Provides HTTP header inspection capabilities using curl -I to audit security headers such as HSTS, CSP, CORS, and X-Frame-Options for a target domain.
Provides TLS/SSL certificate inspection using openssl s_client to extract certificate subject, issuer, SANs, and handshake status for a target domain.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
An Enterprise-Grade Model Context Protocol (MCP) server that exposes POSIX networking and OSINT utilities (dig, curl, openssl, whois) to LLM host environments like Antigravity CLI, Claude Desktop, and Cursor IDE via stdio transport.
Designed with strict command-injection defense mechanisms to prevent Remote Code Execution (RCE) during agentic tool calls.
graph TD
A[LLM Client / Antigravity / Claude] -->|stdio JSON-RPC| B(FastMCP Server)
B --> C{Regex & Flag Sanitizer}
C -->|Invalid / Injection Attempt| D[Reject with Error]
C -->|Valid Arguments| E[Safe Subprocess Executor]
E -->|shell=False + Vector Args| F[Linux CLI Utilities: dig, curl, openssl, whois]
F --> G[Output Parser]
G -->|Structured Markdown Tables| ANo Shell Execution (shell=False): Inputs are passed purely as argument vectors (subprocess.run(["cmd", "arg"])). Shell metasymbols (|, ;, &&, $(), `) are treated as literal characters and neutralized.
Option Flag Defense: Parameters starting with - are rejected to block argument injection (e.g., -o /etc/passwd).
Strict Input Regex Validation: Enforces RFC-compliant domain name and IPv4 format matching prior to command invocation.
Process Lifespan Isolation: Enforces 10-second hard timeouts per subprocess call to avoid denial-of-service conditions.
Stdio Protocol Protection: All standard logging is isolated strictly to sys.stderr to maintain clean JSON-RPC communication on stdout.
Related MCP server: connectivity-diagnostics
Tool Endpoint | Wrapped Binary | Description | Output Format |
|
| Resolves | Markdown Table (Record, TTL, Value) |
|
| Audits security headers ( | Security Compliance Audit Table |
|
| Extracts Subject, Issuer, SANs, and handshake status. | Executive TLS Summary Table |
|
| Queries domain registrar, creation, and expiration dates. | Domain Lifecycle Metadata Table |
Linux (Arch, Debian/Ubuntu, RHEL) or macOS
Python 3.11+
uv package manager (sudo pacman -S uv or curl -LsSf https://astral.sh/uv/install.sh | sh)
System utilities: dig, curl, whois, openssl
Clone the repository:
git clone https://github.com/minhajadab3836/Security-MCP
cd security-mcp-serverAudit local CLI dependencies:
uv run python -m src.security_mcp.auditRun unit & security defense tests:
uv run python -m src.security_mcp.test_defense
uv run python -m src.security_mcp.test_toolsAdd this entry to your host client configuration file (e.g., ~/.config/antigravity/mcp_config.json, claude_desktop_config.json, or .cursor/mcp.json):
{
"mcpServers": {
"security-osint": {
"command": "uv",
"args": [
"run",
"--directory",
"/path/to/security-mcp-server",
"python",
"-m",
"src.security_mcp.server"
]
}
}
}"Conduct a security inspection on
example.comand audit its HTTP security headers."
https://example.comStatus Line: HTTP/2 200
Header | Status | Value |
HSTS ( |
|
|
CSP ( |
| — |
Clickjacking Protection ( |
|
|
MIME Sniffing Defense ( |
|
|
Server Header: ECS (8b54/1218)
Powered By: Unspecified
Distributed under the MIT License. See LICENSE for details.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
DNS, WHOIS, IP geolocation and SSL checks as agent tools.
Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
Free, no-API-key network lookups for AI agents — IP geolocation, DNS, WHOIS, HTTP and SSL/TLS certificate checks, and full domain health reports.
Utility tools for AI agents: hashing, text stats, validation, DNS, currency, GEO audits.
