Shazzer MCP Server

MCP (Model Context Protocol) server for Shazzer - a shared online fuzzing application for browser behavior testing.

What is Shazzer?

Shazzer allows security researchers to create, share, and run fuzz tests across different browsers to discover bugs and security issues. This MCP server lets AI assistants like Claude create fuzz templates, find existing templates, read fuzz results, and view the state of the distributed fuzz network.

Note: This server is read-and-author only. It cannot execute arbitrary code or ad-hoc fuzz runs on the network. Public templates you create are picked up and run by the network exactly like any template submitted through the website.

Installation

npx shazzer-mcp

Or install globally:

npm install -g shazzer-mcp

Configuration

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | SHAZZER_MCP_API_KEY | Yes | Your Shazzer API key (create one at https://shazzer.co.uk/settings) | | SHAZZER_API_URL | No | API URL (defaults to https://shazzer.co.uk) |

API keys carry scopes: read (find templates, get results, view network) and author (create templates). Grant only what you need.

Claude Desktop Setup

Add this to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "shazzer": {
      "command": "npx",
      "args": ["-y", "shazzer-mcp"],
      "env": {
        "SHAZZER_MCP_API_KEY": "shz_YOUR_KEY_HERE"
      }
    }
  }
}

Available Tools

create_template (scope: author)

Create a new fuzz template on Shazzer. Templates define what browser behavior to test across HTML parsing, JavaScript execution, or XSS contexts. Public templates are automatically picked up and run by the distributed fuzz network.

find_templates (scope: read)

Search public fuzz templates by keywords, type, or category. Returns template metadata (id, name, description). Use get_results with a returned template id to read its fuzz results.

Use cases:

• Find XSS bypass characters
• Discover valid HTML parsing quirks
• Identify JavaScript syntax variations across browsers

get_results (scope: read)

Get fuzz results for a template — by id (from find_templates) or by search query. Shows which characters/code points or ready-to-use payloads a template produced per browser.

view_network (scope: read)

View the fuzz network: which browsers are connected right now, and whether your own templates have been picked up and run by the network.

Getting an API Key

1. Go to shazzer.co.uk
2. Sign in with GitHub
3. Navigate to Settings
4. Create a new MCP API key with the read and/or author scopes you need

License

MIT