secops-field-notes-mcp

The things a security analyst does by hand a dozen times a shift, as tools your coding agent can call: score a CVE, pull the indicators out of a report and defang them for the ticket, read a phishing email's headers properly, work out what kind of hash that is, decode a JWT, turn a timestamp into something a human can read, peel a base64-of-hex payload, and check whether a CVE is on CISA's exploited-in-the-wild list.

Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.

Install

Pin the version.

Claude Code

Terminal

claude mcp add secops-field-notes -- npx -y github:labaccessnow/secops-field-notes-mcp#v0.1.0

Claude Desktop, Cursor, or any client with a JSON config

config.json

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "npx",
      "args": ["-y", "github:labaccessnow/secops-field-notes-mcp#v0.1.0"]
    }
  }
}

Docker

config.json

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"]
    }
  }
}

Node 18 or newer for the npx route. Also in the official MCP registry as io.github.labaccessnow/secops-field-notes-mcp.

Tools

Tool	What it answers	Network
`cvss_score`	CVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it	none
`extract_iocs`	Every IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out	none
`defang_text`	hxxp[://], [.], [at] and back	none
`analyze_email_headers`	The Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for	none
`identify_hash`	bcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies	none
`decode_jwt`	Header, payload, times as dates; flags alg:none, expiry, tokens that never expire	none
`convert_timestamp`	Epoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form	none
`decode_layers`	Chain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer	none
`lookup_kev`	Is this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action	CISA feed, cached 1h
`latest_field_note`	What got exploited this week	RSS

analyze_email_headers

Paste the raw source. It unfolds the headers, reads the Received lines in chronological order (they are stored newest-first), computes the delay at each hop, finds the first public IP in the chain, reads the authentication verdicts, and then says what a triage analyst would say:

Code

From        "IT Helpdesk" <helpdesk@corp.example>
Reply-To    helpdesk-reset@evil-mail.example
Auth        SPF pass · DKIM pass · DMARC fail
Origin IP   192.0.2.44

Received chain (origin first, 3 hops):
   1. [10.0.0.5] [192.0.2.44] → relay.example-news.com  2026-09-05 13:59:50Z
   2. relay.example-news.com [198.51.100.9] → mx3.corp.example  2026-09-05 14:00:15Z  +25s
   3. mx3.corp.example [203.0.113.30] → inbox.corp.example  2026-09-05 14:00:20Z  +5s

Warnings:
  ! From domain (corp.example) ≠ Return-Path domain (mailer.example-news.com) …
  ! Reply-To goes to a different domain (evil-mail.example) than From (corp.example) — classic BEC pattern.
  ! DMARC verdict: fail.

cvss_score

The arithmetic is the FIRST specification's, including the Roundup function done in integer arithmetic so floating-point noise never pushes a 4.0 to a 4.1. Log4Shell's vector scores 10.0; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8. Both are in the test suite.

What it does not do

No account, no signup, no key. No telemetry.
Nothing is read from your disk; every input is text you pass in.
No verification of JWT signatures — it decodes, and says so on every result.
One network call in the package: lookup_kev fetches CISA's public catalog (about 1.7 MB) and keeps it for an hour. Everything else never opens a socket.
It does not query VirusTotal, AbuseIPDB or any enrichment service. Those need keys and accounts; this server is for the work you do before and after them.

Licence

MIT. Written by James Son — network, security, and automation engineer. The logic is the same as the free Field Kit desktop app's security tools, so the two stay in step. Corrections welcome.