# securityfortech/secops-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/securityfortech/secops-mcp  
**GitHub Stars:** 210  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/securityfortech-secops-mcp

## Description
All-in-one security testing toolbox that brings together popular open source tools through a single MCP interface. Connected to an AI agent, it enables tasks like pentesting, bug bounty hunting, threat hunting, and more.

## Tools
Capabilities this server exposes over MCP:

- **Nuclei** — Vulnerability scanning with custom templates
- **FFUF** — Fast web fuzzing and content discovery
- **WFuzz** — Web application fuzzing
- **XSStrike** — XSS detection and exploitation
- **SQLMap** — SQL injection testing and exploitation
- **Arjun** — HTTP parameter discovery and testing
- **Gospider** — Web crawling and URL discovery
- **Dirsearch** — Directory and file enumeration
- **Nmap** — Network scanning and service enumeration
- **HTTPX** — HTTP probing and analysis
- **TLSX** — TLS/SSL configuration analysis
- **Amass** — Attack surface mapping and asset discovery
- **Subfinder** — Subdomain enumeration
- **IPInfo** — IP address intelligence gathering
- **Hashcat** — Password cracking and hash analysis

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "secops-mcp": {
    "command": "npx",
    "args": ["-y","securityfortech-secops-mcp"]
  }
}
```

## Documentation

## What securityfortech/secops-mcp MCP server does

The securityfortech/secops-mcp MCP server groups a broad set of command-line security tools behind a single interface. Its scope covers web application testing, network enumeration, reconnaissance, and password or hash analysis. The repository describes the interface as MCP-based and presents the tools as wrappers that can be configured independently.

The project is intended for authorized security work such as penetration testing, bug bounty assessment, and threat hunting. It does not replace the underlying tools; instead, it provides a centralized way to invoke them and collect their output.

## How it works

The application starts from `main.py` and exposes the included tool integrations through the unified interface. Each tool returns a common JSON response shape with a Boolean success field, an error field when execution fails, and a results object when execution succeeds. This gives an agent a consistent response format even though the underlying utilities serve different purposes.

The securityfortech/secops-mcp MCP server can be deployed in Docker or installed manually in a Python virtual environment. In either setup, the external utilities must be available: the README directs operators to install the tools described in the `tools/` directory and ensure they are on the system PATH.

## Setup and configuration

The documented Docker path is to clone the repository, build an image named `secops-mcp`, and run that image interactively. Manual setup uses a Python virtual environment, installs `requirements.txt`, installs the required security utilities separately, and starts the application with `python main.py`.

Individual wrappers expose configuration for output formats, timeouts, verbosity, wordlists, and other tool-specific parameters. The documented Arjun integration also accepts HTTP methods, request data, custom headers, authentication, stable scanning, bulk URL input, and configurable threading. Gospider options include crawl depth, subdomain inclusion, extension filters, and output formats.

## Tools and capabilities

The securityfortech/secops-mcp MCP server includes these integrations:

- Nuclei for vulnerability scanning with templates
- FFUF, WFuzz, and XSStrike for web fuzzing and XSS testing
- SQLMap for SQL injection testing
- Arjun for HTTP parameter discovery
- Gospider and Dirsearch for crawling and path discovery
- Nmap for network and service enumeration
- HTTPX and TLSX for HTTP probing and TLS/SSL analysis
- Amass and Subfinder for attack-surface and subdomain discovery
- IPInfo for IP intelligence
- Hashcat for password cracking and hash analysis

The README specifically documents Gospider support for form detection and potential secret discovery, and Arjun support for GET, POST, PUT, and other HTTP methods.

## Limitations and notes

This project depends on the underlying security tools being installed and reachable through the system PATH when using manual installation. The supplied material does not document hosted deployment, client-specific configuration, authentication requirements, or a published package image. Operators must provide appropriate tool configuration and choose scan intensity, wordlists, and timeouts for their environment.

Use the securityfortech/secops-mcp MCP server only against systems for which permission has been obtained. The README also advises respecting rate limits, robots.txt, terms of service, and the potential impact of aggressive scanning.

_Full upstream README: https://allmcps.com/mcp/securityfortech-secops-mcp/readme_