# Cobalt Strike MCP Server MCP server

Agent View of the PolicyLayer registry record for Cobalt Strike MCP Server: identity, probed posture, risk grade, and all 220 tools classified. HTML page: https://policylayer.com/tools/mickeydb-cobalt-strike-mcp

## Facts

- Server id: `mickeydb/cobalt-strike-mcp`
- Homepage: https://github.com/MickeyDB/Cobalt-Strike-MCP
- Registry record: grade F, identity unverified
- Lifecycle: active
- Rate-limited: no
- Tools: 220
- Tool categories present: Destructive, Execute, Read, Write
- Tags: mickeydb cobalt strike mcp, admin, automation
- Record last modified: 2026-08-15T22:35:50.450Z

## Tools (220)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `beacon_delete_file` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-delete-file.md |
| `clear_beacon_command_queue` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/clear-beacon-command-queue.md |
| `delete_credential` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-credential.md |
| `delete_listener` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener.md |
| `delete_listener_dns` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-dns.md |
| `delete_listener_externalC2` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-externalc2.md |
| `delete_listener_foreignHttp` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-foreignhttp.md |
| `delete_listener_foreignHttps` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-foreignhttps.md |
| `delete_listener_http` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-http.md |
| `delete_listener_https` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-https.md |
| `delete_listener_smb` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-smb.md |
| `delete_listener_tcp` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-tcp.md |
| `delete_listener_userDefinedC2` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/delete-listener-userdefinedc2.md |
| `execute_kerberos_ticket_purge` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-kerberos-ticket-purge.md |
| `execute_socks_stop_all` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks-stop-all.md |
| `execute_tokenStore_remove` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-remove.md |
| `execute_tokenStore_removeAll` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-removeall.md |
| `kill_beacon` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/kill-beacon.md |
| `reset_data` | Destructive | Critical | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/reset-data.md |
| `beacon_change_directory` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-change-directory.md |
| `beacon_copy_file` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-copy-file.md |
| `create_listener` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener.md |
| `create_listener_dns` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-dns.md |
| `create_listener_externalC2` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-externalc2.md |
| `create_listener_foreignHttp` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-foreignhttp.md |
| `create_listener_foreignHttps` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-foreignhttps.md |
| `create_listener_http` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-http.md |
| `create_listener_https` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-https.md |
| `create_listener_smb` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-smb.md |
| `create_listener_tcp` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-tcp.md |
| `create_listener_userDefinedC2` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-listener-userdefinedc2.md |
| `elevate_beacon` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/elevate-beacon.md |
| `elevate_command` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/elevate-command.md |
| `execute_beacon_command` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-beacon-command.md |
| `execute_bof` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-bof.md |
| `execute_bof_pack` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-bof-pack.md |
| `execute_bof_packed` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-bof-packed.md |
| `execute_browserpivot_stop` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-browserpivot-stop.md |
| `execute_cancel_file_download` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-cancel-file-download.md |
| `execute_checkin` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-checkin.md |
| `execute_exit` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-exit.md |
| `execute_get_system` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-get-system.md |
| `execute_get_uid` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-get-uid.md |
| `execute_job_stop` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-job-stop.md |
| `execute_kerberos_ticket_use` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-kerberos-ticket-use.md |
| `execute_kill_process` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-kill-process.md |
| `execute_link_smb` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-link-smb.md |
| `execute_link_tcp` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-link-tcp.md |
| `execute_make_token` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-make-token.md |
| `execute_make_token_upn` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-make-token-upn.md |
| `execute_net_domain` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-net-domain.md |
| `execute_powershell_import` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-powershell-import.md |
| `execute_rev2self` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-rev2self.md |
| `execute_rportfwd_start` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-rportfwd-start.md |
| `execute_rportfwd_stop` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-rportfwd-stop.md |
| `execute_setenv` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-setenv.md |
| `execute_socks_stop` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks-stop.md |
| `execute_socks_stop_port` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks-stop-port.md |
| `execute_socks4_start` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks4-start.md |
| `execute_socks5_start` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-socks5-start.md |
| `execute_steal_token` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-steal-token.md |
| `execute_timestomp` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-timestomp.md |
| `execute_tokenStore_steal` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-steal.md |
| `execute_tokenStore_stealAndUse` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-stealanduse.md |
| `execute_tokenStore_use` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-tokenstore-use.md |
| `execute_unlink` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-unlink.md |
| `generate_stageless_payload` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/generate-stageless-payload.md |
| `generate_stager_payload` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/generate-stager-payload.md |
| `inject_beacon` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-beacon.md |
| `inject_browserpivotStart` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-browserpivotstart.md |
| `inject_dll` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-dll.md |
| `inject_hashdump` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-hashdump.md |
| `inject_keylogger` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-keylogger.md |
| `inject_loadDll` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-loaddll.md |
| `inject_mimikatz` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-mimikatz.md |
| `inject_net_view` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-view.md |
| `inject_portscan` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-portscan.md |
| `inject_postExDll` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-postexdll.md |
| `inject_powershell_unmanaged` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-powershell-unmanaged.md |
| `inject_printscreen` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-printscreen.md |
| `inject_pth` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-pth.md |
| `inject_screenshot` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-screenshot.md |
| `inject_screenwatch` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-screenwatch.md |
| `inject_shellcode` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-shellcode.md |
| `inject_ssh` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-ssh.md |
| `inject_sshKey` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-sshkey.md |
| `remoteExec_beacon` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/remoteexec-beacon.md |
| `remoteExec_command` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/remoteexec-command.md |
| `set_beacon_beacon_gate` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-beacon-gate.md |
| `set_beacon_block_dlls` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-block-dlls.md |
| `set_beacon_c2_host_hold` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-c2-host-hold.md |
| `set_beacon_c2_host_release` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-c2-host-release.md |
| `set_beacon_dns_mode` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-dns-mode.md |
| `set_beacon_ppid` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-ppid.md |
| `set_beacon_sleep` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-sleep.md |
| `set_beacon_spawnto` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-spawnto.md |
| `set_beacon_spoofed_arguments` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-spoofed-arguments.md |
| `set_beacon_syscall_method` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-syscall-method.md |
| `spawn_beacon` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-beacon.md |
| `spawn_beacon_asUser` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-beacon-asuser.md |
| `spawn_beacon_under` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-beacon-under.md |
| `spawn_chromedump` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-chromedump.md |
| `spawn_command` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-command.md |
| `spawn_command_runAs` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-command-runas.md |
| `spawn_command_runNoOutput` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-command-runnooutput.md |
| `spawn_command_runUnder` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-command-rununder.md |
| `spawn_dcsync` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-dcsync.md |
| `spawn_dotnetAssembly` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-dotnetassembly.md |
| `spawn_hashdump` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-hashdump.md |
| `spawn_keylogger` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-keylogger.md |
| `spawn_mimikatz` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-mimikatz.md |
| `spawn_net_computers` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-computers.md |
| `spawn_net_domainTrusts` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-domaintrusts.md |
| `spawn_net_group` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-group.md |
| `spawn_net_sessions` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-sessions.md |
| `spawn_net_share` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-share.md |
| `spawn_net_time` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-time.md |
| `spawn_net_user` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-user.md |
| `spawn_net_user_detail` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-user-detail.md |
| `spawn_net_view` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-view.md |
| `spawn_portscan` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-portscan.md |
| `spawn_postExDll` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-postexdll.md |
| `spawn_powershell` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-powershell.md |
| `spawn_powershell_unmanaged` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-powershell-unmanaged.md |
| `spawn_printscreen` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-printscreen.md |
| `spawn_pth` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-pth.md |
| `spawn_screenshot` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-screenshot.md |
| `spawn_screenwatch` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-screenwatch.md |
| `spawn_shell` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-shell.md |
| `spawn_shellcode` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-shellcode.md |
| `spawn_ssh` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-ssh.md |
| `spawn_sshKey` | Execute | High | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-sshkey.md |
| `beacon_download_file` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-download-file.md |
| `beacon_get_current_directory` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-get-current-directory.md |
| `beacon_list_directory` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-list-directory.md |
| `beacon_list_drives` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-list-drives.md |
| `download_payload` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/download-payload.md |
| `execute_beacon_info` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-beacon-info.md |
| `execute_clipboard` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-clipboard.md |
| `execute_get_privs` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-get-privs.md |
| `execute_reg_query` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-reg-query.md |
| `execute_reg_queryv` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/execute-reg-queryv.md |
| `get_artifacts` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-artifacts.md |
| `get_beacon` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon.md |
| `get_beacon_active_downloads` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-active-downloads.md |
| `get_beacon_c2_host_profiles` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-c2-host-profiles.md |
| `get_beacon_command_help` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-command-help.md |
| `get_beacon_help` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-help.md |
| `get_beacon_jobs` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-jobs.md |
| `get_beacon_keystrokes` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-keystrokes.md |
| `get_beacon_output` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-output.md |
| `get_beacon_task` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-task.md |
| `get_beacon_tasks_detail` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-tasks-detail.md |
| `get_beacon_tasks_summary` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-tasks-summary.md |
| `get_beacon_tokenStore` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-beacon-tokenstore.md |
| `get_credential` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-credential.md |
| `get_download` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-download.md |
| `get_keystrokes` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-keystrokes.md |
| `get_killdate` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-killdate.md |
| `get_listener` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener.md |
| `get_listener_dns` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-dns.md |
| `get_listener_externalC2` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-externalc2.md |
| `get_listener_foreignHttp` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-foreignhttp.md |
| `get_listener_foreignHttps` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-foreignhttps.md |
| `get_listener_http` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-http.md |
| `get_listener_https` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-https.md |
| `get_listener_smb` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-smb.md |
| `get_listener_tcp` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-tcp.md |
| `get_listener_userDefinedC2` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-listener-userdefinedc2.md |
| `get_profile` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-profile.md |
| `get_screenshot` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-screenshot.md |
| `get_system_information` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-system-information.md |
| `get_task` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-task.md |
| `get_task_error` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-task-error.md |
| `get_task_log` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-task-log.md |
| `get_teamserver_info` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-teamserver-info.md |
| `get_teamserver_ip` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/get-teamserver-ip.md |
| `inject_chromedump` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-chromedump.md |
| `inject_dcsync` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-dcsync.md |
| `inject_logonPasswords` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-logonpasswords.md |
| `inject_net_computers` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-computers.md |
| `inject_net_dclist` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-dclist.md |
| `inject_net_domain_controllers` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-domain-controllers.md |
| `inject_net_domainTrusts` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-domaintrusts.md |
| `inject_net_groups` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-groups.md |
| `inject_net_localGroup` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-localgroup.md |
| `inject_net_logons` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-logons.md |
| `inject_net_sessions` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-sessions.md |
| `inject_net_shares` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-shares.md |
| `inject_net_time` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-time.md |
| `inject_net_user_detail` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-user-detail.md |
| `inject_net_users` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/inject-net-users.md |
| `list_beacons` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-beacons.md |
| `list_credentials` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-credentials.md |
| `list_downloads` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-downloads.md |
| `list_keystrokes` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-keystrokes.md |
| `list_listeners` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-listeners.md |
| `list_screenshots` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-screenshots.md |
| `list_tasks` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/list-tasks.md |
| `spawn_logon_passwords` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-logon-passwords.md |
| `spawn_net_dclist` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-dclist.md |
| `spawn_net_domainControllers` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-domaincontrollers.md |
| `spawn_net_localGroup` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-localgroup.md |
| `spawn_net_logons` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-net-logons.md |
| `spawn_process_list` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/spawn-process-list.md |
| `test_connection` | Read | Low | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/test-connection.md |
| `beacon_create_directory` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-create-directory.md |
| `beacon_move_file` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-move-file.md |
| `beacon_upload_file` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/beacon-upload-file.md |
| `create_credential` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/create-credential.md |
| `note_beacon` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/note-beacon.md |
| `set_beacon_c2_failover_notification` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-c2-failover-notification.md |
| `set_beacon_c2_host` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-c2-host.md |
| `set_beacon_c2_host_reset` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-beacon-c2-host-reset.md |
| `set_killdate` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-killdate.md |
| `set_teamserver_ip` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/set-teamserver-ip.md |
| `update_listener_dns` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/update-listener-dns.md |
| `update_listener_http` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/update-listener-http.md |
| `update_listener_https` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/update-listener-https.md |
| `update_profile` | Write | Medium | https://policylayer.com/tools/mickeydb-cobalt-strike-mcp/update-profile.md |

## Tool descriptions

- `beacon_delete_file` — Delete a file or directory on a beacon
- `clear_beacon_command_queue` — Clear the command queue for a beacon
- `delete_credential` — Delete a credential from the teamserver
- `delete_listener` — Delete/remove a listener from the teamserver
- `delete_listener_dns` — Delete a DNS listener
- `delete_listener_externalC2` — Delete an ExternalC2 listener
- `delete_listener_foreignHttp` — Delete a Foreign HTTP listener
- `delete_listener_foreignHttps` — Delete a Foreign HTTPS listener
- `delete_listener_http` — Delete an HTTP listener
- `delete_listener_https` — Delete an HTTPS listener
- `delete_listener_smb` — Delete an SMB listener
- `delete_listener_tcp` — Delete a TCP listener
- `delete_listener_userDefinedC2` — Delete a User-Defined C2 listener
- `execute_kerberos_ticket_purge` — Purge Kerberos tickets
- `execute_socks_stop_all` — Stop all SOCKS proxies
- `execute_tokenStore_remove` — Remove a token from the token store
- `execute_tokenStore_removeAll` — Remove all tokens from the token store
- `kill_beacon` — Kill/remove a beacon from the teamserver
- `reset_data` — Reset teamserver data
- `beacon_change_directory` — Change current directory on a beacon
- `beacon_copy_file` — Copy a file on a beacon
- `create_listener` — Create a new listener (HTTP, HTTPS, DNS, SMB, etc.)
- `create_listener_dns` — Create a DNS listener
- `create_listener_externalC2` — Create an ExternalC2 listener
- `create_listener_foreignHttp` — Create a Foreign HTTP listener
- `create_listener_foreignHttps` — Create a Foreign HTTPS listener
- `create_listener_http` — Create an HTTP listener
- `create_listener_https` — Create an HTTPS listener
- `create_listener_smb` — Create an SMB listener
- `create_listener_tcp` — Create a TCP listener
- `create_listener_userDefinedC2` — Create a User-Defined C2 listener
- `elevate_beacon` — Elevate to a new beacon with higher privileges
- `elevate_command` — Elevate a command with higher privileges
- `execute_beacon_command` — Execute a command on a beacon (e.g.,
- `execute_bof` — Execute a BOF (Beacon Object File) on a beacon. Common BOFs: @artifacts/BOFs/whoami.x64.o, @artifacts/BOFs/whoami.x86.o
- `execute_bof_pack` — Execute a BOF with packing
- `execute_bof_packed` — Execute a packed BOF
- `execute_browserpivot_stop` — Stop browser pivot
- `execute_cancel_file_download` — Cancel file download
- `execute_checkin` — Force beacon to check in immediately
- `execute_exit` — Exit the beacon
- `execute_get_system` — Get SYSTEM privileges
- `execute_get_uid` — Get user ID
- `execute_job_stop` — Stop a job
- `execute_kerberos_ticket_use` — Use a Kerberos ticket
- `execute_kill_process` — Kill a process by PID
- `execute_link_smb` — Link to SMB beacon
- `execute_link_tcp` — Link to TCP beacon
- `execute_make_token` — Make a token using logon credentials
- `execute_make_token_upn` — Make a token using UPN (User Principal Name)
- `execute_net_domain` — Get domain information
- `execute_powershell_import` — Import PowerShell module
- `execute_rev2self` — Revert to self (drop impersonated token)
- `execute_rportfwd_start` — Start reverse port forward
- `execute_rportfwd_stop` — Stop reverse port forward
- `execute_setenv` — Set an environment variable
- `execute_socks_stop` — Stop SOCKS proxy
- `execute_socks_stop_port` — Stop SOCKS proxy on specific port
- `execute_socks4_start` — Start SOCKS4 proxy
- `execute_socks5_start` — Start SOCKS5 proxy
- `execute_steal_token` — Steal a token from a process
- `execute_timestomp` — Modify file timestamps
- `execute_tokenStore_steal` — Steal a token and add it to the token store
- `execute_tokenStore_stealAndUse` — Steal a token and immediately use it
- `execute_tokenStore_use` — Use a token from the token store
- `execute_unlink` — Unlink from beacon
- `generate_stageless_payload` — Generate a stageless payload for a listener
- `generate_stager_payload` — Generate a stager payload for a listener
- `inject_beacon` — Inject beacon into a process
- `inject_browserpivotStart` — Start browser pivot
- `inject_dll` — Inject a DLL into a process
- `inject_hashdump` — Dump password hashes (inject mode)
- `inject_keylogger` — Start keylogger on a process
- `inject_loadDll` — Load DLL
- `inject_mimikatz` — Run Mimikatz (inject mode)
- `inject_net_view` — View network resources
- `inject_portscan` — Perform port scan
- `inject_postExDll` — Load post-exploitation DLL
- `inject_powershell_unmanaged` — Execute unmanaged PowerShell
- `inject_printscreen` — Print screen (inject mode)
- `inject_pth` — Pass-the-hash attack
- `inject_screenshot` — Take screenshot (inject mode)
- `inject_screenwatch` — Start screen watch (inject mode)
- `inject_shellcode` — Inject shellcode into a process
- `inject_ssh` — Inject SSH session
- `inject_sshKey` — Inject SSH session with key
- `remoteExec_beacon` — Remotely execute a beacon on a target
- `remoteExec_command` — Remotely execute a command on a target
- `set_beacon_beacon_gate` — Enable or disable beacon gate
- `set_beacon_block_dlls` — Enable or disable block DLLs
- `set_beacon_c2_host_hold` — Hold C2 host (prevent failover)
- `set_beacon_c2_host_release` — Release C2 host (allow failover)
- `set_beacon_dns_mode` — Set DNS mode for beacon
- `set_beacon_ppid` — Set the parent process ID for a beacon
- `set_beacon_sleep` — Set the sleep time and jitter for a beacon
- `set_beacon_spawnto` — Set the spawn-to process for a beacon
- `set_beacon_spoofed_arguments` — Set spoofed arguments for beacon
- `set_beacon_syscall_method` — Set the system call method for a beacon
- `spawn_beacon` — Spawn a new beacon session on a target
- `spawn_beacon_asUser` — Spawn a beacon as a specific user
- `spawn_beacon_under` — Spawn a beacon under a specific process
- `spawn_chromedump` — Dump Chrome passwords (spawn mode)
- `spawn_command` — Execute a command on a beacon (spawns in new process)
- `spawn_command_runAs` — Run a command as a specific user
- `spawn_command_runNoOutput` — Run command without output
- `spawn_command_runUnder` — Run command under a process
- `spawn_dcsync` — Perform DCSync attack (spawn mode)
- `spawn_dotnetAssembly` — Execute .NET assembly
- `spawn_hashdump` — Dump password hashes from a beacon
- `spawn_keylogger` — Start keylogger (spawn mode)
- `spawn_mimikatz` — Run Mimikatz on a beacon
- `spawn_net_computers` — Enumerate computers (spawn mode)
- `spawn_net_domainTrusts` — Enumerate domain trusts (spawn mode)
- `spawn_net_group` — Enumerate groups (spawn mode)
- `spawn_net_sessions` — Enumerate sessions (spawn mode)
- `spawn_net_share` — Enumerate shares (spawn mode)
- `spawn_net_time` — Get time from target (spawn mode)
- `spawn_net_user` — Enumerate users (spawn mode)
- `spawn_net_user_detail` — Get user details (spawn mode)
- `spawn_net_view` — View network resources (spawn mode)
- `spawn_portscan` — Perform port scan (spawn mode)
- `spawn_postExDll` — Load post-exploitation DLL (spawn mode)
- `spawn_powershell` — Execute PowerShell command on a beacon
- `spawn_powershell_unmanaged` — Execute unmanaged PowerShell (spawn mode)
- `spawn_printscreen` — Print screen (spawn mode)
- `spawn_pth` — Pass-the-hash (spawn mode)
- `spawn_screenshot` — Take a screenshot on a beacon
- `spawn_screenwatch` — Start screen watch (spawn mode)
- `spawn_shell` — Execute a shell command on a beacon
- `spawn_shellcode` — Execute shellcode (spawn mode)
- `spawn_ssh` — Inject SSH session (spawn mode)
- `spawn_sshKey` — Inject SSH session with key (spawn mode)
- `beacon_download_file` — Download a file from a beacon
- `beacon_get_current_directory` — Get current working directory on a beacon
- `beacon_list_directory` — List directory contents on a beacon
- `beacon_list_drives` — List available drives on a beacon
- `download_payload` — Download a generated payload file
- `execute_beacon_info` — Get beacon information
- `execute_clipboard` — Get clipboard contents
- `execute_get_privs` — Get current privileges
- `execute_reg_query` — Query registry key
- `execute_reg_queryv` — Query registry value
- `get_artifacts` — List available artifacts (BOFs, etc.)
- `get_beacon` — Get detailed information about a specific beacon by ID
- `get_beacon_active_downloads` — Get active file downloads for a beacon
- `get_beacon_c2_host_profiles` — Get available C2 profiles for beacon
- `get_beacon_command_help` — Get help for a specific beacon command
- `get_beacon_help` — Get help for beacon commands
- `get_beacon_jobs` — Get jobs running on a beacon
- `get_beacon_keystrokes` — Get keystrokes for a beacon
- `get_beacon_output` — Get the output from a beacon (console output)
- `get_beacon_task` — Get the status and output of a specific beacon task
- `get_beacon_tasks_detail` — Get detailed task information for a specific beacon
- `get_beacon_tasks_summary` — Get task summary for a specific beacon
- `get_beacon_tokenStore` — Get token store state for beacon
- `get_credential` — Get detailed information about a specific credential by ID
- `get_download` — Get download information by ID
- `get_keystrokes` — Get keystroke data by ID
- `get_listener` — Get listener details by name (generic)
- `get_listener_dns` — Get DNS listener details
- `get_listener_externalC2` — Get ExternalC2 listener details
- `get_listener_foreignHttp` — Get Foreign HTTP listener details
- `get_listener_foreignHttps` — Get Foreign HTTPS listener details
- `get_listener_http` — Get HTTP listener details
- `get_listener_https` — Get HTTPS listener details
- `get_listener_smb` — Get SMB listener details
- `get_listener_tcp` — Get TCP listener details
- `get_listener_userDefinedC2` — Get User-Defined C2 listener details
- `get_profile` — Get current Malleable C2 profile
- `get_screenshot` — Get a specific screenshot by ID
- `get_system_information` — Get system information from teamserver
- `get_task` — Get detailed information about a specific task by ID
- `get_task_error` — Get error information for a specific task
- `get_task_log` — Get log information for a specific task
- `get_teamserver_info` — Get information about the Cobalt Strike teamserver (version, license, stats)
- `inject_chromedump` — Dump Chrome passwords
- `inject_dcsync` — Perform DCSync attack to extract domain credentials
- `inject_logonPasswords` — Dump logon passwords (inject mode)
- `inject_net_computers` — Enumerate computers in the domain
- `inject_net_dclist` — List domain controllers
- `inject_net_domain_controllers` — List domain controllers in the domain
- `inject_net_domainTrusts` — Enumerate domain trusts
- `inject_net_groups` — Enumerate groups in the domain
- `inject_net_localGroup` — Enumerate local groups
- `inject_net_logons` — Enumerate logged on users
- `inject_net_sessions` — Enumerate active sessions on a target
- `inject_net_shares` — Enumerate shares on a target
- `inject_net_time` — Get time from target
- `inject_net_user_detail` — Get detailed information about a specific user
- `inject_net_users` — Enumerate users in the domain
- `list_beacons` — List all active beacons in the Cobalt Strike teamserver
- `list_credentials` — List all stored credentials in the Cobalt Strike teamserver
- `list_downloads` — List all file downloads from beacons
- `list_keystrokes` — List all keystroke captures from beacons
- `list_listeners` — List all active listeners in the Cobalt Strike teamserver
- `list_screenshots` — List all screenshots captured from beacons
- `list_tasks` — List all tasks across all beacons or filter by beacon ID
- `spawn_logon_passwords` — Dump logon passwords using Mimikatz
- `spawn_net_dclist` — List domain controllers (spawn mode)
- `spawn_net_domainControllers` — List domain controllers (spawn mode)
- `spawn_net_localGroup` — Enumerate local groups (spawn mode)
- `spawn_net_logons` — Enumerate logged on users (spawn mode)
- `spawn_process_list` — List processes on a beacon
- `test_connection` — Test the connection to the Cobalt Strike REST API server
- `beacon_create_directory` — Create a directory on a beacon
- `beacon_move_file` — Move/rename a file on a beacon
- `beacon_upload_file` — Upload a file to a beacon
- `create_credential` — Create a new credential entry
- `note_beacon` — Add or update a note on a beacon
- `set_beacon_c2_failover_notification` — Enable or disable C2 failover notification
- `set_beacon_c2_host` — Set C2 host for beacon
- `set_beacon_c2_host_reset` — Reset C2 host
- `update_listener_dns` — Update a DNS listener
- `update_listener_http` — Update an HTTP listener
- `update_listener_https` — Update an HTTPS listener
- `update_profile` — Update Malleable C2 profile

## Related servers

- UnClick (1662 tools) — https://policylayer.com/tools/io-github-malamutemayhem-unclick-mcp-server.md
- Delx Protocol — Agent Recovery & Continuity (1076 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-protocol.md
- Delx Mcp A2a (1068 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-a2a.md
- Nodebench (824 tools) — https://policylayer.com/tools/io-github-homenshum-nodebench.md
- MCP Framework Personal (811 tools) — https://policylayer.com/tools/inggerman-mcps.md
- Delx MCP Server (740 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-server.md
- Binance MCP Server (734 tools) — https://policylayer.com/tools/nirholas-binance-mcp.md
- Eda Agent (726 tools) — https://policylayer.com/tools/eda-agent.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=mickeydb-cobalt-strike-mcp · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/mickeydb-cobalt-strike-mcp