
mcp-for-security
MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan and more. Integrate security testing and penetration testing into AI workflows.
Stars: 388

MCP for Security is a repository that contains Model Context Protocol (MCP) server implementations for various security testing tools, making them accessible through a standardized interface. It aims to provide automated threat detection and reduce human latency in cybersecurity by combining artificial intelligence and security tools. Users can access a variety of tools for subdomain enumeration, reconnaissance, vulnerability scanning, web crawling, HTTP security analysis, mobile application security testing, network scanning, SSL/TLS configuration analysis, DNS brute-forcing, HTTP request smuggling detection, SQL injection testing, historical URL retrieval, and WordPress vulnerability scanning. The repository encourages collaboration and rapid evolution through open-source projects.
README:
About Cyprox — The Future of AI-Driven Cybersecurity
Cyprox is pioneering the future of cybersecurity by combining artificial intelligence and security tools to empower organizations with next-level threat detection and automated response.
"The Future of Cybersecurity Humans and AI, Working Together..."
- 🚀 AI Driven Solutions: Cybersecurity solutions using Agentic-AI systems with an AI-driven approach
- 🌐 Community-Driven: Open-source projects fostering collaboration and rapid evolution.
- ⚡ Speed & Precision: Automated threat detection that reduces human latency.
- 🔒 Secure & Transparent: Trustworthy platform built with open standards.
Explore more at https://cyprox.io
MCP for Security repository contains Model Context Protocol (MCP) server implementations for various security testing tools, making them accessible through a standardized interface.
You can use all MCP servers through Docker using the cyprox/mcp-for-security Docker image. It can also be used from any MCP client with Docker support, such as the Cyprox platform. Visit Cyprox for more information.
Since each MCP server may require different dependencies, the start.sh
bash script provides a general setup mechanism. Nonetheless, users should always refer to the installation instructions specific to the corresponding MCP server to ensure proper setup.
Tool | Description | Detailed Documentation |
---|---|---|
Amass | Advanced subdomain enumeration and reconnaissance tool | Amass MCP Documentation |
Alterx | Pattern-based wordlist generator for subdomain discovery | Alterx MCP Documentation |
Arjun | Run Arjun to discover hidden HTTP parameters | Arjun MCP Documentation |
Assetfinder | Passive subdomain discovery tool based on Tomnomnom’s Assetfinder | Assetfinder MCP Documentation |
Cero | Certificate-based subdomain enumeration tool leveraging TLS handshakes to extract domain names from certificate fields like SAN | Cero MCP Documentation |
Certificate Search (crt.sh) | Subdomain discovery tool using SSL certificate logs | Certificate Search MCP Documentation |
FFUF | Web content fuzzing tool for discovering hidden files and directories | FFUF MCP Documentation |
Gowitness | Web screenshot and reconnaissance tool for capturing and analyzing web pages | Gowitness MCP Documentation |
HTTP Headers Security | Analyzer for HTTP security headers against OWASP standards | HTTP Headers MCP Documentation |
httpx | Fast and multi-purpose HTTP toolkit for port scanning. | httpx MCP Documentation |
Katana | Fast and flexible web crawler with JS parsing and hybrid crawling support | Katana MCP Documentation |
Masscan | Fast port scanner for large-scale network discovery | Masscan MCP Documentation |
MobSF | Mobile security framework for analyzing mobile applications | MobSF MCP Documentation |
Nmap | Comprehensive network scanning tool for service and vulnerability discovery | Nmap MCP Documentation |
Nuclei | Vulnerability scanner using custom templates | Nuclei MCP Documentation |
Scout Suite | Cloud security auditing tool for assessing configurations across multiple services | Scout Suite MCP Documentation |
SSLScan | SSL/TLS configuration analyzer for security assessment | SSLScan MCP Documentation |
shuffledns | High-speed and customizable DNS brute-forcing and resolution tool | shuffledns MCP Documentation |
Smuggler | Advanced tool for detecting HTTP Request Smuggling vulnerabilities | Smuggler MCP Documentation |
SQLmap | Advanced SQL injection detection and exploitation tool | SQLmap MCP Documentation |
Waybackurls | Tool for retrieving historical URLs from the Wayback Machine | Waybackurls MCP Documentation |
WPScan | WordPress vulnerability scanner for detecting plugins, themes, and configuration issues | WPScan MCP Documentation |
Generates custom wordlists for subdomain discovery using pattern-based permutations.
Advanced reconnaissance tool for subdomain enumeration and intelligence gathering with both passive and active modes.
Discovers hidden HTTP parameters on web applications by scanning URLs, supporting custom wordlists, multiple methods, and adjustable scanning speeds.
Discovers subdomains related to a given domain using passive enumeration techniques. Integrates Tomnomnom’s Assetfinder into the MCP ecosystem for fast and reliable reconnaissance.
Certificate-based subdomain discovery tool that extracts domain names from TLS certificates for reconnaissance and infrastructure mapping.
Discovers subdomains by querying SSL certificate transparency logs without active scanning.
URL-based fuzzing tool with support for all FFUF command line arguments.
Web screenshot and reconnaissance tool that captures screenshots of web pages, analyzes HTTP responses, and provides visual reconnaissance capabilities for security assessments and web application testing.
Analyzes HTTP response headers against OWASP security standards with recommendations.
Performs high-speed probing of discovered subdomains to validate alive hosts, fetch response details, and enrich reconnaissance data without heavy scanning.
Performs fast and customizable web crawling to discover endpoints, scripts, and hidden paths. Supports JavaScript parsing, depth control, and hybrid crawling with headless browsers to enrich reconnaissance and automation workflows.
Fast port scanning tool for target-based port discovery across networks.
Mobile application security testing framework for Android, iOS, and Windows applications.
Full-featured network scanner with detailed service fingerprinting and vulnerability detection.
Template-based vulnerability scanner with an extensive library of security checks.
Performs a multi-service cloud security audit by analyzing cloud configurations and highlighting potential misconfigurations and risks based on best practices.
High-speed DNS brute-forcing and mass subdomain resolution tool to quickly discover valid subdomains using custom resolvers and wordlists.
HTTP Request Smuggling detection tool that identifies desynchronization vulnerabilities between front-end and back-end servers.
SQL injection testing tool with comprehensive capabilities for vulnerability discovery.
SSL/TLS configuration analyzer for identifying weak ciphers and security misconfigurations.
Retrieves historical URLs from the Wayback Machine to discover forgotten endpoints.
WordPress vulnerability scanner for detecting outdated plugins, themes, and common misconfigurations.
- commix
- Corsy
- CrackMapExec
- crlfuzz
- dalfox
- dnsrecon
- feroxbuster
- gau
- getJS
- github-endpoints
- github-subdomains
- gobuster
- gospider
- hakrawler
- kiterunner
- medusa
- naabu
- ParamSpider
- puredns
- s3scanner
- tlsx
- wafw00f
- webscreenshot
- wpscan
- ...
The project uses TypeScript and the Model Context Protocol SDK. To contribute:
- Fork the repository
- Create a feature branch
- Make your changes
- Submit a pull request
For installation instructions for each tool, please refer to the individual documentation linked in the table above.
Each tool has specific parameters and usage instructions. For detailed information, see the documentation for the specific tool you want to use.
For Tasks:
Click tags to check more tools for each tasksFor Jobs:
Alternative AI tools for mcp-for-security
Similar Open Source Tools

mcp-for-security
MCP for Security is a repository that contains Model Context Protocol (MCP) server implementations for various security testing tools, making them accessible through a standardized interface. It aims to provide automated threat detection and reduce human latency in cybersecurity by combining artificial intelligence and security tools. Users can access a variety of tools for subdomain enumeration, reconnaissance, vulnerability scanning, web crawling, HTTP security analysis, mobile application security testing, network scanning, SSL/TLS configuration analysis, DNS brute-forcing, HTTP request smuggling detection, SQL injection testing, historical URL retrieval, and WordPress vulnerability scanning. The repository encourages collaboration and rapid evolution through open-source projects.

awesome-MLSecOps
Awesome MLSecOps is a curated list of open-source tools, resources, and tutorials for MLSecOps (Machine Learning Security Operations). It includes a wide range of security tools and libraries for protecting machine learning models against adversarial attacks, as well as resources for AI security, data anonymization, model security, and more. The repository aims to provide a comprehensive collection of tools and information to help users secure their machine learning systems and infrastructure.

Clean-Coder-AI
Clean Coder is an AI tool that serves as a 2-in-1 Scrum Master and Developer. It helps users delegate planning, managing, and coding tasks to AI agents. These agents create tasks within Todoist, write code, and test it, enabling users to work on projects with minimal effort and stress. The tool offers features like project supervision, task execution by programming agents, frontend feedback, automatic file linting, file researcher agent, and sensitive files protection. Users can interact with Clean Coder through speech and benefit from advanced techniques for intelligent task execution.

arthur-engine
The Arthur Engine is a comprehensive tool for monitoring and governing AI/ML workloads. It provides evaluation and benchmarking of machine learning models, guardrails enforcement, and extensibility for fitting into various application architectures. With support for a wide range of evaluation metrics and customizable features, the tool aims to improve model understanding, optimize generative AI outputs, and prevent data-security and compliance risks. Key features include real-time guardrails, model performance monitoring, feature importance visualization, error breakdowns, and support for custom metrics and models integration.

spring-ai-apps
spring-ai-apps is a collection of Spring AI small applications designed to help users easily apply Spring AI for AI application development. Each small application comes with minimal code and a fully set up framework to resolve version conflict issues.

AI-Writer
AI-Writer is an AI content generation toolkit called Alwrity that automates and enhances the process of blog creation, optimization, and management. It integrates advanced AI models for text generation, image creation, and data analysis, offering features such as online research integration, long-form content generation, AI content planning, multilingual support, prevention of AI hallucinations, multimodal content generation, SEO optimization, and integration with platforms like Wordpress and Jekyll. The toolkit is designed for automated blog management and requires appropriate API keys and access credentials for full functionality.

GenAIExamples
This project provides a collective list of Generative AI (GenAI) and Retrieval-Augmented Generation (RAG) examples such as chatbot with question and answering (ChatQnA), code generation (CodeGen), document summary (DocSum), etc.

Airclap
Airclap is a user-friendly, cross-platform, ultra-fast, and beautifully designed file transfer tool that allows you to send any file to any device without requiring an internet connection. With its wireless transfer and nearby sharing capabilities, you can easily share files between devices on different platforms, including Mac, iOS, Windows, and Android. Airclap's modern user interface provides a simplified and intuitive transfer experience, with clear and real-time feedback. It also offers ultra-fast transfer speeds, maximum transfer speed available on the local network, and a highly stable transmission process. Additionally, Airclap provides abundant shortcuts and a clear file list with preview thumbnails for easy file management.

PURE
PURE (Process-sUpervised Reinforcement lEarning) is a framework that trains a Process Reward Model (PRM) on a dataset and fine-tunes a language model to achieve state-of-the-art mathematical reasoning capabilities. It uses a novel credit assignment method to calculate return and supports multiple reward types. The final model outperforms existing methods with minimal RL data or compute resources, achieving high accuracy on various benchmarks. The tool addresses reward hacking issues and aims to enhance long-range decision-making and reasoning tasks using large language models.

stockbot-on-groq
StockBot Powered by Groq is an AI-powered chatbot that provides lightning-fast responses with live interactive stock charts, financial data, news, screeners, and more. Leveraging Groq's speed and Vercel's AI SDK, StockBot offers real-time conversation with natural language processing, interactive TradingView charts, adaptive interfaces, and multi-asset market coverage. It is designed for entertainment and instructional use, not for investment advice.

generative-ai-cdk-constructs
The AWS Generative AI Constructs Library is an open-source extension of the AWS Cloud Development Kit (AWS CDK) that provides multi-service, well-architected patterns for quickly defining solutions in code to create predictable and repeatable infrastructure, called constructs. The goal of AWS Generative AI CDK Constructs is to help developers build generative AI solutions using pattern-based definitions for their architecture. The patterns defined in AWS Generative AI CDK Constructs are high level, multi-service abstractions of AWS CDK constructs that have default configurations based on well-architected best practices. The library is organized into logical modules using object-oriented techniques to create each architectural pattern model.

traceroot
TraceRoot is a tool that helps engineers debug production issues 10× faster using AI-powered analysis of traces, logs, and code context. It accelerates the debugging process with AI-powered insights, integrates seamlessly into the development workflow, provides real-time trace and log analysis, code context understanding, and intelligent assistance. Features include ease of use, LLM flexibility, distributed services, AI debugging interface, and integration support. Users can get started with TraceRoot Cloud for a 7-day trial or self-host the tool. SDKs are available for Python and JavaScript/TypeScript.

NSMusicS
NSMusicS is a local music software that is expected to support multiple platforms with AI capabilities and multimodal features. The goal of NSMusicS is to integrate various functions (such as artificial intelligence, streaming, music library management, cross platform, etc.), which can be understood as similar to Navidrome but with more features than Navidrome. It wants to become a plugin integrated application that can almost have all music functions.

aiter
AITER is AMD’s centralized repository that supports various high performance AI operators for AI workloads acceleration. It serves as a unified platform for customer operator-level requests, catering to different customer needs. Developers can focus on operators and customers can integrate this collection into their own frameworks. Features include C++ and Python level APIs, kernels from triton/ck/asm, support for inference, training, GEMM, and communication kernels for workarounds in any kernel-framework combination for any architecture limitation.

aiops-modules
AIOps Modules is a collection of reusable Infrastructure as Code (IAC) modules that work with SeedFarmer CLI. The modules are decoupled and can be aggregated using GitOps principles to achieve desired use cases, removing heavy lifting for end users. They must be generic for reuse in Machine Learning and Foundation Model Operations domain, adhering to SeedFarmer Guide structure. The repository includes deployment steps, project manifests, and various modules for SageMaker, Mlflow, FMOps/LLMOps, MWAA, Step Functions, EKS, and example use cases. It also supports Industry Data Framework (IDF) and Autonomous Driving Data Framework (ADDF) Modules.

openrl
OpenRL is an open-source general reinforcement learning research framework that supports training for various tasks such as single-agent, multi-agent, offline RL, self-play, and natural language. Developed based on PyTorch, the goal of OpenRL is to provide a simple-to-use, flexible, efficient and sustainable platform for the reinforcement learning research community. It supports a universal interface for all tasks/environments, single-agent and multi-agent tasks, offline RL training with expert dataset, self-play training, reinforcement learning training for natural language tasks, DeepSpeed, Arena for evaluation, importing models and datasets from Hugging Face, user-defined environments, models, and datasets, gymnasium environments, callbacks, visualization tools, unit testing, and code coverage testing. It also supports various algorithms like PPO, DQN, SAC, and environments like Gymnasium, MuJoCo, Atari, and more.
For similar tasks

mcp-for-security
MCP for Security is a repository that contains Model Context Protocol (MCP) server implementations for various security testing tools, making them accessible through a standardized interface. It aims to provide automated threat detection and reduce human latency in cybersecurity by combining artificial intelligence and security tools. Users can access a variety of tools for subdomain enumeration, reconnaissance, vulnerability scanning, web crawling, HTTP security analysis, mobile application security testing, network scanning, SSL/TLS configuration analysis, DNS brute-forcing, HTTP request smuggling detection, SQL injection testing, historical URL retrieval, and WordPress vulnerability scanning. The repository encourages collaboration and rapid evolution through open-source projects.
For similar jobs

ciso-assistant-community
CISO Assistant is a tool that helps organizations manage their cybersecurity posture and compliance. It provides a centralized platform for managing security controls, threats, and risks. CISO Assistant also includes a library of pre-built frameworks and tools to help organizations quickly and easily implement best practices.

PurpleLlama
Purple Llama is an umbrella project that aims to provide tools and evaluations to support responsible development and usage of generative AI models. It encompasses components for cybersecurity and input/output safeguards, with plans to expand in the future. The project emphasizes a collaborative approach, borrowing the concept of purple teaming from cybersecurity, to address potential risks and challenges posed by generative AI. Components within Purple Llama are licensed permissively to foster community collaboration and standardize the development of trust and safety tools for generative AI.

vpnfast.github.io
VPNFast is a lightweight and fast VPN service provider that offers secure and private internet access. With VPNFast, users can protect their online privacy, bypass geo-restrictions, and secure their internet connection from hackers and snoopers. The service provides high-speed servers in multiple locations worldwide, ensuring a reliable and seamless VPN experience for users. VPNFast is easy to use, with a user-friendly interface and simple setup process. Whether you're browsing the web, streaming content, or accessing sensitive information, VPNFast helps you stay safe and anonymous online.

taranis-ai
Taranis AI is an advanced Open-Source Intelligence (OSINT) tool that leverages Artificial Intelligence to revolutionize information gathering and situational analysis. It navigates through diverse data sources like websites to collect unstructured news articles, utilizing Natural Language Processing and Artificial Intelligence to enhance content quality. Analysts then refine these AI-augmented articles into structured reports that serve as the foundation for deliverables such as PDF files, which are ultimately published.

NightshadeAntidote
Nightshade Antidote is an image forensics tool used to analyze digital images for signs of manipulation or forgery. It implements several common techniques used in image forensics including metadata analysis, copy-move forgery detection, frequency domain analysis, and JPEG compression artifacts analysis. The tool takes an input image, performs analysis using the above techniques, and outputs a report summarizing the findings.

h4cker
This repository is a comprehensive collection of cybersecurity-related references, scripts, tools, code, and other resources. It is carefully curated and maintained by Omar Santos. The repository serves as a supplemental material provider to several books, video courses, and live training created by Omar Santos. It encompasses over 10,000 references that are instrumental for both offensive and defensive security professionals in honing their skills.

AIMr
AIMr is an AI aimbot tool written in Python that leverages modern technologies to achieve an undetected system with a pleasing appearance. It works on any game that uses human-shaped models. To optimize its performance, users should build OpenCV with CUDA. For Valorant, additional perks in the Discord and an Arduino Leonardo R3 are required.

admyral
Admyral is an open-source Cybersecurity Automation & Investigation Assistant that provides a unified console for investigations and incident handling, workflow automation creation, automatic alert investigation, and next step suggestions for analysts. It aims to tackle alert fatigue and automate security workflows effectively by offering features like workflow actions, AI actions, case management, alert handling, and more. Admyral combines security automation and case management to streamline incident response processes and improve overall security posture. The tool is open-source, transparent, and community-driven, allowing users to self-host, contribute, and collaborate on integrations and features.