// SCAN REPORT

John The Ripper

12 tools. 3 can modify or destroy data without limits.

3 write tools that can modify data. Rate limits recommended.

Last updated: 2 Jul 2026

3 can modify or destroy data

9 read-only

12 tools total

Community server · catalogue entry verified 02/07/2026

How to control John The Ripper ↓

TOOL MAP

What John The Ripper exposes to your agents

Read (9) Write / Execute (3) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous John The Ripper tools

Execute · High john_benchmark This tool triggers execution of John the Ripper benchmark operations on a remote system. Execute · High john_crack This tool executes code/external operations (John the Ripper binary) with arguments that determine behavior. Execute · High john_restore This tool resumes a password cracking operation on a remote Kali system via SSH.

3 of John The Ripper's 12 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control John The Ripper

PolicyLayer is an MCP gateway — it sits between your AI agents and John The Ripper, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "john_formats": {
    "limits": [
      {
        "counter": "john_formats_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register John The Ripper — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON JOHN THE RIPPER →

Instant setup, no code required.

FULL CATALOGUE

All 12 John The Ripper tools

EXECUTE 3 tools

Execute john_benchmark Run benchmarks to test cracking speed for different hash types Execute john_crack Start password cracking with John the Ripper. Supports various modes including wordlist, incremental, and sing Execute john_restore Restore and continue an interrupted cracking session

READ 9 tools

Read john_formats List all supported hash formats. Can filter by keyword. Read john_hash_extract Extract hashes from various file types using John\ Read john_identify Identify the hash type(s) for given hash values Read john_kill Kill a running John the Ripper process or session Read john_pot Manage the john.pot file containing cracked passwords Read john_rules List available mangling rules or test rules against words Read john_sessions List all active and saved John the Ripper sessions Read john_show Show cracked passwords from a hash file or pot file Read john_status Check the status of a cracking session

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about John The Ripper

Is the John The Ripper MCP server safe to use without restrictions? +

The John The Ripper server is primarily read-only with 9 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the John The Ripper MCP server expose? +

12 tools across 3 categories: Execute, Read, Write. 9 are read-only. 3 can modify, create, or delete data.

How do I enforce a policy on John The Ripper? +

Register the John The Ripper MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every John The Ripper tool call.

Deterministic rules across all 12 John The Ripper tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON JOHN THE RIPPER →

Instant setup, no code required.

12 John The Ripper tools catalogued and risk-classified — across an index of 43,000+ MCP servers.