Cybersec Mcp

io.github.xu-c0Published by GitHub account xu-c0v0.1.2Updated Oct 24, 2026

Cybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.

VerifiedSTDIODesktop onlyKnowledge & MemorySecurity & MonitoringAI & ML

Overview

AI-generated overview

An MCP server that gives an assistant 323 cybersecurity prompts and 7 chained workflows for red team, blue team, SOC, cloud, OSINT, GRC, and AI security tasks.

What you can do
It exposes a library of 323 cybersecurity prompts across eight categories, including red team, blue team, SOC operations, cloud security, OSINT, GRC, vulnerability analysis, and AI agent security. Prompts accept typed variables and return structured output such as steps, tables, SIEM queries, and MITRE ATT&CK tags. Seven scenario workflows chain prompts end to end, for example web app penetration testing, incident response, cloud security audit, bug bounty recon, ISO 27001 compliance audit, threat hunting, and AI security assessment.
When to use it
Worth adding when you want an assistant to walk through a structured security task, such as planning incident response, running a cloud audit, or drafting a pentest report, instead of pasting prompts by hand. Useful for practitioners who want consistent, variable-driven output and MITRE ATT&CK-tagged results.
Requirements
Runs locally as a stdio process, installed via the npm package @xu-c0/cybersec-mcp, typically launched with npx. Requires Node.js and an MCP-compatible client such as Claude Desktop. No accounts, API keys, environment variables, or headers are declared.
Before you install
The server supplies prompt content and workflow steps; any commands, queries, or actions it suggests are executed by you or your assistant, not by the server. Review generated security guidance before acting on it, especially for offensive or production-affecting steps. The README notes the MCP server itself is described as in progress.

Installation

In SourceWeft

  1. Open Cybersec Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

cybersec-mcp

MCP server with 323 cybersecurity prompts and 7 chained workflows. Install it and Claude (or any MCP-compatible client) can run an incident-response plan, a cloud audit, or a pentest by calling tools instead of you copy-pasting prompts.

Live demo · MIT License · Model Context Protocol

Install

bash
npx -y @xu-c0/cybersec-mcp

Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

json
{  "mcpServers": {    "cybersec": {      "command": "npx",      "args": ["-y", "@xu-c0/cybersec-mcp"]    }  }}

Then:

Use cybersec to plan an incident response for unusual outbound traffic from a SIEM-flagged host. SIEM is Splunk, EDR is CrowdStrike.

The agent picks the incident-response scenario, fills your variables in, and walks through detection, triage, containment, eradication, and post-mortem with concrete commands at each step.

Tools

323 prompts across 8 categories. Every prompt takes typed variables and returns output in a defined shape (steps, tables, SIEM queries, MITRE tags).

CategoryPromptsCovers
Red Team45Pentest methodology, AD attack paths, C2 infra, social engineering
Blue Team42Log analysis, IR playbooks, detection engineering, deception
SOC Operations42Splunk/Sentinel/Elastic queries, alert triage, runbooks, shift handover
Cloud Security38AWS/Azure/GCP audits, IAM, container security, CSPM
OSINT38Domain intel, threat actor profiling, footprinting, attribution
GRC38ISO 27001, SOC 2, NIST CSF, risk assessment, policy generation
Vulnerability Analysis42CVE triage, CVSS 4.0, patch prioritization, pentest reports
AI Agent Security38LLM red teaming, prompt injection, agent guardrails, supply chain

Source: content/prompts-master.md → generated web-app/js/data.js.

Scenarios

Seven end-to-end workflows that chain prompts and pass variables between steps:

  1. Web App Penetration Test — recon → mapping → fingerprinting → API testing → exploitation → post-exploit → reporting
  2. Incident Response — detection → log investigation → severity → containment → eradication → comms → lessons learned
  3. Cloud Security Audit — IAM → network → storage → database → logging → compliance
  4. Bug Bounty Recon — subdomains → ports → tech → OSINT → surface → vuln assessment
  5. Compliance Audit (ISO 27001) — scoping → risk → controls → evidence → gaps → docs
  6. Threat Hunting — hypothesis → query design → pivot → validation → response
  7. AI Security Assessment — inventory → access control → red team → prompt injection → supply chain → monitoring

Definitions live in web-app/js/scenarios.js.

Web demo

cybersec-mcp.vercel.app — browse every prompt, fill in variables, copy the rendered text into any LLM. Dark mode, English / 한국어 / 日本語, no signup. Same data as the MCP server, different interface.

Useful when you want to inspect what a tool will send before wiring up the server, or hand a teammate a one-off prompt.

ATT&CK mapping

Red team, blue team, and SOC prompts are tagged to MITRE ATT&CK tactics. The full mapping is in ATTACK_MATRIX.md — useful for purple-team exercises and detection-coverage reviews.

Layout

mcp/         MCP server (TypeScript, in progress)web-app/     Static demo deployed to Vercelcontent/     prompts-master.md — prompt source of truthexamples/    Client configs (Claude Desktop, Cursor, Claude Code)

parse_prompts.py regenerates web-app/js/data.js from content/prompts-master.md.

Contributing

PRs welcome — new prompts, MITRE tags, scenario workflows, translations, MCP tool fixes. Schema and quality bar in CONTRIBUTING.md.

This project is for authorized security testing, defensive operations, security research, and education. PRs promoting unauthorized access will be rejected. See CODE_OF_CONDUCT.md.

License

MIT — see LICENSE. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; this project is not affiliated with MITRE.

Source: README.md at commit bc9ef05

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.