Mcp Security Hub

reason-machines/security-skills/skills/mcp-security-hub

by reason-machines304c245fe992No license11 starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 2 months ago

Deploy and orchestrate 38 MCP servers for offensive security tools (Nmap, Nuclei, Ghidra, SQLMap, etc.) via Docker

Instructions onlySecurityDevOps & Cloud
AI-generated overview

Deploys and configures 38 Dockerized MCP servers that expose offensive security tools to AI assistants.

What it does
This skill provides instructions for building and orchestrating a collection of 38 Dockerized MCP servers covering reconnaissance, web security, binary analysis, cloud and blockchain security, secrets detection and password cracking. It documents Docker Compose build and run commands, Claude Desktop and project-level MCP configuration, environment variables for API keys, and volume mounts for target data. It also covers health monitoring, troubleshooting, security hardening and example workflows for network, web, binary and cloud assessments.
When to use it
Use it when you want to connect offensive security tooling such as Nmap, Nuclei, SQLMap, Gitleaks, radare2 or Trivy to an MCP-compatible AI client. It suits setting up, configuring or troubleshooting these Dockerized security servers and running assessment workflows through natural language prompts.
Requirements
Docker 20.10+ and Docker Compose 2.0+, plus an MCP-compatible client such as Claude Desktop. Some servers need API keys (Shodan, VirusTotal, ZoomEye, Burp Suite), Linux capabilities such as NET_RAW, Docker socket access, and read-only volume mounts for target directories. Network access is needed to pull images and reach external services. The skill ships no scripts; it is instructions only.

mcp-security-hub

Skill by ara.so — Security Skills collection.

Overview

mcp-security-hub is a production-ready collection of 38 Dockerized MCP (Model Context Protocol) servers that expose 300+ offensive security tools to AI assistants like Claude. It enables natural language security assessments, vulnerability scanning, binary analysis, and penetration testing workflows.

Key capabilities:

  • 8 reconnaissance servers (Nmap, Shodan, ProjectDiscovery tools, WhatWeb, Masscan, ZoomEye)
  • 6 web security servers (Nuclei, SQLMap, Nikto, ffuf, Burp Suite)
  • 6 binary analysis servers (radare2, Ghidra, Binwalk, YARA, Capa, IDA Pro)
  • 3 blockchain security servers (DAML Viewer, Medusa, Solazy)
  • 3 cloud security servers (Trivy, Prowler, RoadRecon)
  • Plus: secrets detection, fuzzing, OSINT, threat intelligence, Active Directory, password cracking

Installation

Prerequisites

  • Docker 20.10+
  • Docker Compose 2.0+
  • Claude Desktop or MCP-compatible client

Clone and Build

bash
git clone https://github.com/FuzzingLabs/mcp-security-hub.gitcd mcp-security-hub
# Build all MCP serversdocker-compose build
# Or build specific serversdocker-compose build nmap-mcp nuclei-mcp gitleaks-mcp

Verify Installation

bash
# Check built imagesdocker images | grep mcp
# Start specific serversdocker-compose up nmap-mcp nuclei-mcp -d
# Verify healthdocker-compose ps

Configuration

Claude Desktop Integration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    },    "gitleaks": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/repos:/app/target:ro",        "gitleaks-mcp:latest"      ]    },    "radare2": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/binaries:/samples:ro",        "radare2-mcp:latest"      ]    },    "sqlmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "sqlmap-mcp:latest"]    },    "trivy": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "/var/run/docker.sock:/var/run/docker.sock:ro",        "trivy-mcp:latest"      ]    }  }}

Project-Level Configuration

Create .mcp.json in your project root:

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    }  }}

Environment Variables

Many MCP servers require API keys for external services:

bash
# Shodanexport SHODAN_API_KEY=your_key_here
# VirusTotalexport VT_API_KEY=your_key_here
# ZoomEyeexport ZOOMEYE_API_KEY=your_key_here
# Burp Suiteexport BURP_API_KEY=your_key_here

Pass environment variables to Docker containers:

json
{  "mcpServers": {    "shodan": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-e", "SHODAN_API_KEY=${SHODAN_API_KEY}",        "shodan-mcp:latest"      ]    }  }}

Key MCP Servers

Nmap MCP (Network Scanning)

Available tools (8):

  • scan_hosts - Basic host discovery
  • scan_ports - Port scanning with service detection
  • scan_os - OS fingerprinting
  • scan_vuln - Vulnerability scanning with NSE scripts
  • scan_custom - Custom nmap command execution
  • list_nse_scripts - List available NSE scripts
  • get_nse_script_info - Get NSE script details
  • scan_with_script - Run specific NSE script

Example prompts:

  • "Scan 192.168.1.0/24 for open ports"
  • "Perform OS detection on 10.0.0.1"
  • "Run vulnerability scan on example.com"

Nuclei MCP (Vulnerability Scanning)

Available tools (7):

  • scan_target - Scan with default templates
  • scan_with_severity - Filter by severity (critical, high, medium, low)
  • scan_with_tags - Use specific tags (cve, exposure, xss, sqli)
  • scan_with_templates - Use custom template paths
  • list_templates - Show available templates
  • update_templates - Update template database
  • scan_multiple_targets - Bulk scanning

Example prompts:

  • "Scan https://example.com for critical vulnerabilities"
  • "Check example.com for CVEs using nuclei"
  • "Run nuclei with exposure and misconfiguration templates"

Gitleaks MCP (Secrets Detection)

Available tools (5):

  • scan_repo - Scan git repository
  • scan_file - Scan individual file
  • scan_directory - Scan directory tree
  • generate_baseline - Create baseline for false positives
  • scan_commits - Scan specific commit range

Example prompts:

  • "Scan /app/target/myrepo for secrets"
  • "Check this project for exposed API keys"
  • "Find credentials in the last 10 commits"

Volume mounting required:

json
{  "gitleaks": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/repos:/app/target:ro",      "gitleaks-mcp:latest"    ]  }}

Radare2 MCP (Binary Analysis)

Available tools (32+):

  • analyze_binary - Load and analyze binary
  • disassemble - Disassemble functions
  • decompile - Decompile to C-like code
  • list_functions - Show all functions
  • find_strings - Extract strings
  • find_imports - List imported functions
  • find_exports - List exported functions
  • search_bytes - Search byte patterns
  • analyze_entropy - Detect packed sections

Example prompts:

  • "Analyze /samples/malware.exe for suspicious functions"
  • "Decompile main function in this binary"
  • "Find strings in /samples/firmware.bin"

Volume mounting required:

json
{  "radare2": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/binaries:/samples:ro",      "radare2-mcp:latest"    ]  }}

SQLMap MCP (SQL Injection)

Available tools (8):

  • test_url - Test URL for SQL injection
  • dump_database - Extract database contents
  • dump_table - Extract specific table
  • list_databases - Enumerate databases
  • list_tables - Enumerate tables
  • get_dbs - Get database names
  • get_current_user - Get DB user
  • test_forms - Test web forms for SQLi

Example prompts:

Trivy MCP (Container Security)

Available tools (7):

  • scan_image - Scan Docker image
  • scan_filesystem - Scan local filesystem
  • scan_config - Scan IaC files (Terraform, K8s)
  • scan_repo - Scan git repository
  • list_vulnerabilities - Show known CVEs
  • get_sbom - Generate SBOM
  • scan_kubernetes - Scan K8s cluster

Example prompts:

  • "Scan nginx:latest for vulnerabilities"
  • "Check this Dockerfile for security issues"
  • "Generate SBOM for python:3.11 image"

Common Workflows

Network Reconnaissance Workflow

bash
# 1. Build reconnaissance serversdocker-compose build nmap-mcp whatweb-mcp masscan-mcp
# 2. Start servicesdocker-compose up nmap-mcp whatweb-mcp -d
# 3. Use in Claude# "Scan 10.0.0.0/24 for web servers, then fingerprint each one"

Web Application Security Assessment

bash
# Build web security stackdocker-compose build nuclei-mcp sqlmap-mcp ffuf-mcp
# Start servicesdocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d
# In Claude:# "Scan example.com with nuclei, test any forms for SQL injection,#  and fuzz for hidden directories"

Binary Analysis Pipeline

bash
# Build binary analysis toolsdocker-compose build radare2-mcp binwalk-mcp yara-mcp capa-mcp
# Mount binaries directorydocker-compose up radare2-mcp binwalk-mcp yara-mcp capa-mcp -d
# In Claude:# "Analyze /samples/suspicious.exe - extract filesystem if packed,#  scan for malware patterns, and identify capabilities"

Secrets Scanning in CI/CD

bash
# Build gitleaksdocker-compose build gitleaks-mcp
# Run as one-off scandocker run -i --rm \  -v "$(pwd):/app/target:ro" \  gitleaks-mcp:latest <<EOF{  "jsonrpc": "2.0",  "method": "tools/call",  "params": {    "name": "scan_directory",    "arguments": {      "path": "/app/target"    }  },  "id": 1}EOF

Cloud Security Audit

bash
# Build cloud security toolsdocker-compose build trivy-mcp prowler-mcp
# Mount Docker socket for Trivydocker-compose up trivy-mcp prowler-mcp -d
# In Claude:# "Scan all running containers for CVEs, then audit AWS account#  for security misconfigurations"

Docker Compose Orchestration

Start All Services

bash
docker-compose up -d

Start Specific Category

bash
# Reconnaissance onlydocker-compose up nmap-mcp whatweb-mcp masscan-mcp -d
# Web security onlydocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d

Resource Limits

Edit docker-compose.yml to adjust resource constraints:

yaml
services:  nmap-mcp:    image: nmap-mcp:latest    deploy:      resources:        limits:          cpus: '2.0'          memory: 1G        reservations:          cpus: '0.5'          memory: 256M

Health Monitoring

bash
# Check health statusdocker-compose ps
# View logsdocker-compose logs -f nmap-mcp
# Restart unhealthy servicesdocker-compose restart nmap-mcp

Development

Building Individual Servers

bash
cd reconnaissance/nmap-mcpdocker build -t nmap-mcp:latest .

Testing MCP Server

bash
# Run interactive testdocker run -it --rm nmap-mcp:latest
# Send JSON-RPC requestecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Adding Custom MCP Server

bash
mkdir -p custom-category/mytool-mcpcd custom-category/mytool-mcp
# Create Dockerfilecat > Dockerfile <<'EOF'FROM python:3.11-slimRUN useradd -m -u 1000 mcpuserRUN pip install mcp mytoolUSER mcpuserWORKDIR /appCOPY server.py .CMD ["python", "server.py"]EOF
# Create server.py with MCP protocol implementation# Add to docker-compose.yml

Security Hardening

All MCP servers follow security best practices:

dockerfile
# Example hardened Dockerfile patternFROM alpine:3.19RUN adduser -D -u 1000 mcpuserRUN apk add --no-cache tool-nameUSER mcpuserWORKDIR /app# Drop all capabilities by default# Add only required capabilities in docker-compose.yml

Required Capabilities

Some tools need specific Linux capabilities:

yaml
nmap-mcp:  cap_drop:    - ALL  cap_add:    - NET_RAW  # Required for SYN scanning
trivy-mcp:  volumes:    - /var/run/docker.sock:/var/run/docker.sock:ro  # Docker scanning

Read-Only Mounts

Always mount target directories read-only:

yaml
gitleaks-mcp:  volumes:    - ./repos:/app/target:ro  # Read-only prevents modification

Troubleshooting

MCP Server Not Responding

bash
# Check if container is runningdocker ps | grep mcp
# View logsdocker logs nmap-mcp
# Restart servicedocker-compose restart nmap-mcp
# Test JSON-RPC directlyecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Permission Denied Errors

bash
# Nmap requires NET_RAW capability# Add to docker-compose.yml:cap_add:  - NET_RAW
# Or run with --cap-adddocker run --cap-add=NET_RAW nmap-mcp:latest

Volume Mount Issues

bash
# Ensure absolute pathsdocker run -v /absolute/path:/app/target:ro gitleaks-mcp
# Check permissions (container runs as UID 1000)chown -R 1000:1000 /path/to/repos
# Verify mount inside containerdocker run -it --rm -v $(pwd):/app/target:ro gitleaks-mcp shls -la /app/target

Claude Desktop Not Finding MCP Servers

bash
# Verify config location# macOS: ~/Library/Application Support/Claude/claude_desktop_config.json# Windows: %APPDATA%\Claude\claude_desktop_config.json
# Check JSON syntaxcat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq .
# Restart Claude Desktop after config changes
# Verify image existsdocker images | grep nmap-mcp

API Key Authentication Failures

bash
# Verify environment variable is setecho $SHODAN_API_KEY
# Pass to Docker containerdocker run -e SHODAN_API_KEY=$SHODAN_API_KEY shodan-mcp
# For Claude Desktop, use full env var syntax{  "command": "docker",  "args": ["-e", "SHODAN_API_KEY=${SHODAN_API_KEY}", ...]}

Network Connectivity Issues

bash
# Some tools need host network accessdocker run --network host nmap-mcp
# Or create custom networkdocker network create security-netdocker run --network security-net nmap-mcp

Container Build Failures

bash
# Clear Docker build cachedocker builder prune -a
# Rebuild with no cachedocker-compose build --no-cache nmap-mcp
# Check base image availabilitydocker pull alpine:3.19docker pull python:3.11-slim

Advanced Usage

Custom Nuclei Templates

bash
# Mount custom template directorydocker run -i --rm \  -v $(pwd)/custom-templates:/nuclei-templates:ro \  nuclei-mcp:latest
# In Claude: "Use custom nuclei templates from /nuclei-templates"

Multi-Stage Binary Analysis

bash
# 1. Extract firmwaredocker run -v $(pwd)/firmware:/samples:ro binwalk-mcp
# 2. Scan extracted filesdocker run -v $(pwd)/firmware/_extracted:/samples:ro yara-mcp
# 3. Analyze suspicious binariesdocker run -v $(pwd)/firmware/_extracted:/samples:ro radare2-mcp

Automated Scanning Pipeline

bash
#!/bin/bash# scan-pipeline.sh
TARGET=$1
# Network scandocker run --rm --cap-add=NET_RAW nmap-mcp \  -A $TARGET > nmap-results.txt
# Web fingerprintingdocker run --rm whatweb-mcp $TARGET > whatweb-results.txt
# Vulnerability scandocker run --rm nuclei-mcp -u $TARGET -severity high,critical \  > nuclei-results.txt

Integration with Existing Tools

bash
# Export Trivy results to JSONdocker run --rm -v /var/run/docker.sock:/var/run/docker.sock \  trivy-mcp image nginx:latest -f json > trivy-report.json
# Parse and filter with jqcat trivy-report.json | jq '.Results[] | select(.Vulnerabilities)'

References

Source and attribution

Source:reason-machines/security-skillsinskills/mcp-security-hubat commit304c245

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from reason-machines/security-skills

Vibe Pentest Ai Security Testing

reason-machines

AI multi-agent automated penetration testing for web apps, APIs and admin panels, producing security reports.

Security11updated 2 months ago

Unisecurityguard Academic Whistleblower Archive

reason-machines

Guides building a GitHub-based archive for academic employment whistleblowing and censored social media evidence.

Security11updated 2 months ago

Security Detections Mcp

reason-machines

MCP server skill for searching and analyzing security detection rules with MITRE ATT&CK coverage mapping.

Security11updated 2 months ago

Security Threat Awareness

reason-machines

Warns users about GitHub repositories that distribute malware disguised as cracked security software.

Security11updated 2 months ago

S800 Vehicle Network Security Testing

reason-machines

Guides automotive CAN bus and vehicle network security testing, covering traffic capture, fuzzing, ECU scanning, replay and UDS diagnostics.

Security11updated 2 months ago

Pentest Agents Bug Bounty Framework

reason-machines

Autonomous bug bounty framework with hunting agents, validation gates, exploit chains and platform MCP servers.

Security11updated 2 months ago

More in Security

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Compliance Tracking

anthropics

Featured

Tracks compliance requirements, audit readiness, and evidence for frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS.

Security27Kupdated today

Dpop Adoption

google

Featured

Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.

Security21Kupdated today

Secops Triage

google

Featured

Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.

Security21Kupdated today

Secops Investigate

google

Featured

Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.

Security21Kupdated today

Secops Hunt

google

Featured

Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.

Security21Kupdated today