or XDG_DATA_HOME before starting Mitsu.
Provider credentials are written with owner-only file permissions. This protects them from other local users when the filesystem honors Unix permissions; it does not encrypt them or replace a secrets manager.
mitsu/
├── agents/ Agent loop, context, and tool dispatch
├── armory/ Red Team Armory catalog
├── assets/pets/ Bundled companion artwork
├── config/ Providers, preferences, and session storage
├── pets/ Companion catalog and metadata
├── providers/ Model APIs, streaming, and image input
├── search/ Web and vulnerability research
├── services/ Host integrations and tool installers
├── tools/ Built-in, Armory, and custom MCP tools
├── tui/ Terminal UI, chat, dialogs, and widgets
└── workspace/ Session Intel and workspace history
Mitsu is a tool; the person operating her is responsible for every target, command, and result. Use her only where you have explicit permission and keep all activity within the agreed scope. The project’s maintainers are not responsible for unauthorized use or damage caused by misuse.
Good places to use Mitsu
Do not use Mitsu to
Mitsu may handle sensitive assessment data. Before sending prompts, Intel, tool output, credentials, or images, check the privacy and retention terms of the model provider you selected. Privacy protections and data handling vary by provider and account settings; Mitsu cannot guarantee what a third-party service does with submitted data. Also review the terms of any search service or external MCP server you connect. Check tool output and verify evidence before reporting findings. If permission or scope is unclear, pause and ask first.
MIT License
Copyright (c) 2026 ARCANGEL0
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Hack the world. Byte by Byte. ⛛ 𝝺𝗿𝗰𝗮𝗻𝗴𝗲𝗹𝗼 @ 2026
Use Mitsu only with authorization and within the agreed scope.
Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > explo
Обзор
Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > exploitation, and post-exploitation, armored with 165+ MCP-connected tools and live session intel. Guide every step or let her pwn autonomously. ( ◠‿◠)
Инструменты
Списка инструментов пока нет. У удалённых серверов он появляется после первой проверки состояния.
FAQ
Скопируйте на этой странице конфигурацию stdio для Cursor, Claude Desktop, Claude Code или VS Code. Она использует установку издателя, а не прокси PlugMCP.
В этой записи не указано обязательных переменных окружения.
Mitsu работает локально через stdio.
Последняя проверка: 2026-11-14. Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > exploitation, and post-exploitation, armored with 165+ MCP-connected tools and live session intel. Guide every step or let her pwn autonomously. ( ◠‿◠)
