Skip to main content
Glama
veteranchat

MCP Security Tools Server

by veteranchat
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

MCP Security Tools Server

Production-ready HTTP API server untuk security testing & reconnaissance tools. Jalan atas FastAPI + uvicorn dengan support ngrok tunnel.

Fitur

  • ✅ HTTP API endpoints — semua tools bisa dipanggil via REST

  • ✅ Async-ready — FastAPI + pydantic

  • ✅ Ngrok tunnel — expose server ke internet (optional)

  • ✅ Tools integration: nmap, cariddi, paramspider, metasploit, web scraper

  • ✅ Auto status check — cek tool mana yang tersedia di sistem

  • ✅ Minimal dependencies — hanya 8 packages (vs 48 package sebelumnya)

  • ✅ Tested — beneran jalan di Cloud Shell, local machine, Linux server

Related MCP server: Bug Bounty Hunter MCP

Quick Start

1. Clone & Install

git clone https://github.com/antonlarimaraton/mcp-accses.git
cd mcp-accses
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

2. Setup Config (opsional)

Copy .env.example ke .env:

cp .env.example .env
# Edit .env untuk isi API keys kalau diperlukan

Ngrok token (opsional, hanya kalau mau tunnel):

# Edit ngrok_config.json dan isi authtoken
nano ngrok_config.json

3. Run Server

Localhost saja:

python3 mcp_server.py

Dengan ngrok tunnel:

python3 mcp_server.py --ngrok

Custom port:

python3 mcp_server.py --port=9000

Server listening di http://localhost:8000 (atau custom port). API docs ada di /docs.

API Endpoints

Health & Status

  • GET / — Root endpoint, list semua endpoints

  • GET /health — Health check

  • GET /status — Server status + tool availability

Security Tools

  • POST /tools/nmap — Network reconnaissance

  • POST /tools/cariddi — API endpoint discovery

  • POST /tools/paramspider — Parameter extraction

  • POST /tools/scrape — Web scraping (requires SCRAPINGANT_API_KEY)

  • POST /tools/metasploit — Exploitation framework

Contoh Penggunaan

Nmap scan:

curl -X POST http://localhost:8000/tools/nmap \
  -H "Content-Type: application/json" \
  -d '{"target": "192.168.1.1", "args": "-sV"}'

Cariddi (API discovery):

curl -X POST http://localhost:8000/tools/cariddi \
  -H "Content-Type: application/json" \
  -d '{"target": "https://api.example.com"}'

ParamSpider (parameter extraction):

curl -X POST http://localhost:8000/tools/paramspider \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Web scraping:

curl -X POST http://localhost:8000/tools/scrape \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Buka http://localhost:8000/docs di browser untuk interactive API documentation (Swagger UI).

Requirements

System Requirements

  • OS: Linux (Ubuntu 20.04+), macOS, atau Windows (WSL)

  • Python: 3.8+

  • RAM: 512MB minimum

Optional Security Tools

Untuk menggunakan tool tertentu, install di system:

# Nmap
sudo apt-get install -y nmap

# Cariddi (requires Go)
go install github.com/edoardottt/cariddi/cmd/cariddi@latest

# ParamSpider (requires git)
git clone https://github.com/devanshbatham/paramspider.git tools/paramspider

# Metasploit Framework (heavy!)
# Lihat: https://docs.rapid7.com/metasploit/managing-the-database/

Configuration

Environment Variables (.env)

MCP_SERVER_PORT=8000
MCP_SERVER_HOST=0.0.0.0
SCRAPINGANT_API_KEY=your_key_here   # opsional
GITHUB_API_KEY=your_token_here      # opsional

Ngrok Configuration (ngrok_config.json)

{
  "authtoken": "your_ngrok_token_here",
  "region": "ap",
  "log_level": "info"
}

Daftar ngrok gratis di: https://dashboard.ngrok.com

Troubleshooting

"connection refused" / Server tidak jalan

# Check Python version
python3 --version    # Harus 3.8+

# Check dependencies
pip list | grep -E "fastapi|uvicorn|pydantic"

# Run dengan debug
python3 -u mcp_server.py

"Tool not found" (nmap, cariddi, etc)

  • Server report status tools.nmap: false, dll

  • Install tools secara manual (lihat section "Optional Security Tools" di atas)

Ngrok tunnel tidak jalan

# Check authtoken
cat ngrok_config.json | grep authtoken

# Test dengan CLI
ngrok http 8000

Permission denied

chmod +x mcp_server.py
python3 mcp_server.py    # Tidak perlu sudo

Architecture

┌─────────────────────────────────────────────┐
│  FastAPI + Uvicorn (HTTP Server)            │
├─────────────────────────────────────────────┤
│  ToolRunner (Core Logic)                     │
│  ├─ execute_nmap()                          │
│  ├─ execute_cariddi()                       │
│  ├─ execute_paramspider()                   │
│  ├─ scrape_with_api()                       │
│  ├─ execute_metasploit()                    │
│  └─ start_ngrok_tunnel()                    │
├─────────────────────────────────────────────┤
│  System Tools (optional)                    │
│  ├─ nmap CLI                                │
│  ├─ cariddi                                 │
│  ├─ paramspider.py                          │
│  └─ msfconsole                              │
├─────────────────────────────────────────────┤
│  External APIs (optional)                   │
│  ├─ ScrapingAnt (web scraping)              │
│  ├─ Ngrok (tunneling)                       │
│  └─ GitHub API                              │
└─────────────────────────────────────────────┘

Security Notes ⚠️

  • Authorization Only — Hanya scan target yang kamu punya izin testing

  • Legal Compliance — Pastikan comply dengan laws & regulations di region kamu

  • API Keys — Jangan commit .env ke Git; gunakan .env.example untuk template

  • Rate Limiting — Implement rate limit buat production usage

  • Network — Gunakan VPN untuk remote testing

  • Logging — Enable comprehensive logging untuk audit trail

Project Status

Komponen

Status

Notes

HTTP Server (FastAPI)

✅ Production

Tested di Cloud Shell, local, Linux

Nmap Integration

✅ Working

Require system nmap

Cariddi Integration

✅ Working

Require Go-installed tool

ParamSpider Integration

✅ Working

Include di repo atau install manual

Metasploit Integration

✅ Working

Require msfconsole installed

Web Scraper (ScrapingAnt)

✅ Working

Require API key

Ngrok Tunneling

✅ Working

Optional feature

Documentation

✅ Complete

Instruksi jelas & tested

File Structure

mcp-accses/
├── mcp_server.py              # Main server (HTTP API)
├── mcp_config.json            # Server configuration
├── ngrok_config.json          # Ngrok tunnel config (optional)
├── .env.example               # Environment variables template
├── requirements.txt           # Python dependencies (8 packages)
├── README.md                  # Ini file
├── LICENSE                    # MIT License
└── tools/                     # Optional: CLI tools
    ├── cariddi/
    ├── paramspider/
    └── ...

License

MIT License — Lihat LICENSE file untuk detil.

IMPORTANT: Tools ini untuk authorized security testing only. Unauthorized access ke computer systems adalah illegal. Users bertanggung jawab atas compliance dengan semua applicable laws.

Support & Contributing

Version: 1.0.0 | Last Updated: 2025-01-01

This server cannot be installed

A
license - permissive license
-
quality - not tested
C
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • Kali MCP Pentest Server

    andrew-stclair
    F
    license
    -
    quality
    B
    maintenance
    Enables users to perform security testing and penetration testing tasks through a Docker-based API that provides access to popular security tools like nmap, nikto, sqlmap, wpscan, dirb, and searchsploit. Designed for educational purposes with input sanitization and non-root execution for safer pentesting workflows.

  • Bug Bounty Hunter MCP

    MauricioDuarte100
    A
    license
    -
    quality
    D
    maintenance
    Professional security testing server with 50+ integrated tools for web application vulnerability scanning, reconnaissance, fuzzing, and API testing. Enables comprehensive bug bounty hunting workflows including subdomain enumeration, XSS/SQLi detection, and automated security assessments.
    1
    MIT

  • Bug Bounty MCP Server

    akinabudu
    F
    license
    -
    quality
    D
    maintenance
    A comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.
    5

  • MoonMCP

    Moonwuk
    A
    license
    A
    quality
    B
    maintenance
    A scope-aware bug-bounty & reconnaissance MCP server that works out of the box on the Python standard library and augments itself with your favourite CLI tools when they're present.
    22
    MIT

View all related MCP servers

Related MCP Connectors

  • mcp-server

    MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

  • pentest-mcp-server

    Offline methodology engine for authorized penetration testing, CTF, and security research.

  • MCP Fortress

    Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/veteranchat/mcp-server77'

If you have feedback or need assistance with the MCP directory API, please join our Discord server