MLNops

What is MLNops?

MLNops is a Python MCP server that equips AI clients with live infrastructure reconnaissance tools. It combines domain registration, DNS, TLS, network, web, email-security, certificate-transparency, and reputation evidence into one structured workflow.

MLNops does not replace professional judgment. It collects evidence and exposes it through MCP; the connected AI client decides which tool to invoke and how to explain the result.

operator request
      │
      ▼
MCP client ──► MLNops tool registry
                   │
         ┌─────────┼─────────┐
         ▼         ▼         ▼
      passive    active    external
      records    probes    intelligence
         └─────────┼─────────┘
                   ▼
          normalized signals
                   ▼
       correlated threat report

MLNops runs locally, but reconnaissance still creates outbound traffic to target systems and third-party services. Use it only on assets you own or are explicitly authorized to assess.

Related MCP server: Bug Bounty Assistant MCP

Capability matrix

Full reconnaissance pipeline

full_recon executes dependency-aware waves and returns raw evidence, tool coverage, normalized signals, and a prompt-ready summary.

Focused tools

MCP prompt

threat_analysis turns full_recon signals into a structured report with:

• an executive security posture;

• confirmed and likely findings separated by severity;

• a transparent 100-point risk score;

• an immediate, weekly, and monthly remediation roadmap;

• explicit insufficient-data handling when a tool is blocked or fails.

Quick start

Requirements

• Python 3.12+

• uv

• Nmap for port scanning

• An MCP-capable client such as Claude Desktop, Cursor, or VS Code

Install

git clone https://github.com/Milindu-Weerawarna/MLNops.git
cd MLNops
uv sync --locked

Confirm Nmap is available:

nmap --version

Connect an MCP client

Use absolute paths in your client configuration.

Windows

{
  "mcpServers": {
    "MLNops": {
      "command": "C:\\full\\path\\to\\MLNops\\.venv\\Scripts\\python.exe",
      "args": ["C:\\full\\path\\to\\MLNops\\server.py"],
      "env": {
        "ABUSEIPDB_API_KEY": "optional-key"
      }
    }
  }
}

macOS / Linux

{
  "mcpServers": {
    "MLNops": {
      "command": "/full/path/to/MLNops/.venv/bin/python",
      "args": ["/full/path/to/MLNops/server.py"],
      "env": {
        "ABUSEIPDB_API_KEY": "optional-key"
      }
    }
  }
}

ABUSEIPDB_API_KEY is optional and used only by ip_reputation. All other tools work without it.

Restart the MCP client after changing its configuration, then ask:

What MLNops security tools are available?

Operator examples

Run DNS enumeration on example.com.
Inspect the TLS posture of example.com.
Scan scanme.nmap.org with service detection.
Look up CVEs for Apache 2.4.49.
Trace redirects for https://example.com.
Run a complete authorized recon on my-domain.example.

For a correlated report, attach the threat_analysis MCP prompt and invoke full_recon.

Port-scan profiles

Architecture

server.py                     MCP entry point and tool registration
tools/                        Reconnaissance implementations
tools/signals/                Evidence normalization and warning extraction
tools/prompts/                Correlation prompt templates
utils/                        Shared validation and parsing helpers
tests/                        Unit and regression tests
mcp.json / server.json        MCP distribution metadata

The full-recon scheduler runs tools in waves:

1. Lightweight identity and configuration checks.

2. Active service inspection and passive discovery.

3. Reputation analysis after an IP address has been resolved.

A failed tool is recorded as failed or skipped without terminating the remaining scan.

Development

uv sync --locked
uv run pytest tests -q

Run the MCP development inspector:

uv run fastmcp dev inspector server.py

See contributing.md for tool contracts, signal extraction, testing, and registration guidance.

Responsible use

• Scan only systems you own or have explicit written permission to test.

• Use scanme.nmap.org when learning Nmap against a public target.

• Treat heuristic findings as leads that require validation.

• Do not interpret a missing response as proof of a vulnerability.

• Follow the laws and organizational policies that apply to your environment.

License and lineage

MLNops is an independent fork and rebuild based on AynOps. It is distributed under the MIT License. The original copyright notice is retained in LICENSE, and subsequent MLNops modifications are identified there as well.

Maintained by Milindu Weerawarna.