Transports & targets

The target you pass to every command is either a URL or a local command line, and mcpwn picks the transport from it automatically.

Auto-detection

Target	Detected transport
http://host:port/mcp/	Streamable HTTP
https://host/sse	SSE (path ends in /sse)
python server.py · npx -y some-pkg	stdio (a command line)

The rules (from parse_target in src/mcpwn/connection.py):

• A target starting with http:// or https:// is treated as a URL. If its path ends in /sse it uses the legacy SSE transport; otherwise Streamable HTTP.
• Anything else is treated as a stdio command line — mcpwn launches it as a subprocess and speaks MCP over its stdin/stdout.

Forcing a transport

Override auto-detection with -t/--transport:

mcpwn -t sse  enum https://host/stream
mcpwn -t http enum https://host/endpoint
mcpwn -t stdio enum "node build/index.js"

http and sse require an http(s) URL; passing a non-URL target with those transports is an error.

Headers, env, and working directory

Option	Applies to	Example
-H, --header	HTTP / SSE	-H "Authorization: Bearer abc" (repeatable)
-e, --env	stdio	-e API_KEY=secret (repeatable)
--cwd	stdio	--cwd /path/to/server
--timeout	all	--timeout 60 (seconds, default 30)

Headers are merged onto every request the client factory builds, so they ride along through a proxy too. Environment variables and --cwd configure the subprocess for stdio servers.

# Authenticated HTTP server
mcpwn -H "Authorization: Bearer $TOKEN" enum https://host/mcp/

# stdio server that needs an API key and a specific working directory
mcpwn -e API_KEY=secret --cwd ./server enum "python -m my_mcp_server"

Pick the transport that matches your engagement

Use HTTP/SSE for remote/deployed servers (and pair with -x to watch the wire), and stdio for local servers or anything you can launch yourself.