Menu
Caido proxy integration for HTTP history search, request replay, fuzzing results, sitemap, and security findings via MCP. Use when you need to search proxy traffic, replay requests with modifications, triage fuzzing results, or document findings in Caido.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
| name | caido-proxy |
| description | Caido proxy integration for HTTP history search, request replay, fuzzing results, sitemap, and security findings via MCP. Use when you need to search proxy traffic, replay requests with modifications, triage fuzzing results, or document findings in Caido. |
MCP integration with Caido proxy. Results load into context -- keep queries focused.
If
python3 -c "import caido_sdk_client"succeeds in the current runtime, prefer thecaido-sdkskill instead — direct SDK calls avoid per-tool MCP round-trips and are more efficient. Use this MCP path when the SDK is not importable (its usual state outside the MCP's own env) or Caido is unreachable.
req.host.eq:"example.com" # Exact host match
req.host.cont:"example" # Contains
req.path.cont:"/api/" # Path contains
req.method.eq:"POST" # Exact method
resp.code.eq:200 # Status code
resp.code.gte:400 # Greater than or equal
# Combinators
req.host.eq:"a.com" AND req.method.eq:"POST"
NOT req.path.cont:"/health"
# Security queries
req.header["authorization"].cont:"Bearer"
req.body.cont:"password"
resp.code.gte:500
mcp__caido__list_requests -- search proxy history with HTTPQL
httpql: filter stringlimit: max results (default 20, max 100)mcp__caido__get_request -- full request/response
ids: request ID arrayinclude: ["requestHeaders", "requestBody", "responseHeaders", "responseBody"]mcp__caido__send_request -- send raw HTTP request
raw: full HTTP request texthost: target hostport: target port (default 443)tls: use HTTPS (default true)mcp__caido__list_automate_sessions -- list fuzzing sessions
mcp__caido__get_automate_session -- session details
mcp__caido__get_automate_entry -- fuzzing results with pagination
mcp__caido__create_finding -- document a security finding
requestId: associated request IDtitle: finding titledescription: detailed description1. Search: mcp__caido__list_requests(httpql: 'req.path.cont:"/api/" AND req.method.eq:"GET"', limit: 50)
2. Inspect: mcp__caido__get_request(ids: ["<id>"], include: ["requestHeaders","requestBody","responseHeaders","responseBody"])
3. Replay with modified ID: mcp__caido__send_request(raw: "<modified request>", host: "target.com")
4. Document: mcp__caido__create_finding(requestId: "<id>", title: "IDOR in /api/users/{id}")
1. mcp__caido__list_automate_sessions()
2. mcp__caido__get_automate_session(id: "<session_id>")
3. mcp__caido__get_automate_entry(id: "<entry_id>", limit: 20)
Compare response sizes/codes for anomalies
| Error | Fix |
|---|---|
Invalid token | Run caido-mcp-server login |
Connection refused | Start Caido desktop app |
No such tool | Check capability MCP config |
lsof -i :8080 # Caido running?
which caido-mcp-server # Binary exists?
cat ~/.config/caido-mcp-server/token # Authenticated?