> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pwno.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Run pwno-mcp locally with Docker and connect an MCP client.

This is the fastest path to a working local `pwno-mcp` instance.

<Warning>
  `pwno-mcp` needs `SYS_PTRACE`, `SYS_ADMIN`, and unconfined seccomp/apparmor settings so GDB and attach flows work correctly inside Docker.
</Warning>

<Steps>
  <Step title="Create a workspace mount">
    Put the target binary you want to analyze inside a local `workspace` directory.

    ```bash theme={null}
    mkdir -p ./workspace
    cp ./path/to/your/binary ./workspace/chal
    chmod +x ./workspace/chal
    ```
  </Step>

  <Step title="Choose a transport">
    Use HTTP when your client wants a `url`. Use stdio when your client wants a local `command` plus `args`.
  </Step>

  <Step title="Start the server">
    Pick one of the launch commands below.
  </Step>

  <Step title="Connect your client">
    Open [Client Setup](/client-setup/index) and copy the matching config for your MCP client.
  </Step>
</Steps>

<CodeGroup>
  ```bash HTTP theme={null}
  docker run --rm -p 5500:5500 \
    --cap-add=SYS_PTRACE \
    --cap-add=SYS_ADMIN \
    --security-opt seccomp=unconfined \
    --security-opt apparmor=unconfined \
    -v "$PWD/workspace:/workspace" \
    ghcr.io/pwno-io/pwno-mcp:latest
  ```

  ```bash stdio theme={null}
  docker run --rm -i \
    --cap-add=SYS_PTRACE \
    --cap-add=SYS_ADMIN \
    --security-opt seccomp=unconfined \
    --security-opt apparmor=unconfined \
    -v "$PWD/workspace:/workspace" \
    ghcr.io/pwno-io/pwno-mcp:latest \
    --stdio
  ```
</CodeGroup>

In HTTP mode, connect clients to `http://127.0.0.1:5500/mcp` and use `http://127.0.0.1:5500/healthz` for health checks.

In stdio mode, your client spawns the container as a local MCP server instead of calling an HTTP endpoint.

## Important defaults

* `http_path` defaults to `/mcp`.
* The HTTP health endpoint is `/healthz`.
* The attach helper API defaults to `127.0.0.1:5501` inside the runtime.
* Tool path arguments should use container-visible paths under `/workspace`.
* Relative paths are resolved under `/workspace` by the server.

<Check>
  If you mounted `./workspace` from your host, your first binary path inside tool calls is usually `/workspace/chal`.
</Check>

## Next steps

<CardGroup cols={2}>
  <Card title="Configure your client" icon="plug" href="/client-setup/index">
    Copy a ready-to-use HTTP or stdio config for your MCP client.
  </Card>

  <Card title="Verify the setup" icon="check-circle" href="/verify-setup">
    Run a short end-to-end validation flow against your local server.
  </Card>
</CardGroup>