Cybersecurity MCP Server

What gaoharimran29-glitch/Cybersecurity-MCP-Server does

gaoharimran29-glitch/Cybersecurity-MCP-Server exposes local reconnaissance functions to MCP-compatible AI clients. It focuses on defensive attack-surface discovery across domains, IP addresses, email configurations, websites, certificates, cloud storage naming patterns, and known software vulnerabilities.

The available checks cover:

• SSL/TLS certificate metadata, including issuer, expiration, SANs, cipher strength, and negotiated TLS version.
• SPF, DKIM, and DMARC records with a security score, rating, and configuration recommendations.
• Web technology identification for servers, CMS platforms, JavaScript frameworks, CDNs, and analytics systems.
• Certificate Transparency searches through crt.sh, including discovered certificates, subdomains, and wildcard names.
• ASN and network ownership data through Team Cymru WHOIS.
• IP reputation through AbuseIPDB and breach exposure through Have I Been Pwned.
• HTTP security headers, redirects, robots.txt, cloud storage exposure, and dangling DNS records.
• NVD searches for CVEs by software name and version.

The full_recon tool combines the core reconnaissance checks and runs them concurrently.

How it works

The server runs as a local FastMCP process and communicates with an AI client using standard JSON-RPC 2.0 over stdio. The client invokes individual tools with a target domain, IP address, email address, or software identifier, depending on the check. Results are returned as structured reconnaissance data for the agent to interpret.

Local execution keeps the server process on the host or in an isolated container. Some operations still make outbound requests to the services they query, including crt.sh, Team Cymru WHOIS, AbuseIPDB, Have I Been Pwned, and the NIST National Vulnerability Database. The repository describes an asynchronous, wave-based approach for coordinating dependent reconnaissance work; full_recon uses parallel execution for its combined checks.

Setup and configuration

The project targets Python 3.12 or newer and includes a Docker-ready deployment with Nmap and Python 3.12. Configure it as a stdio MCP server in a compatible client such as Claude Desktop, Cursor, or VS Code.

AbuseIPDB checks require an ABUSEIPDB_API_KEY, and Have I Been Pwned checks require a HIBP_API_KEY. ASN lookup through Team Cymru WHOIS and CVE lookup through the NIST NVD do not require API keys. The server can otherwise run locally without a hosted service component.

Tools and capabilities

The tool surface includes ssl_inspect, email_security_check, tech_stack_detect, cert_transparency, asn_lookup, ip_reputation, headers_analyzer, full_recon, cve_lookup, cloud_exposure_check, trace_redirects, robots_txt_inspect, hibp_check, and subdomain_takeover.

trace_redirects evaluates each redirect hop and flags TLS downgrades, private-IP disclosure, loops, cross-domain transitions, and excessively long chains. subdomain_takeover looks for dangling DNS records associated with supported cloud and SaaS services. cloud_exposure_check tests common bucket-name patterns for AWS S3, Azure Blob Storage, and Google Cloud Storage. headers_analyzer reports security-header severity and configuration details.

Limitations and notes

Use the reconnaissance functions only against systems and domains you are authorized to assess. Results depend on DNS visibility, reachable HTTP endpoints, external service responses, and the quality of the supplied target. API-backed checks cannot provide their full results without the corresponding credentials. Detection output should be validated before treating a suspected exposure, takeover condition, vulnerability, or reputation flag as confirmed.