Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@CyberMCP start a scoped engagement for example.com and run full recon"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A free, open-source Model Context Protocol server that gives AI assistants a toolbox of recon and defensive cybersecurity tools.
Point Claude Desktop, Claude Code, or any other MCP-compatible client at CyberMCP and it can look up DNS records, enumerate subdomains from certificate transparency logs, check TLS certificate expiry, audit HTTP security headers, look up CVEs, identify hash formats, estimate password strength, and more — all through natural conversation.
⚠️ Scope: CyberMCP is for authorized security testing, OSINT, and education. It ships no exploits and no attack automation. See SECURITY.md for the responsible-use policy.
🔎 DNS & WHOIS — dns_lookup, reverse_dns, whois_lookup
🕵️ Passive OSINT — enumerate_subdomains via certificate transparency (crt.sh), zero contact with the target
🔐 TLS inspection — check_ssl: validity, expiry, issuer, SANs, cipher/version
🛡️ HTTP security headers — check_http_security_headers: HSTS, CSP, X-Frame-Options, and more, with a 0–100 score
🧪 CVE intel — lookup_cve, search_cves against the NIST NVD API
🧰 Offline toolbox — compute_hashes, identify_hash, estimate_password_strength, encode_text/decode_text
🚧 Authorization-gated port scanning — scan_ports refuses to run unless explicitly told authorized=True
✅ Full pytest suite, ruff lint, matrixed CI across Python 3.10–3.12, tagged releases auto-published via GitHub Actions
See docs/TOOLS.md for the full tool reference.
Related MCP server: BugBounty MCP Server
git clone https://github.com/Dacraezy1/CyberMCP.git
cd CyberMCP
python3 -m venv .venv && source .venv/bin/activate
pip install -e .Add it to Claude Desktop's config (see docs/INSTALL.md for full details and Claude Code instructions):
{
"mcpServers": {
"cybermcp": {
"command": "/absolute/path/to/CyberMCP/.venv/bin/python",
"args": ["-m", "cybermcp.server"]
}
}
}Restart Claude Desktop, then just ask:
"Check the SSL cert on example.com and tell me when it expires."
"Search NVD for CVEs related to Log4j."
"What does crt.sh show for subdomains of my-domain.org?"
More examples in docs/USAGE.md.
CyberMCP/
├── cybermcp/
│ ├── server.py # MCP server + tool registration (FastMCP)
│ └── tools/ # One module per tool, independently testable
├── tests/ # pytest suite
├── docs/ # INSTALL.md, USAGE.md, TOOLS.md
├── examples/ # Claude Desktop config example
└── .github/workflows/ # ci.yml (lint+test+build), release.yml (tag → GitHub Release)pip install -e ".[dev]"
pytest -v
ruff check .Pushing a tag like v0.1.0 triggers the release workflow, which builds the
package and publishes it as a GitHub Release with the wheel/sdist attached.
PRs welcome — see CONTRIBUTING.md for what's in/out of scope and how to add a new tool. Please read CODE_OF_CONDUCT.md and SECURITY.md first.
Audit an HTTP(S) endpoint's security-relevant response headers.
Inputs: url (required).
Inspect a host's TLS certificate: validity, expiry, issuer, SANs, cipher.
Inputs: host (required), port.
Compute cryptographic digests (md5/sha1/sha256/sha512/...) of a string.
Inputs: text (required), algorithms.
Decode text using base64, base64url, hex, url, or rot13.
Inputs: text (required), scheme (required).
Resolve DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain.
Inputs: domain (required), record_types.
Encode text using base64, base64url, hex, url, or rot13.
Inputs: text (required), scheme (required).
Passively enumerate subdomains observed in public certificate transparency logs.
Inputs: domain (required).
Estimate entropy and flag common weaknesses in a password (local-only, never logged).
Inputs: password (required).
Guess the likely algorithm/format of a hash string, by length and pattern.
Inputs: value (required).
Fetch details (description, CVSS score, references) for a CVE ID from NVD.
Inputs: cve_id (required).
Reverse-resolve an IP address to hostname(s) via PTR record.
Inputs: ip (required).
Check which common TCP ports are open on a host.
Only call this with authorized=True if the user has confirmed they own the host or have explicit written permission to test it.
Inputs: host (required), ports, authorized.
Search the NVD database for CVEs matching a keyword (e.g. a product name).
Inputs: keyword (required), results_per_page.
Look up public WHOIS registration data for a domain.
Inputs: domain (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 14 tools
Each tool has a clearly distinct purpose: DNS resolution vs reverse lookup, CVE lookup by ID vs keyword search, hash computation vs identification, and encode vs decode are all cleanly separated. Host-focused tools (scan_ports, check_ssl, check_http_security_headers) target different security aspects and are unlikely to be confused.
Most names follow a clear snake_case verb_noun pattern (enumerate_subdomains, scan_ports, lookup_cve, compute_hashes, encode_text). A few early tools use noun_verb ordering (dns_lookup, whois_lookup, reverse_dns), which is a minor deviation but still readable and consistent in casing.
The 14 tools are well-scoped for a cybersecurity utility server, covering distinct reconnaissance and helper functions without excessive redundancy. Each tool earns its place and the count stays within a manageable range.
The surface covers core cyber utilities: DNS/WHOIS, subdomain enumeration, port scan, TLS/HTTP header checks, CVE lookup/search, hashing, password strength, and encoding. Minor gaps exist (e.g., no IP reputation, HTTP request/fetch, or richer DNS enumeration), but agents can work around them.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Agent rental platform: web-vuln scanning, OSINT and red-team tools via subscription.
Test your AI agents for security and safety weaknesses, and re-verify the fixes.
