Hashcat through Pentest MCP

runHashcat is a local, always-logged credential assessment tool for an active engagement. Use it only for password material the engagement owner has authorized for offline testing. Tool availability is not permission to crack hashes.

Execution boundary

• The call requires engagementId and a saved engagement that is active in its authorization period.
• Hashcat is available only over local stdio. Authenticated HTTP clients cannot start it.
• A managed assessment worker may call it only when runHashcat appears in the plan's exact allowedToolNames and the plan explicitly authorizes the credential method.
• Managed workers may read wordlists and rules only from their private, server-created wordlist directory. Symlinks and path escapes are rejected.
• Managed workers cannot use sessions, restore, loopback, masks, or custom charsets because those paths and side effects are not yet fully contained.
• Caller-selected potfiles, output files, and raw Hashcat options are rejected. The server creates a private temporary run directory and removes it after the run.
• Command time, output size, and the engagement deadline bound execution. Cancellation and failure are recorded.

Evidence and secret handling

The MCP response reports the cracked count and the evidence recordId. It does not return cracked plaintext. The private evidence record contains counts, byte lengths, and SHA-256 digests of Hashcat output and the temporary potfile; it does not retain plaintext credentials. Report drafts receive this count-only metadata.

A cracked count is an observation about the supplied test material. It does not establish where a credential is accepted, whether it is current, whether another account reuses it, or whether online authentication is vulnerable.

Runtime readiness

Call getRuntimeStatus before selecting Hashcat; it reports binary availability and the detected version, but cannot establish usable devices. Check hashcat -I on the machine that will execute the assessment. The wrapper requires a detected Hashcat 8.0.0 or newer for PCFG (attackMode: "4"), hash recipes (hashType: "4000"), and FPGA bcrypt (hashType: "75000"). The Dockerfile builds and installs the signed Hashcat 8.0.0 source release with its PCFG data and a CPU OpenCL runtime. Native hosts need their own v8 installation, and the default Docker profile does not pass through GPU or FPGA hardware. A missing binary, older version, unavailable device, exhausted runtime, or failed command is incomplete coverage and must not be reported as zero cracked credentials.

The Hashcat 8.0.0 release introduces PCFG attacks, hash recipes, and Linux FPGA bcrypt support. Its upgrade notes also change restore behavior and exit codes; this MCP tool continues to prohibit caller-selected sessions and raw options in managed runs. FPGA support requires a compatible board and bridge installation on the execution host. Selecting hashType: "75000" or a device ID does not install or verify that hardware.

Main inputs

Field	Purpose
engagementId	Existing authorized engagement
hashData	Authorized hashes, one per line
hashType	Numeric Hashcat mode such as 0, 1000, or 22000; Hashcat 8 adds 4000 for recipes and 75000 for FPGA bcrypt
attackMode	0, 1, 3, 4 (PCFG), 6, or 7; mode 4 uses Hashcat 8's bundled default ruleset and needs no wordlist
hashRecipe	Hashcat 8 expression used only with hashType: "4000"; the operator must verify the scheme and input hash format
wordlist	Approved private wordlist path for dictionary and hybrid modes
rules	Approved private rule file
mask	Brute-force mask; unavailable to managed workers
runtime	Additional Hashcat runtime limit within the server and engagement deadlines
workloadProfile	Compatibility field; Hashcat 8 accepts -w but ignores it
deviceTypes	OpenCL classes 1 CPU and 2 GPU, passed to -D; supply both to select both classes. This does not select FPGA bridge units
backendDevices	OpenCL/backend device IDs from the current host's hashcat -I, passed to -d; bridge units are selected by hash mode, not by this field

The MCP JSON Schema is authoritative. Fields retained for compatibility can still be rejected by the execution policy.

Controlled example

Create or select a private wordlist through generateWordlist, then pass its returned path only when the assessment plan permits offline cracking:

{
  "engagementId": "client-2026-10",
  "hashData": "<authorized test hash>",
  "hashType": "1000",
  "attackMode": "0",
  "wordlist": "/private/worker/data/wordlists/<owner>/wordlist-<id>.txt",
  "runtime": 300
}

The path is illustrative. Use the exact private path returned by the current server; do not invent or copy a system wordlist path into a managed run.

On a verified Hashcat 8 host, change attackMode to "4" and omit wordlist to use the bundled PCFG grammar. To test a custom hash scheme, supply hashType: "4000" and a reviewed hashRecipe such as "md5(md5(salt) . pass)" with a matching authorized hash input and wordlist. The wrapper does not expose custom PCFG rulesets, feed plugins, tables, or wordlists embedded in masks; use an operator-reviewed method outside this tool when those are required.

Report treatment

Report the authorization boundary, hash source and format, selected method, runtime, device limitation, cracked count, record ID, output digest, and any cancellation or error. Keep recovered values in the client's approved secret-handling channel outside the report. Analyst verification is required before converting the observation into a finding or recommendation.