_{Renaissance masquerade. Sit in the agent's seat.}

masq

Sit in the agent's seat.

A CLI that speaks MCP and OpenAI-compat the way the model does, then reports like linpeas. Findings plus remediations. No exploit payloads. No CoT decrypt.

Why this exists

Static MCP scanners (Invariant mcp-scan, mcp-security-scan) lint schemas and configs. Health doctors ping initialize. The hole is the seat:

1. Encrypted reasoning blobs are echoed to the client and stored in session logs. They are portable across sessions, users, and weaker sibling models (arXiv:2608.09867). Scraping 315k public blobs recovered 182 credentials. masq detects those blobs. It does not decode them.
2. A large share of public MCP servers have no auth. If you can initialize, you are the agent.
3. Local model ports (:11434, :8000) often bind 0.0.0.0 with no bearer.

Wheels we ride, not rewrite: existing catalog detectors + pin/check, netstat, ureq GET-only, OWASP MCP Top 10 as the finding taxonomy. We did not clone mcp-scan or mcp-security-scan.

Install

git clone https://gitlab.com/WattoCyber/masq.git
cd masq
cargo install --path .
# binary: masq
cargo test
# expect: exit 0

World suite (binary against fixtures, local mocks, this-host recon):

python scripts/world_suite.py
# field = ~/.grok/sessions  lab = allowlisted hosts  bench = frozen-corpus wall
python scripts/world_suite.py --lanes all

Kali-style remote box, from the desktop:

MASQ_REMOTE_HOST=user@host bash scripts/deploy_kali.sh
# on the box:
~/.local/bin/masq --plain
MASQ_LAB_HOSTS=... ~/.local/bin/masq --lab --plain

Happy path

masq                         # live stream + posture report (includes skills)
masq --lab                   # same, plus allowlisted homelab hosts
masq tui                     # boxed TUI, stays until Ctrl+C
masq --plain                 # report only, no live stream
masq --json                  # machine report
masq recon                   # same dump, recon only
masq sniff ~/.grok/sessions  # CoT / secrets in session logs
masq sniff --timeline PATH   # file-order blob/secret/reason lines (no decrypt)
masq api                     # GET /v1/models on local (and --lab) ports
masq sit --url http://127.0.0.1:4443/mcp
masq chameleon --url http://127.0.0.1:4443/mcp -o /tmp/chameleon
masq chameleon --url ws://127.0.0.1:9000/mcp -o /tmp/chameleon
masq chameleon --url unix:///tmp/mcp.sock -o /tmp/chameleon
masq chameleon --token-file ~/.secrets/mcp.txt --url http://127.0.0.1:9/mcp -o /tmp/chameleon
masq chameleon -- python -m their_mcp -o /tmp/chameleon
# then: npx -y @copilotkit/aimock --config /tmp/chameleon/aimock.json
masq discover                # find VS Code / Cursor / Claude / Grok / Hermes MCP configs
masq proxy --upstream http://127.0.0.1:4443/mcp --block
masq sast ./server           # local sinks (semgrep if present)
masq classify --url http://127.0.0.1:4443/mcp --lab
masq overnight --lab --hours 6
masq map --from reports/overnight-YYYYMMDD/latest.json

# catalog
masq fixtures/t3_line_jump.json
masq fixtures/clean_calculator.json --trusted
masq pin fixtures/clean_calculator.json -k calc
masq check fixtures/clean_calculator.json -k calc
masq detectors

Exit: 0 clean · 2 findings ≥ --fail-on (default high) · 1 error.

TUI is opt-in (masq tui or --tui). Default on a tty is a linpeas live stream, then the report. Cron uses --plain / --no-color.

Commands

Aliases: doctor / audit → scan. chameleon → mimic. posture → seat.

Modules vs OWASP MCP Top 10

Transports and auth

sit / chameleon speak:

• Streamable HTTP (http://)
• HTTP+SSE (GET endpoint event, then POST)
• ws://
• unix: and npipe:
• stdio (--framing auto tries NDJSON then Content-Length)

Auth (never dumped to the report):

• --token-file PATH (first line becomes Authorization: Bearer …)
• --token-env VAR
• --header "Name: value" (repeatable)

wss:// is not built in. Stunnel to ws:// or use HTTP. HTTP follows zero redirects.

Stdio initialize does not advertise sampling. Flag server sampling / elicitation. Docs URLs (model-catalog.json, /docs/) are ignored on purpose.

Hosts masq discovers

Config + skill roots under $HOME / %USERPROFILE%:

VS Code, Cursor, Windsurf, Claude Desktop, Claude Code, Grok, Hermes, Codex, Continue, Gemini CLI, Amp, Kiro, OpenCode, Amazon Q, Antigravity, OpenClaw.

Plus cwd .mcp.json and MASQ_EXTRA_CONFIG (OS path list).

Lab allowlist (--lab)

--lab is an allowlist, not a /24 scan. It is operator-configured. Nothing is compiled in beyond loopback.

• MASQ_LAB_HOSTS env var: comma-, space-, or newline-separated host:port or hosts.
• .masq/lab-hosts file: one host per line, # comments.

Example:

export MASQ_LAB_HOSTS="192.0.2.10,192.0.2.11"
masq --lab

MASQ_LAB_HOSTS is read for API probes and the TUI fleet rollup. MASQ_SIT_URLS (or a --mcp-url) supplies MCP URLs to sit on with --lab.

Off-loopback sit --url needs --lab and an allowlisted host. Loopback unauth initialize is High. Off-box is Critical.

Do not point proxy at a host you would not sit.

Hard limits

Sniff priority: chat_history.jsonl first, then Hermes request_dump_*, then other jsonl. Walk finishes. It does not keep the first 300 WalkDir hits. Point masq sniff <one-session-dir> to go deeper.

Overnight

masq overnight --lab --hours 6 --interval-mins 20
# writes <cwd>/reports/overnight-YYYYMMDD/{latest.json,latest.md,latest.txt,delta.txt}

Does not mutate configs. Does not tools/call the live server. delta.txt is baseline / no_change / CHANGE plus + severity title and - severity title.

classify --llm and the TUI triage add-on are the only completions POSTs (Grok /v1/chat/completions, operator confirm). No key: local remediations only. Key from XAI_API_KEY or ~/.secrets/xai.txt. Never dumped.

Architecture

CLI (clap)  masq
  → seat | recon | sniff | api | sit | chameleon
  → discover | proxy | sast | classify | overnight | map
  → scan | multi | pin | check | detectors | tui
  → client (HTTP / SSE / ws / unix / npipe / stdio)
  → normalize (full-schema walk, caps)
  → detectors + sniff + recon + sit findings
  → report (text / JSON / Markdown) + optional TUI

Library crate: masq (scan_from_tools_list, scan_stdio, run_seat, PostureReport).

Honest scope

Do not dump ~/.secrets. Recon counts files. Path + "loaded".

Offline tests

cargo test
cargo clippy --all-targets -- -D warnings

Expect exit 0.

Fixtures: T1 description poison, T3 line-jump, T6 param names, T8 ANSI, T13 duplicate names, pin rugpull, multi-list, live NDJSON mock under tests/mock_mcp_server.py.

Secrets stay out of git (reports/, data/, .env, *.key, secrets/, .masq/).

License

MIT. Copyright 2026 SamsonCyber.