Skip to main content
Glama
warnii

cyber-mcp-server

by warnii
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Cybersecurity MCP Server

A production-style MCP (Model Context Protocol) server that gives AI models a toolkit of real cybersecurity capabilities — port scanning, WHOIS, DNS, threat intelligence, CVE lookup, and more.

Claude / ChatGPT
      │
Model Context Protocol
      │
Cyber MCP Server
      │
 ┌────┬────┬──────┬──────┬─────┬───────┬────────┐
Nmap DNS  WHOIS  VT   ABUSE  NVD  Hash   URL

Tools

Tool

What it does

External API

scan_host

Nmap TCP scan on a single host

—

scan_range

Nmap sweep across a CIDR block

—

whois_lookup

Registrar, dates, nameservers

—

dns_lookup

A/AAAA/MX/NS/TXT/CNAME/SOA records

—

check_ip_reputation

Malicious flag, abuse score, ISP

VirusTotal, AbuseIPDB

check_url_reputation

Detection ratio, categories

VirusTotal

analyze_hash

MD5/SHA1/SHA256 file hash lookup

VirusTotal

search_cve

CVSS score, description, CPEs

NVD (NIST)

check_password_strength

zxcvbn score, entropy, crack time

— (fully local)

scan_url

SSL cert, redirect chain, risk score

—

Related MCP server: OSINT Tools MCP Server

Quick start

1. Clone & install

git clone https://github.com/yourname/cyber-mcp-server.git
cd cyber-mcp-server

python -m venv .venv
source .venv/bin/activate          # Windows: .venv\Scripts\activate
pip install -r requirements.txt

2. Configure

cp .env.example .env
# Edit .env — add your API keys

3. Run (stdio — for Claude Desktop)

python server.py

4. Run (SSE — for HTTP clients)

MCP_TRANSPORT=sse python server.py
# Server starts on http://0.0.0.0:8000

5. Docker

docker compose up --build

Claude Desktop integration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "cyber": {
      "command": "python",
      "args": ["/absolute/path/to/cyber-mcp-server/server.py"],
      "env": {
        "API_KEYS": "your-key",
        "VIRUSTOTAL_API_KEY": "...",
        "ABUSEIPDB_API_KEY": "...",
        "NVD_API_KEY": "..."
      }
    }
  }
}

Example prompts (in Claude)

Scan scanme.nmap.org and summarize the open services.
Is 185.220.101.1 a malicious IP?
Look up CVE-2024-3400 and explain the risk.
Check the password "Summer2024!" — is it strong?
Analyse the hash d41d8cd98f00b204e9800998ecf8427e.
Scan https://example.com for SSL and security header issues.
Do a full DNS lookup for google.com.

Project structure

cyber-mcp-server/
├── server.py                   # Entry point — registers all tools
├── config/
│   └── settings.py             # Env-based configuration
├── tools/
│   ├── nmap_tool.py            # Port scanner
│   ├── whois_tool.py           # WHOIS lookup
│   ├── dns_tool.py             # DNS records
│   ├── vt_tool.py              # VirusTotal / AbuseIPDB
│   ├── hash_tool.py            # File hash analysis
│   ├── cve_tool.py             # NVD CVE lookup
│   ├── password_tool.py        # Password strength (local)
│   └── url_tool.py             # SSL + redirect + header scan
├── middleware/
│   ├── auth.py                 # API key + JWT auth
│   ├── rate_limit.py           # Token-bucket rate limiter
│   └── audit.py                # Structured JSON audit logs
├── utils/
│   └── helpers.py              # Shared utilities
├── tests/
│   └── test_tools.py           # Pytest unit tests
├── logs/                       # Auto-created at runtime
├── .env.example                # Environment variable template
├── .github/workflows/ci.yml    # GitHub Actions CI/CD
├── Dockerfile
├── docker-compose.yml
├── pytest.ini
└── requirements.txt

API keys needed

Service

Get key

Free tier

VirusTotal

https://virustotal.com

4 req/min

AbuseIPDB

https://abuseipdb.com

1000 req/day

NVD (NIST)

https://nvd.nist.gov/developers/request-an-api-key

50 req/30s

Testing

pytest tests/ -v --cov=. --cov-report=term-missing

Security notes

  • Nmap scans should only target hosts you have permission to scan.

  • Passwords evaluated by check_password_strength are never logged or sent externally.

  • All tool calls are written to logs/audit.log as newline-delimited JSON.

  • Run the container as a non-root user (already configured in Dockerfile).

  • Rotate API_KEYS and JWT_SECRET before deploying to production.

Resume features checklist

  • MCP + FastMCP integration

  • 8 cybersecurity tools

  • API key authentication

  • JWT token support

  • Rate limiting (token bucket)

  • Structured audit logging

  • Docker + docker-compose

  • GitHub Actions CI/CD

  • Pytest unit tests with coverage

  • Async throughout (httpx, asyncio)

  • Secure non-root Docker image

  • .env-based configuration "# cyber-mcp-server"

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • wrg-mcp-server

    WRG-11
    A
    license
    Not graded
    quality
    A
    maintenance
    An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
    1
    MIT

  • OSINT Tools MCP Server

    frishtik
    A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude, enabling sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools.
    241
    MIT

  • PenTest MCP

    omamishra8051-source
    A
    license
    C
    quality
    C
    maintenance
    AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.
    31
    MIT