de en es ja ko ru zh

mcp-security-server

Name: mcp-security-server
Author: Balckers

by Balckers

Overview Schema Related Servers Score Discussions

Python

Local

MCP 安全扫描器服务器 v2.0

Python MCP Kali License Security

专业的、生产级 MCP 服务器，用于安全评估。基于 Model Context Protocol 构建，专为 Kali Linux 设计。

概述

一个专业的 Model Context Protocol (MCP) 服务器，为 AI 代理提供标准化的安全扫描能力。专为经过授权的安全评估设计，并带有严格的合规控制。

主要特性

7 步强制流程 — 每个工具都遵循：参数验证 → 安全过滤 → 边界检查 → 业务逻辑 → 结果封装 → 异常捕获 → 日志记录
零命令注入 — 所有 shell 调用均使用参数数组，绝不使用字符串拼接
强制授权 — 所有扫描操作均需 legal_authorized=true
8 项 CVE 验证 — Log4Shell、Spring4Shell、Apache 路径遍历、HTTP/2 Rapid Reset 等
标准化输出 — 统一的 JSON 响应：code/msg/target/vuln_list/risk_level/cvss_score/suggest
专业日志记录 — 带时间戳的日志，包含任务 ID、扫描轨迹和审计记录

Related MCP server: Security MCP Server

架构

mcp-security-server/
├── server.py              # MCP Server Entry Point
├── core/                  # Business Logic Layer
│   ├── scanner.py         # Scanning Engine (6 tools, 37KB)
│   ├── result.py          # Unified Response Builder
│   ├── analyzer.py        # CVSS 3.1 Scoring & Vulnerability DB
│   └── reporter.py        # Multi-format Report Generator
├── utils/                 # Infrastructure Layer
│   ├── executor.py        # Safe Command Executor (Parameter Arrays)
│   ├── validator.py       # Parameter Validation & Whitelist
│   ├── logger.py          # Professional Logging System
│   └── env.py             # Kali Environment Detection
└── requirements.txt       # Dependencies

快速开始

1. 安装依赖

# Python packages
pip3 install mcp pydantic

# System tools (Kali Linux)
sudo apt update && sudo apt install -y nmap curl

2. 启动服务器

cd mcp-security-server
python3 server.py

3. 配置 MCP 客户端

添加到您的 MCP 客户端配置中（例如 Claude Desktop、opencode）：

{
  "mcpServers": {
    "mcp-security-scanner": {
      "command": "python3",
      "args": ["/path/to/mcp-security-server/server.py"]
    }
  }
}

工具

工具	描述	必需参数
`host_alive_detect`	主机存活检测（ICMP + TCP SYN）	target, legal_authorized
`port_scan`	端口扫描（SYN/Connect）	target, legal_authorized
`service_fingerprint`	服务版本检测	target, legal_authorized
`web_vuln_scan`	Web 漏洞扫描	target, legal_authorized
`cve_poc_check`	CVE POC 验证	target, legal_authorized, cve_id
`report_generate`	安全报告生成	target, legal_authorized, scan_data
`env_check`	环境与依赖检查	（无）

使用示例

主机存活检测

{
  "target": "192.168.1.1",
  "legal_authorized": true,
  "timeout": 15
}

端口扫描

{
  "target": "192.168.1.1",
  "legal_authorized": true,
  "ports": "80,443,8080,8443",
  "scan_type": "syn"
}

CVE 验证

{
  "target": "192.168.1.1",
  "legal_authorized": true,
  "cve_id": "CVE-2021-44228",
  "port": 8080
}

生成报告

{
  "target": "192.168.1.1",
  "legal_authorized": true,
  "scan_data": "{\"vuln_list\":[...],\"suggest\":[...]}",
  "format_type": "html"
}

支持的 CVE

CVE	名称	CVSS	验证方法
CVE-2021-44228	Log4Shell	10.0	Java 服务检测
CVE-2022-22965	Spring4Shell	9.8	Spring/Tomcat 检测
CVE-2023-22515	Confluence 权限提升	10.0	Setup 端点检查
CVE-2022-26134	Confluence OGNL	9.8	Confluence 检测
CVE-2021-41773	Apache 路径遍历	7.5	路径遍历测试
CVE-2021-42013	Apache 路径遍历 2	7.5	路径遍历测试
CVE-2023-44487	HTTP/2 Rapid Reset	7.5	HTTP/2 支持检查
CVE-2021-3449	OpenSSL NULL 解引用	5.9	版本检测

标准化输出

{
  "code": 0,
  "msg": "success",
  "target": "192.168.1.1",
  "status": "completed",
  "scan_data": { ... },
  "vuln_list": [
    {
      "vuln_id": "CVE-2021-44228",
      "vuln_name": "Log4Shell",
      "cve_id": "CVE-2021-44228",
      "cvss_score": 10.0,
      "risk_level": "Critical",
      "confidence": "Suspected",
      "description": "Apache Log4j2 RCE",
      "evidence": "Java service detected",
      "remediation": "Upgrade Log4j to 2.17.0+"
    }
  ],
  "risk_level": "critical",
  "cvss_score": 10.0,
  "suggest": ["URGENT: Fix critical vulnerability immediately"],
  "task_id": "TASK-20260822100000-a1b2c3d4",
  "timestamp": "2026-08-22T10:00:00",
  "duration": 12.34
}

日志记录

日志自动保存到 log/ 目录：

日志文件	用途
`main_YYYY-MM-DD.log`	常规操作
`scan_YYYY-MM-DD.log`	扫描活动
`error_YYYY-MM-DD.log`	错误与异常
`audit_YYYY-MM-DD.log`	安全审计追踪

合规性

本工具设计用于：

具有书面授权的安全评估
内部安全团队的漏洞验证
安全研究与教育

禁止：未经授权的扫描、数据窃取、系统破坏

许可证

MIT 许可证 — 仅限授权安全测试

This server cannot be installed

license - not found

Not graded

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

MCP Pentest
Penetration Testing Security Testing & QA Tools
adriyansyah-mf
A
license
C
quality
D
maintenance
An automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.
Updated a year ago (2025-09-28 19:48 UTC)
25
27
9
7
BSD 3-Clause
Security MCP Server
Security OS Automation
nordeim
F
license
Not graded
quality
D
maintenance
Provides AI agents like Claude with secure, controlled access to network security tools like nmap for scanning private networks and lab environments. Features comprehensive safety controls, circuit breakers, and production-ready monitoring.
Updated a year ago (2025-10-06 11:06 UTC)
MCPPentestBOT
Penetration Testing Security Testing & QA Tools
kannanprabu
A
license
Not graded
quality
D
maintenance
Enables AI assistants to perform authorized security testing and penetration testing operations including SSL/TLS analysis, port scanning, vulnerability scanning, and HTTP security header audits through natural language interactions.
Updated 9 months ago (2025-11-12 19:47 UTC)
1
MIT
Caido MCP Server
Penetration Testing Security Testing & QA Tools
FazcomIA
F
license
Not graded
quality
D
maintenance
Enables AI agents to perform automated security testing through Caido, providing 10 security tools for vulnerability scanning (XSS, SQLi, command injection), HTTP request manipulation, and penetration testing workflows with whitelist protection.
Updated 7 months ago (2026-01-11 04:09 UTC)
1

View all related MCP servers

Related MCP Connectors

AgentAegis
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
security-intel-mcp
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Intel MCP
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Balckers/mcp-security-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server