Skip to main content
Glama
warnii

cyber-mcp-server

by warnii

Cybersecurity MCP Server

A production-style MCP (Model Context Protocol) server that gives AI models a toolkit of real cybersecurity capabilities — port scanning, WHOIS, DNS, threat intelligence, CVE lookup, and more.

Claude / ChatGPT
      │
Model Context Protocol
      │
Cyber MCP Server
      │
 ┌────┬────┬──────┬──────┬─────┬───────┬────────┐
Nmap DNS  WHOIS  VT   ABUSE  NVD  Hash   URL

Tools

Tool

What it does

External API

scan_host

Nmap TCP scan on a single host

scan_range

Nmap sweep across a CIDR block

whois_lookup

Registrar, dates, nameservers

dns_lookup

A/AAAA/MX/NS/TXT/CNAME/SOA records

check_ip_reputation

Malicious flag, abuse score, ISP

VirusTotal, AbuseIPDB

check_url_reputation

Detection ratio, categories

VirusTotal

analyze_hash

MD5/SHA1/SHA256 file hash lookup

VirusTotal

search_cve

CVSS score, description, CPEs

NVD (NIST)

check_password_strength

zxcvbn score, entropy, crack time

— (fully local)

scan_url

SSL cert, redirect chain, risk score


Related MCP server: wrg-mcp-server

Quick start

1. Clone & install

git clone https://github.com/yourname/cyber-mcp-server.git
cd cyber-mcp-server

python -m venv .venv
source .venv/bin/activate          # Windows: .venv\Scripts\activate
pip install -r requirements.txt

2. Configure

cp .env.example .env
# Edit .env — add your API keys

3. Run (stdio — for Claude Desktop)

python server.py

4. Run (SSE — for HTTP clients)

MCP_TRANSPORT=sse python server.py
# Server starts on http://0.0.0.0:8000

5. Docker

docker compose up --build

Claude Desktop integration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "cyber": {
      "command": "python",
      "args": ["/absolute/path/to/cyber-mcp-server/server.py"],
      "env": {
        "API_KEYS": "your-key",
        "VIRUSTOTAL_API_KEY": "...",
        "ABUSEIPDB_API_KEY": "...",
        "NVD_API_KEY": "..."
      }
    }
  }
}

Example prompts (in Claude)

Scan scanme.nmap.org and summarize the open services.
Is 185.220.101.1 a malicious IP?
Look up CVE-2024-3400 and explain the risk.
Check the password "Summer2024!" — is it strong?
Analyse the hash d41d8cd98f00b204e9800998ecf8427e.
Scan https://example.com for SSL and security header issues.
Do a full DNS lookup for google.com.

Project structure

cyber-mcp-server/
├── server.py                   # Entry point — registers all tools
├── config/
│   └── settings.py             # Env-based configuration
├── tools/
│   ├── nmap_tool.py            # Port scanner
│   ├── whois_tool.py           # WHOIS lookup
│   ├── dns_tool.py             # DNS records
│   ├── vt_tool.py              # VirusTotal / AbuseIPDB
│   ├── hash_tool.py            # File hash analysis
│   ├── cve_tool.py             # NVD CVE lookup
│   ├── password_tool.py        # Password strength (local)
│   └── url_tool.py             # SSL + redirect + header scan
├── middleware/
│   ├── auth.py                 # API key + JWT auth
│   ├── rate_limit.py           # Token-bucket rate limiter
│   └── audit.py                # Structured JSON audit logs
├── utils/
│   └── helpers.py              # Shared utilities
├── tests/
│   └── test_tools.py           # Pytest unit tests
├── logs/                       # Auto-created at runtime
├── .env.example                # Environment variable template
├── .github/workflows/ci.yml    # GitHub Actions CI/CD
├── Dockerfile
├── docker-compose.yml
├── pytest.ini
└── requirements.txt

API keys needed

Service

Get key

Free tier

VirusTotal

https://virustotal.com

4 req/min

AbuseIPDB

https://abuseipdb.com

1000 req/day

NVD (NIST)

https://nvd.nist.gov/developers/request-an-api-key

50 req/30s


Testing

pytest tests/ -v --cov=. --cov-report=term-missing

Security notes

  • Nmap scans should only target hosts you have permission to scan.

  • Passwords evaluated by check_password_strength are never logged or sent externally.

  • All tool calls are written to logs/audit.log as newline-delimited JSON.

  • Run the container as a non-root user (already configured in Dockerfile).

  • Rotate API_KEYS and JWT_SECRET before deploying to production.


Resume features checklist

  • MCP + FastMCP integration

  • 8 cybersecurity tools

  • API key authentication

  • JWT token support

  • Rate limiting (token bucket)

  • Structured audit logging

  • Docker + docker-compose

  • GitHub Actions CI/CD

  • Pytest unit tests with coverage

  • Async throughout (httpx, asyncio)

  • Secure non-root Docker image

  • .env-based configuration "# cyber-mcp-server"

F
license - not found
-
quality - not tested
C
maintenance

Maintenance

Maintainers
Response time
Release cycle
Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

View all related MCP servers

Related MCP Connectors

  • Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.

  • MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

  • MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/warnii/cyber-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server