FofaMap — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Monitor FofaMap's active MCP implementation, evolving runtime guardrails and publisher-disclosed credential-remediation guidance.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Evidence-driven FOFA reconnaissance with tightly gated active scanning

What we know

Security-research MCP/CLI/REST tool for FOFA reconnaissance, AI reflection and optional human-approved Nuclei scanning.

Maintenance / activity evidence

Observed Aug 16, 2026 (UTC)Update version README

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read-only FOFA by default; optional scans behind allowlists and one-time approval tokens. Writes: Approved Nuclei scans.
FOFA key; JWT for remote deployment.
Sensitive access: FOFA credentials, Security targets/results

Current safeguards are explicit, but reconnaissance and active scanning remain security-sensitive and must be authorized.
Historical credential exposure and the completeness of revocation, history cleanup, fork cleanup, and clone invalidation remain unresolved from the official sources fetched.
Historical credential exposure and remediation guidance remain disclosed risk evidence; no comprehensive security review or proof of remediation of every historical clone is claimed.
Keep historic credential-risk note attached to this identity
Historic credential-exposure concerns require current-version credential hygiene.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

732 repository stars

Stars observed Sep 25, 2026.

Preserve any already-reviewed adoption metrics in MCP100. Batch 4 did not refresh package downloads because the package-stats provider had insufficient credits.

All limitations / Review context

Have MCP runtime guardrails or publisher guidance for the historical credential incident changed?

Owner-reviewed supplemental finding: current security boundaries and historical credential exposure with remediation/rotation guidance justify public Radar tracking. The disclosed historical incident is retained as risk evidence and is not itself a material public-tracking blocker. This is not a security certification.

Current safeguards are explicit, but reconnaissance and active scanning remain security-sensitive and must be authorized.
Read-only FOFA by default; optional scans behind allowlists and one-time approval tokens.
FOFA key; JWT for remote deployment.
Asset/query data and scan results are processed locally/through FOFA and optional scanner.
Reviewed write actions: Approved Nuclei scans
Sensitive access: FOFA credentials, Security targets/results
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Historical credential exposure and the completeness of revocation, history cleanup, fork cleanup, and clone invalidation remain unresolved from the official sources fetched.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Historical credential exposure and remediation guidance remain disclosed risk evidence; no comprehensive security review or proof of remediation of every historical clone is claimed.
Keep historic credential-risk note attached to this identity
Active scanning is disabled by default and must remain target/approval bounded.
Historic credential-exposure concerns require current-version credential hygiene.

Original activity observations

2026-08-16T17:44:59Z: Update version README

Technical identity

github.com/asaotomo/fofamap

Exact implementation source: https://github.com/asaotomo/fofamap ↗
Reviewed resource type: MCP Server
Repository identity: asaotomo/fofamap

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
asaotomo/fofamap
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Codex

Publisher instructions with a documented client setup path.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-documented setup follows; complete prerequisites and client configuration in the correct environment.
git clone https://github.com/asaotomo/FofaMap.git cd FofaMap python -m pip install -e .
fofamap integrate --agent codex
Configure / authenticate
Publisher instructions
Use fofamap init for FOFA credentials and verify the chosen agent supports its integration. For Codex inspect fofamap integrate --agent codex --dry-run first, then intentionally install if acceptable. Nuclei scanning is separate, disabled unless explicitly enabled and scoped/approved.
Check connection
MCP100 setup guide
Run fofamap integrate --list and/or dry-run to inspect supported integrations; verify the chosen Codex MCP/Skill entry after installing. fofamap account may consume FOFA quota; no real asset scans during setup QA.
fofamap integrate --list
fofamap integrate --agent codex --dry-run
Remove / uninstall / revoke
Publisher instructions
Publisher documents `fofamap integrate --agent codex --uninstall` to remove the managed Codex integration, and `python -m pip uninstall fofamap` to remove the Python package. These are separate operations; this does not delete `results/` or local configuration.
fofamap integrate --agent codex --uninstall

Official Documentation & Sources

What it does

Security-research MCP/CLI/REST tool for FOFA reconnaissance, AI reflection and optional human-approved Nuclei scanning.

Capability: Security & Testing
Resource type: MCP Server
Industry: Cybersecurity
Best fit: Evidence-driven FOFA reconnaissance with tightly gated active scanning

Representative uses

Search FOFA assets
Correlate fingerprints/certificates
Run reconnaissance
Perform approved Nuclei scans

Limitations

Active scanning is disabled by default and must remain target/approval bounded.
Historic credential-exposure concerns require current-version credential hygiene.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: FOFA key; JWT for remote deployment.
Permissions: Read-only FOFA by default; optional scans behind allowlists and one-time approval tokens.
Data handling: Asset/query data and scan results are processed locally/through FOFA and optional scanner.
Cost: usage_based
Risk and cautions: Current safeguards are explicit, but reconnaissance and active scanning remain security-sensitive and must be authorized.

Access scope and cautions

Write actions: Approved Nuclei scans
Sensitive access: FOFA credentials Security targets/results
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search FOFA assets; Correlate fingerprints/certificates; Run reconnaissance; Perform approved Nuclei scans.

What authentication is documented?

Local FOFA key; remote MCP/REST requires auth.

Can it modify data or perform write operations?

Documented write actions include: Approved Nuclei scans. Recorded permission boundary: Read-only FOFA by default; optional scans behind allowlists and one-time approval tokens.

What data-handling boundary should I consider?

Asset/query data and scan results are processed locally/through FOFA and optional scanner. Recorded sensitive-access context: FOFA credentials; Security targets/results.

What limitations and risks should I check before use?

Current safeguards are explicit, but reconnaissance and active scanning remain security-sensitive and must be authorized. Active scanning is disabled by default and must remain target/approval bounded. Historic credential-exposure concerns require current-version credential hygiene. Historical credential exposure and the completeness of revocation, history cleanup, fork cleanup, and clone invalidation remain unresolved from the official sources fetched. No independent runtime, installation, or comprehensive security audit was performed.

What cost model is recorded?

The reviewed cost model is usage based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

asaotomo is listed as Community implementation in MCP100’s current evidence.