CyberMCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dns_lookupB | Resolve DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain. |
| reverse_dnsA | Reverse-resolve an IP address to hostname(s) via PTR record. |
| whois_lookupB | Look up public WHOIS registration data for a domain. |
| enumerate_subdomainsB | Passively enumerate subdomains observed in public certificate transparency logs. |
| scan_portsB | Check which common TCP ports are open on a host. Only call this with authorized=True if the user has confirmed they own the host or have explicit written permission to test it. |
| check_sslC | Inspect a host's TLS certificate: validity, expiry, issuer, SANs, cipher. |
| check_http_security_headersB | Audit an HTTP(S) endpoint's security-relevant response headers. |
| lookup_cveB | Fetch details (description, CVSS score, references) for a CVE ID from NVD. |
| search_cvesC | Search the NVD database for CVEs matching a keyword (e.g. a product name). |
| compute_hashesB | Compute cryptographic digests (md5/sha1/sha256/sha512/...) of a string. |
| identify_hashA | Guess the likely algorithm/format of a hash string, by length and pattern. |
| estimate_password_strengthA | Estimate entropy and flag common weaknesses in a password (local-only, never logged). |
| encode_textB | Encode text using base64, base64url, hex, url, or rot13. |
| decode_textA | Decode text using base64, base64url, hex, url, or rot13. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Each tool has a clearly distinct purpose: DNS resolution vs reverse lookup, CVE lookup by ID vs keyword search, hash computation vs identification, and encode vs decode are all cleanly separated. Host-focused tools (scan_ports, check_ssl, check_http_security_headers) target different security aspects and are unlikely to be confused.
Most names follow a clear snake_case verb_noun pattern (enumerate_subdomains, scan_ports, lookup_cve, compute_hashes, encode_text). A few early tools use noun_verb ordering (dns_lookup, whois_lookup, reverse_dns), which is a minor deviation but still readable and consistent in casing.
The 14 tools are well-scoped for a cybersecurity utility server, covering distinct reconnaissance and helper functions without excessive redundancy. Each tool earns its place and the count stays within a manageable range.
The surface covers core cyber utilities: DNS/WHOIS, subdomain enumeration, port scan, TLS/HTTP header checks, CVE lookup/search, hashing, password strength, and encoding. Minor gaps exist (e.g., no IP reputation, HTTP request/fetch, or richer DNS enumeration), but agents can work around them.