mcp-security-server
MCP Security Scanner Server v2.0
Professioneller MCP-Server in Produktionsqualität für Sicherheitsbewertungen. Basiert auf dem Model Context Protocol, entwickelt für Kali Linux.
Überblick
Ein professioneller Model Context Protocol (MCP) Server, der KI-Agenten standardisierte Sicherheits-Scan-Funktionen bereitstellt. Entwickelt für autorisierte Sicherheitsbewertungen mit strengen Compliance-Kontrollen.
Hauptfunktionen
Verpflichtender 7-Schritte-Ablauf — Jedes Tool folgt: Parametervalidierung → Sicherheitsfilterung → Grenzprüfungen → Geschäftslogik → Ergebnisverpackung → Ausnahmeerfassung → Protokollierung
Keine Command-Injection — Alle Shell-Aufrufe verwenden Parameter-Arrays, niemals String-Konkatenation
Verpflichtende Autorisierung —
legal_authorized=truefür alle Scan-Vorgänge erforderlich8 CVE-Verifizierungen — Log4Shell, Spring4Shell, Apache Path Traversal, HTTP/2 Rapid Reset und weitere
Standardisierte Ausgabe — Einheitliche JSON-Antwort:
code/msg/target/vuln_list/risk_level/cvss_score/suggestProfessionelles Logging — Zeitgestempelte Protokolle mit Aufgaben-IDs, Scan-Trails und Audit-Aufzeichnungen
Related MCP server: Security MCP Server
Architektur
mcp-security-server/
├── server.py # MCP Server Entry Point
├── core/ # Business Logic Layer
│ ├── scanner.py # Scanning Engine (6 tools, 37KB)
│ ├── result.py # Unified Response Builder
│ ├── analyzer.py # CVSS 3.1 Scoring & Vulnerability DB
│ └── reporter.py # Multi-format Report Generator
├── utils/ # Infrastructure Layer
│ ├── executor.py # Safe Command Executor (Parameter Arrays)
│ ├── validator.py # Parameter Validation & Whitelist
│ ├── logger.py # Professional Logging System
│ └── env.py # Kali Environment Detection
└── requirements.txt # DependenciesSchnellstart
1. Abhängigkeiten installieren
# Python packages
pip3 install mcp pydantic
# System tools (Kali Linux)
sudo apt update && sudo apt install -y nmap curl2. Server starten
cd mcp-security-server
python3 server.py3. MCP-Client konfigurieren
Fügen Sie dies zu Ihrer MCP-Client-Konfiguration hinzu (z. B. Claude Desktop, opencode):
{
"mcpServers": {
"mcp-security-scanner": {
"command": "python3",
"args": ["/path/to/mcp-security-server/server.py"]
}
}
}Tools
Tool | Beschreibung | Erforderliche Parameter |
| Host-Erkennung (ICMP + TCP SYN) | target, legal_authorized |
| Port-Scan (SYN/Connect) | target, legal_authorized |
| Dienst-Versionserkennung | target, legal_authorized |
| Web-Schwachstellenscan | target, legal_authorized |
| CVE-POC-Verifizierung | target, legal_authorized, cve_id |
| Sicherheitsbericht-Erstellung | target, legal_authorized, scan_data |
| Umgebungs- und Abhängigkeitsprüfung | (keine) |
Anwendungsbeispiele
Host-Erkennung
{
"target": "192.168.1.1",
"legal_authorized": true,
"timeout": 15
}Port-Scan
{
"target": "192.168.1.1",
"legal_authorized": true,
"ports": "80,443,8080,8443",
"scan_type": "syn"
}CVE-Verifizierung
{
"target": "192.168.1.1",
"legal_authorized": true,
"cve_id": "CVE-2021-44228",
"port": 8080
}Bericht erstellen
{
"target": "192.168.1.1",
"legal_authorized": true,
"scan_data": "{\"vuln_list\":[...],\"suggest\":[...]}",
"format_type": "html"
}Unterstützte CVEs
CVE | Name | CVSS | Verifizierungsmethode |
CVE-2021-44228 | Log4Shell | 10.0 | Java-Dienst-Erkennung |
CVE-2022-22965 | Spring4Shell | 9.8 | Spring/Tomcat-Erkennung |
CVE-2023-22515 | Confluence Privilege | 10.0 | Setup-Endpunkt-Prüfung |
CVE-2022-26134 | Confluence OGNL | 9.8 | Confluence-Erkennung |
CVE-2021-41773 | Apache Path Traversal | 7.5 | Path-Traversal-Test |
CVE-2021-42013 | Apache Path Traversal 2 | 7.5 | Path-Traversal-Test |
CVE-2023-44487 | HTTP/2 Rapid Reset | 7.5 | HTTP/2-Unterstützungsprüfung |
CVE-2021-3449 | OpenSSL NULL deref | 5.9 | Versionserkennung |
Standardisierte Ausgabe
{
"code": 0,
"msg": "success",
"target": "192.168.1.1",
"status": "completed",
"scan_data": { ... },
"vuln_list": [
{
"vuln_id": "CVE-2021-44228",
"vuln_name": "Log4Shell",
"cve_id": "CVE-2021-44228",
"cvss_score": 10.0,
"risk_level": "Critical",
"confidence": "Suspected",
"description": "Apache Log4j2 RCE",
"evidence": "Java service detected",
"remediation": "Upgrade Log4j to 2.17.0+"
}
],
"risk_level": "critical",
"cvss_score": 10.0,
"suggest": ["URGENT: Fix critical vulnerability immediately"],
"task_id": "TASK-20260822100000-a1b2c3d4",
"timestamp": "2026-08-22T10:00:00",
"duration": 12.34
}Protokollierung
Logs werden automatisch im Verzeichnis log/ gespeichert:
Log-Datei | Zweck |
| Allgemeine Vorgänge |
| Scan-Aktivitäten |
| Fehler und Ausnahmen |
| Sicherheits-Audit-Trail |
Compliance
Dieses Tool ist konzipiert für:
Sicherheitsbewertungen mit schriftlicher Autorisierung
Schwachstellen-Verifikation durch interne Sicherheitsteams
Sicherheitsforschung und -bildung
VERBOTEN: Nicht autorisierte Scans, Datendiebstahl, Systembeschädigung
Lizenz
MIT-Lizenz — Nur autorisierte Sicherheitstests
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseCqualityDmaintenanceAn automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.252797BSD 3-Clause
- FlicenseNot gradedqualityDmaintenanceProvides AI agents like Claude with secure, controlled access to network security tools like nmap for scanning private networks and lab environments. Features comprehensive safety controls, circuit breakers, and production-ready monitoring.
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to perform authorized security testing and penetration testing operations including SSL/TLS analysis, port scanning, vulnerability scanning, and HTTP security header audits through natural language interactions.1MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI agents to perform automated security testing through Caido, providing 10 security tools for vulnerability scanning (XSS, SQLi, command injection), HTTP request manipulation, and penetration testing workflows with whitelist protection.1
Related MCP Connectors
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Balckers/mcp-security-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server