Un servidor integral de Protocolo de Contexto de Modelo (MCP) que proporciona herramientas de respuesta a incidentes y análisis de red para profesionales de la seguridad. Este servidor permite a agentes de IA como Claude realizar diversas búsquedas y análisis relacionados con la red para facilitar las investigaciones de seguridad.
El servidor MCP de IR Toolshed ofrece un conjunto de herramientas de red y seguridad accesibles mediante el Protocolo de Contexto de Modelo. Está diseñado como un servicio de propósito general para los responsables de la respuesta a incidentes de red, permitiéndoles realizar búsquedas básicas mediante:
Búsquedas de ASN (Número de sistema autónomo)
Búsquedas y análisis de DNS
Recuperación de registros WHOIS
Geolocalización de IP
Y más capacidades de análisis de red por venir
Cada herramienta viene acompañada de documentación detallada como recurso, lo que facilita que los sistemas de IA comprendan cómo usar las herramientas y qué resultados esperar.
Related MCP server: Wireshark MCP
La herramienta de búsqueda ASN devuelve información sobre una dirección IP, incluyendo:
La dirección IP que se consultó
El número AS asociado con la dirección IP
El nombre de la organización propietaria del número AS
La herramienta de búsqueda de DNS proporciona información de registros DNS para dominios:
Admite múltiples tipos de registros (A, AAAA, MX, NS, TXT)
Devuelve registros DNS formateados
Maneja consultas tanto IPv4 como IPv6
La herramienta de búsqueda WHOIS recupera información de registro de dominio:
Detalles de propiedad del dominio
Fechas de inscripción
Información del servidor de nombres
Datos del registrador
La herramienta de geolocalización IP proporciona información de ubicación utilizando la base de datos GeoLite2 de MaxMind:
Datos de ubicación a nivel de país y ciudad
Coordenadas de latitud y longitud
Información de la red
Datos de zona horaria
Nota: La herramienta de geolocalización requiere una clave de licencia de MaxMind. Puede:
Obtenga una clave gratuita en: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
Cualquiera:
Establezca la variable de entorno MAXMIND_LICENSE_KEY
Proporciónelo como parámetro al utilizar la herramienta
Introdúzcalo cuando se le solicite
Se agregarán más herramientas en futuras versiones.
Python 3.8 o más reciente (se recomienda 3.13+)
gestor de paquetes uv Python
Clonar este repositorio:
git clone <repository-url>
cd ir-toolshed-mcp-serverCrear un entorno virtual:
uv venvActivar el entorno virtual:
.venv\Scripts\activatesource .venv/bin/activateInstalar el paquete en modo de desarrollo:
uv pip install -e .Inicie el servidor MCP con:
uv run mcp dev src/mcp_server.pyEsto lanzará el servidor en modo de desarrollo, haciéndolo disponible para clientes MCP como Claude Desktop.
Cuando se conecta a un cliente MCP como Claude Desktop, puede utilizar la herramienta de búsqueda ASN proporcionando una dirección IP:
asnlookup("8.8.8.8")Ejemplo de salida:
{
"ip_addr": "8.8.8.8",
"as_number": "15169",
"as_name": "GOOGLE - Google LLC"
}Cuando se conecta a un cliente MCP como Claude Desktop, puede utilizar la herramienta de búsqueda DNS proporcionando un dominio:
dnslookup("example.com")Ejemplo de salida:
{
"domain": "example.com",
"record_type": "A",
"record_value": "93.184.216.34"
}Cuando se conecta a un cliente MCP como Claude Desktop, puede utilizar la herramienta de búsqueda WHOIS proporcionando un dominio:
whoislookup("example.com")Ejemplo de salida:
{
"domain": "example.com",
"ownership_details": "Google LLC",
"registration_date": "2004-04-26",
"nameserver_information": "ns1.google.com",
"registrar_details": "MarkMonitor Inc."
}Cuando se conecta a un cliente MCP como Claude Desktop, puede utilizar la herramienta de geolocalización proporcionando una dirección IP:
geolocation("8.8.8.8")Ejemplo de salida:
{
"ip_addr": "8.8.8.8",
"country": "US",
"city": "Mountain View",
"latitude": 37.40599,
"longitude": -122.078514,
"network": "AS15169 Google LLC",
"timezone": "America/Los_Angeles"
}Cada herramienta sigue un patrón de manejo de errores consistente:
Formato de respuesta de error general:
{
"status": "error",
"error": "Detailed error message",
"query": "Original query value"
}Ejemplos de errores específicos de la herramienta:
Búsqueda de ASN:
{
"ip_addr": "<queried-ip>",
"status": "error",
"error": "Invalid IP address format"
}Búsqueda de DNS:
{
"domain": "<queried-domain>",
"record_type": "<requested-type>",
"status": "error",
"error": "DNS resolution failed"
}Búsqueda WHOIS:
{
"domain": "<queried-domain>",
"status": "error",
"error": "WHOIS server not available"
}Geolocalización:
{
"ip_addr": "<queried-ip>",
"status": "error",
"error": "MaxMind database not found or license key invalid"
}El proyecto sigue una estructura de paquete Python estándar:
irtoolshed_mcp_server/ # Main package directory
├── __init__.py # Package initialization
├── asnlookup.py # ASN lookup functionality
├── dnslookup.py # DNS lookup functionality
├── geolookup.py # Geolocation functionality
├── mcp_server.py # Main MCP server implementation
└── whoislookup.py # WHOIS lookup functionality
tests/ # Test directory
├── test_asnlookup.py # ASN lookup tests
├── test_dnslookup.py # DNS lookup tests
├── test_geolookup.py # Geolocation tests
└── test_whoislookup.py # WHOIS lookup testsClonar este repositorio:
git clone <repository-url>
cd ir-toolshed-mcp-serverCree un entorno virtual e instale dependencias:
uv venv
source .venv/bin/activate # On Windows use: .venv\Scripts\activate
uv pip install -e ".[dev]"Para ejecutar el conjunto de pruebas:
uv run pytestEsto hará lo siguiente:
Ejecutar todas las pruebas en el directorio tests/
Mostrar información de cobertura de la prueba
Mostrar salida detallada para cualquier falla
Nota: Algunas pruebas requieren configuración adicional:
Las pruebas de geolocalización requieren una base de datos MaxMind GeoLite2 y una clave de licencia
Las pruebas WHOIS pueden fallar si el servicio WHOIS no está disponible
El proyecto utiliza varias herramientas para mantener la calidad del código:
Código de formato con negro:
uv run black .Ordenar importaciones con isort:
uv run isort .Ejecutar la comprobación de tipos con mypy:
uv run mypy .Ejecutar pelusa con ruff:
uv run ruff .Completado: ✓ Búsquedas de ASN ✓ Búsquedas de registros DNS (A, AAAA, MX, etc.) ✓ Recuperación de registros WHOIS ✓ Servicios de geolocalización de IP
Herramientas futuras planificadas para su inclusión:
Puntuación de reputación de dominio
Análisis de certificados SSL
Escaneo de puertos de red
Integración de inteligencia de amenazas
Historial de DNS pasivo
Análisis de seguridad del correo electrónico (SPF, DKIM, DMARC)
Análisis de ruta BGP
Visualización del tráfico de red
Búsquedas de hash de malware
Comprobación de la reputación de URL
Se agradecen las contribuciones para añadir nuevas herramientas de IR o mejorar las existentes. Siga estos pasos:
Bifurcar el repositorio
Crear una rama de características
Agregue su herramienta siguiendo el patrón existente en mcp_server.py
Incluir documentación apropiada como recurso
Envíe una solicitud de extracción con una descripción clara de sus cambios
Apache 2.0
Este servidor está diseñado para la investigación legítima de seguridad y la respuesta a incidentes. Los usuarios deben asegurarse de cumplir con todas las leyes y normativas aplicables al utilizar estas herramientas.
| Name | Required | Description | Default |
|---|---|---|---|
| ipaddr | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| record_type | No | A |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
| Name | Required | Description | Default |
|---|---|---|---|
| ipaddr | Yes | ||
| license_key | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0asnlookupdnslookupgeolookupwhoislookupScored across 4 tools
Each tool has a clearly distinct purpose: asnlookup for Autonomous System Number queries, dnslookup for DNS resolution, geolookup for geographic IP location, and whoislookup for domain registration details. There is no overlap or ambiguity between these tools, making it easy for an agent to select the correct one based on the specific information needed.
All tool names follow a consistent pattern of noun+lookup (e.g., asnlookup, dnslookup, geolookup, whoislookup), using lowercase and no separators. This predictable naming scheme enhances readability and makes the tool set easy to navigate without any deviations or mixed conventions.
With 4 tools, this server is well-scoped for its purpose in IR (Incident Response) or network investigation. Each tool earns its place by covering a distinct aspect of network intelligence (ASN, DNS, geolocation, WHOIS), providing a focused and efficient set without being too thin or overloaded.
The tool set covers core network investigation functions comprehensively, with no obvious gaps for basic lookups. However, minor gaps might exist for advanced IR workflows, such as IP reputation checks or threat intelligence queries, but agents can likely work around this with the provided tools for most common tasks.
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
The Google GKE MCP server is a managed Model Context Protocol server that provides AI applications with tools to manage Google Kubernetes Engine (GKE) clusters and Kubernetes resources. It exposes a structured, discoverable interface that allows AI agents to interact with GKE and Kubernetes APIs, enabling them to inspect cluster configurations, retrieve Kubernetes resource YAMLs, monitor operations like cluster upgrades, diagnose issues, and optimize costs—all without needing to parse text output or use complex kubectl commands.
The Telnyx MCP server is an official implementation of the Model Context Protocol that enables AI clients (like Claude Desktop, Cursor, and OpenAI Agents) to interact with Telnyx's telephony, messaging, and AI assistant APIs. It provides comprehensive capabilities including making and managing phone calls, sending SMS/MMS messages, purchasing and configuring phone numbers, creating AI assistants with custom instructions, managing cloud storage buckets, scraping and embedding website content, and handling integration secrets. The server exists as both a local implementation and a remotely hosted version, allowing developers to integrate real-world communication infrastructure directly into AI applications.
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
