Provides Linux host privilege escalation auditing, scanning for dangerous SUID/SGID binaries, capabilities, and writable scheduled tasks.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@sec-ops-mcp Run a privilege escalation surface audit on the current Linux host"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
sec-ops-mcp)
SecOps MCP is an enterprise-grade Model Context Protocol server that arms LLMs and AI agents with direct diagnostic capabilities for defensive security posture assessments, privilege escalation surface auditing, and Post-Quantum Cryptography (PQC) readiness checks.
Module | Scope | Key Diagnostic Capabilities |
QuantumGuard | PQC & Modern Cryptography | Scans x509 cert chains for classical vs. PQC algorithms (FIPS 203/204), evaluates Shor's vulnerability risks on RSA/ECC, and probes TLS endpoints for hybrid key exchange support. |
PrivScope | Linux Privilege Surface | Identifies dangerous SUID/SGID binaries (GTFOBins mapped), unauthorized |
WinScope | Windows Privilege Surface | Audits |
Related MCP server: Phantom MCP
Python 3.10+
pip / venv
git clone [https://github.com/JoaquinHernandez/sec-ops-mcp.git](https://github.com/JoaquinHernandez/sec-ops-mcp.git)
cd sec-ops-mcp
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
pip install -r requirements.txtAdd this MCP server definition to your client configuration:
claude_desktop_config.json){
"mcpServers": {
"secops-scanner": {
"command": "/absolute/path/to/sec-ops-mcp/.venv/bin/python",
"args": ["/absolute/path/to/sec-ops-mcp/server.py"]
}
}
}{
"mcpServers": {
"secops-scanner": {
"command": "python",
"args": ["./server.py"],
"cwd": "/absolute/path/to/sec-ops-mcp"
}
}
}scan_pqc_readiness(target_dir): Evaluates local certificate stores against NIST PQC migration guidelines.
scan_tls_quantum_posture(hostname, port): Connects to TLS services to check for post-quantum hybrid key exchange suites.
audit_linux_posture(deep_scan): Scans Linux hosts for SUID escalation vectors and capability leaks.
audit_windows_posture(): Scans Windows registry and service tables for privilege escalation flaws.
This MCP server is built specifically for read-only posture assessment and hardening verification. It performs passive analysis and structured reporting, enabling autonomous defensive assistants to guide engineers through remediation workflows without generating offensive payloads.
This server cannot be deployed
Run verified read-only code tools: quant diagnostics + agent-ops preflight, no source exposure.
Read-only smart-contract security intelligence for autonomous agents.
Read-only, deterministic AI triage and readiness tools implementing Sophon's published rubrics.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
