# gaoharimran29-glitch/Cybersecurity-MCP-Server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/gaoharimran29-glitch/Cybersecurity-MCP-Server  
**GitHub Stars:** 29  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/gaoharimran29-glitch-cybersecurity-mcp-server

## Description
Cybersecurity reconnaissance server for Claude. WHOIS lookup, DNS enumeration with subdomain brute-forcing, Nmap port scanning with service detection, SSL/TLS certificate inspection, technology stack fingerprinting, CVE lookup, and IP reputation checking. Runs fully locally via FastMCP.

## Tools
Capabilities this server exposes over MCP:

- **ssl_inspect** — SSL/TLS certificate — issuer, expiry, cipher strength, SANs, TLS version
- **email_security_check** — Checks SPF, DKIM, and DMARC DNS records — returns a security_score, rating, and actionable recommendations for missing or weak configurations
- **tech_stack_detect** — Web server, CMS, JS frameworks, CDN, and analytics
- **cert_transparency** — Query crt.sh Certificate Transparency logs for a domain and extract certificate, subdomain, and wildcard information
- **asn_lookup** — Autonomous System Number (ASN) and network ownership lookup via Team Cymru WHOIS — identifies ASN, BGP prefix, organization, registry, country, and allocation date for domains or IP addresses (no API key required)
- **ip_reputation** — Check if an IP is flagged as malicious via AbuseIPDB (api key requied)
- **headers_analyzer** — Analyzes HTTP security headers — checks HSTS, CSP, X-Frame-Options, and more with severity ratings and misconfiguration details
- **full_recon** — Runs all core tools in parallel and returns combined result
- **cve_lookup** — Search NVD for known CVEs by software name and version (no API key required)
- **cloud_exposure_check** — Checks for publicly accessible AWS S3, Azure Blob Storage, and Google Cloud Storage buckets using common bucket naming patterns derived from the target domain
- **trace_redirects** — Traces the full HTTP redirect chain hop by hop — flags TLS downgrades, private-IP leaks, redirect loops, cross-domain hops, and overly long chains
- **robots_txt_inspect** — Fetch and parse robots.txt to reveal hidden directories and sitemaps
- **hibp_check** — Check if an email or domain appears in Have I Been Pwned breaches (HIBP_API_KEY required)
- **subdomain_takeover** — Detect dangling DNS records that may leave subdomains vulnerable to takeover across supported cloud and SaaS providers

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/gaoharimran29-glitch/Cybersecurity-MCP-Server), copied verbatim. Run them in order; they are not an mcpServers config.

1. Configure:

```sh
python -m venv .venv
```

2. Install:

```sh
pip install -e .
```

## Documentation

## What gaoharimran29-glitch/Cybersecurity-MCP-Server does

gaoharimran29-glitch/Cybersecurity-MCP-Server exposes local reconnaissance functions to MCP-compatible AI clients. It focuses on defensive attack-surface discovery across domains, IP addresses, email configurations, websites, certificates, cloud storage naming patterns, and known software vulnerabilities.

The available checks cover:

- SSL/TLS certificate metadata, including issuer, expiration, SANs, cipher strength, and negotiated TLS version.
- SPF, DKIM, and DMARC records with a security score, rating, and configuration recommendations.
- Web technology identification for servers, CMS platforms, JavaScript frameworks, CDNs, and analytics systems.
- Certificate Transparency searches through crt.sh, including discovered certificates, subdomains, and wildcard names.
- ASN and network ownership data through Team Cymru WHOIS.
- IP reputation through AbuseIPDB and breach exposure through Have I Been Pwned.
- HTTP security headers, redirects, robots.txt, cloud storage exposure, and dangling DNS records.
- NVD searches for CVEs by software name and version.

The `full_recon` tool combines the core reconnaissance checks and runs them concurrently.

## How it works

The server runs as a local FastMCP process and communicates with an AI client using standard JSON-RPC 2.0 over stdio. The client invokes individual tools with a target domain, IP address, email address, or software identifier, depending on the check. Results are returned as structured reconnaissance data for the agent to interpret.

Local execution keeps the server process on the host or in an isolated container. Some operations still make outbound requests to the services they query, including crt.sh, Team Cymru WHOIS, AbuseIPDB, Have I Been Pwned, and the NIST National Vulnerability Database. The repository describes an asynchronous, wave-based approach for coordinating dependent reconnaissance work; `full_recon` uses parallel execution for its combined checks.

## Setup and configuration

The project targets Python 3.12 or newer and includes a Docker-ready deployment with Nmap and Python 3.12. Configure it as a stdio MCP server in a compatible client such as Claude Desktop, Cursor, or VS Code.

AbuseIPDB checks require an `ABUSEIPDB_API_KEY`, and Have I Been Pwned checks require a `HIBP_API_KEY`. ASN lookup through Team Cymru WHOIS and CVE lookup through the NIST NVD do not require API keys. The server can otherwise run locally without a hosted service component.

## Tools and capabilities

The tool surface includes `ssl_inspect`, `email_security_check`, `tech_stack_detect`, `cert_transparency`, `asn_lookup`, `ip_reputation`, `headers_analyzer`, `full_recon`, `cve_lookup`, `cloud_exposure_check`, `trace_redirects`, `robots_txt_inspect`, `hibp_check`, and `subdomain_takeover`.

`trace_redirects` evaluates each redirect hop and flags TLS downgrades, private-IP disclosure, loops, cross-domain transitions, and excessively long chains. `subdomain_takeover` looks for dangling DNS records associated with supported cloud and SaaS services. `cloud_exposure_check` tests common bucket-name patterns for AWS S3, Azure Blob Storage, and Google Cloud Storage. `headers_analyzer` reports security-header severity and configuration details.

## Limitations and notes

Use the reconnaissance functions only against systems and domains you are authorized to assess. Results depend on DNS visibility, reachable HTTP endpoints, external service responses, and the quality of the supplied target. API-backed checks cannot provide their full results without the corresponding credentials. Detection output should be validated before treating a suspected exposure, takeover condition, vulnerability, or reputation flag as confirmed.

_Full upstream README: https://allmcps.com/mcp/gaoharimran29-glitch-cybersecurity-mcp-server/readme_