Metadata-Version: 2.5
Name: wodbuster-mcp-bridge
Version: 0.1.1
Summary: Unofficial: connect MCP clients to a wodbuster-api server, logging in from environment variables
License-Expression: MIT
License-File: LICENSE
Keywords: claude,mcp,wodbuster
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: End Users/Desktop
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: anyio>=4.9
Requires-Dist: httpx2>=2.10
Requires-Dist: mcp<3,>=2.3
Requires-Dist: pydantic-settings>=2.7
Requires-Dist: pydantic>=2.7
Description-Content-Type: text/markdown

# wodbuster-mcp-bridge

> Unofficial. Not affiliated with or endorsed by WodBuster.

Connects an MCP client (Claude Desktop, Claude Code or any other) to the MCP endpoint of
a running wodbuster-api server. The client starts the bridge as a local
command and passes it the login parameters as environment variables, in its own
configuration:

```json
{
  "mcpServers": {
    "wodbuster": {
      "command": "uvx",
      "args": ["wodbuster-mcp-bridge"],
      "env": {
        "WODBUSTER_API_URL": "http://<host>:8080",
        "WODBUSTER_BOX": "<your-box>",
        "WODBUSTER_EMAIL": "<your-email>",
        "WODBUSTER_PASSWORD": "<your-password>",
        "WODBUSTER_REMEMBER_CREDENTIALS": "true",
        "WODBUSTER_LABEL": "claude-desktop"
      }
    }
  }
}
```

| Variable | Login field | Default |
|---|---|---|
| `WODBUSTER_API_URL` | (the server's base URL) | required |
| `WODBUSTER_BOX` | `box` | required |
| `WODBUSTER_EMAIL` | `email` | required |
| `WODBUSTER_PASSWORD` | `password` | required |
| `WODBUSTER_REMEMBER_CREDENTIALS` | `remember_credentials` | `false` |
| `WODBUSTER_LABEL` | `label` | `mcp-bridge` |

When it starts, the bridge works in three steps:

1. It logs in to the server once, with `POST /v1/auth/login`.
2. It relays every MCP message between the client (stdin and stdout) and `/mcp`.
3. It revokes its token when the client closes it.

Keep in mind:

- **Use `WODBUSTER_REMEMBER_CREDENTIALS=true`.** With it, the server answers later
  logins with the same password from its valid session, without logging in to
  WodBuster again. Several clients that start at once then cost no WodBuster login.
- **`false` deletes the stored credentials,** so the server's automations can no longer
  log in again by themselves.
- **The bridge first checks that the server has an MCP endpoint**, before logging in.
  A server that has not been updated yet answers 404 there; the bridge then exits with
  that reason instead of logging in for nothing.
- **A failed login is never retried.** A wrong password costs one of WodBuster's
  limited attempts. The bridge then exits, with the reason in the client's log.
- **`uvx` runs the bridge from its cache.** After the first run it does not download
  the bridge again. Pin a version (`wodbuster-mcp-bridge@0.1.1`) to control updates.
