cybersec-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VIRUSTOTAL_API_KEY | Yes | Your VirusTotal API key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze-hashA | Identify the hash algorithm type (MD5, SHA-1, SHA-256, etc.) and optionally query VirusTotal for reputation/threat intelligence on the hash. |
| check-cveA | Look up a CVE ID from the NIST National Vulnerability Database (NVD) and return severity, CVSS score, description, affected products, and remediation guidance. |
| scan-headersA | Fetch HTTP response headers from a URL and audit them for security best practices (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, etc.). |
| whois-lookupA | Perform WHOIS and passive DNS reconnaissance on a domain. Returns registration info, registrar, name servers, creation/expiry dates, and IP geolocation via public APIs. |
| decode-payloadA | Decode obfuscated or encoded payloads commonly found in malware analysis, CTF challenges, and phishing emails. Supports Base64, URL encoding, hex, and ROT13. |
| password-strengthA | Analyze password strength against NIST SP 800-63b guidelines. Checks length, entropy, character diversity, common patterns, and known breach indicators. Does NOT store or transmit the password. |
| generate-threat-reportA | Generate a structured threat intelligence report from collected findings. Provide any combination of: domain, IP, hash, CVE IDs, or free-form observations, and get a formatted TI report with risk rating, IOCs, and recommended actions. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool maps to a distinct security task: hash analysis, CVE lookup, header scanning, WHOIS recon, payload decoding, password strength, and report generation. Even analyze-hash and decode-payload are clearly separated by their descriptions and use cases.
Names are consistently lowercase with hyphens, and most follow a clear verb-noun pattern such as analyze-hash, check-cve, and scan-headers. Minor deviations like whois-lookup and password-strength are still readable but break the strict verb-first convention.
With 7 tools, the server is well-scoped and each tool provides a meaningful, non-redundant capability. The count is appropriate for a cybersecurity-focused MCP server without feeling bloated or thin.
The set covers common security workflows including reconnaissance, CVE research, hash analysis, payload decoding, password policy checks, and threat report generation. Minor gaps exist such as IP reputation enrichment or URL scanning beyond headers, but the core surface is solid.