Mcp Security Hub

reason-machines/security-skills/skills/mcp-security-hub

作者 reason-machines304c245fe992无许可证11 个星标收录于 2026年10月9日更新于 2026年10月9日仓库2个月前更新

Deploy and orchestrate 38 MCP servers for offensive security tools (Nmap, Nuclei, Ghidra, SQLMap, etc.) via Docker

仅含说明SecurityDevOps & Cloud
AI 生成的概览

部署并配置 38 个 Docker 化 MCP 服务器，将攻击性安全工具接入 AI 助手。

功能
该技能提供构建和编排 38 个 Docker 化 MCP 服务器的说明，涵盖侦察、Web 安全、二进制分析、云与区块链安全、密钥检测和密码破解。文档包含 Docker Compose 构建与运行命令、Claude Desktop 及项目级 MCP 配置、API 密钥环境变量以及目标数据的卷挂载方式。此外还涉及健康监控、故障排查、安全加固，以及网络、Web、二进制和云评估的示例工作流。
适用场景
当你希望把 Nmap、Nuclei、SQLMap、Gitleaks、radare2 或 Trivy 等攻击性安全工具接入兼容 MCP 的 AI 客户端时使用。它适用于搭建、配置或排查这些 Docker 化安全服务器，并通过自然语言提示运行评估工作流。
运行要求
需要 Docker 20.10+ 和 Docker Compose 2.0+，以及兼容 MCP 的客户端（如 Claude Desktop）。部分服务器需要 API 密钥（Shodan、VirusTotal、ZoomEye、Burp Suite）、NET_RAW 等 Linux 能力、Docker 套接字访问权限，以及对目标目录的只读卷挂载。需要网络访问以拉取镜像并连接外部服务。该技能不附带脚本，仅为说明文档。

mcp-security-hub

Skill by ara.so — Security Skills collection.

Overview

mcp-security-hub is a production-ready collection of 38 Dockerized MCP (Model Context Protocol) servers that expose 300+ offensive security tools to AI assistants like Claude. It enables natural language security assessments, vulnerability scanning, binary analysis, and penetration testing workflows.

Key capabilities:

  • 8 reconnaissance servers (Nmap, Shodan, ProjectDiscovery tools, WhatWeb, Masscan, ZoomEye)
  • 6 web security servers (Nuclei, SQLMap, Nikto, ffuf, Burp Suite)
  • 6 binary analysis servers (radare2, Ghidra, Binwalk, YARA, Capa, IDA Pro)
  • 3 blockchain security servers (DAML Viewer, Medusa, Solazy)
  • 3 cloud security servers (Trivy, Prowler, RoadRecon)
  • Plus: secrets detection, fuzzing, OSINT, threat intelligence, Active Directory, password cracking

Installation

Prerequisites

  • Docker 20.10+
  • Docker Compose 2.0+
  • Claude Desktop or MCP-compatible client

Clone and Build

bash
git clone https://github.com/FuzzingLabs/mcp-security-hub.gitcd mcp-security-hub
# Build all MCP serversdocker-compose build
# Or build specific serversdocker-compose build nmap-mcp nuclei-mcp gitleaks-mcp

Verify Installation

bash
# Check built imagesdocker images | grep mcp
# Start specific serversdocker-compose up nmap-mcp nuclei-mcp -d
# Verify healthdocker-compose ps

Configuration

Claude Desktop Integration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    },    "gitleaks": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/repos:/app/target:ro",        "gitleaks-mcp:latest"      ]    },    "radare2": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/binaries:/samples:ro",        "radare2-mcp:latest"      ]    },    "sqlmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "sqlmap-mcp:latest"]    },    "trivy": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "/var/run/docker.sock:/var/run/docker.sock:ro",        "trivy-mcp:latest"      ]    }  }}

Project-Level Configuration

Create .mcp.json in your project root:

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    }  }}

Environment Variables

Many MCP servers require API keys for external services:

bash
# Shodanexport SHODAN_API_KEY=your_key_here
# VirusTotalexport VT_API_KEY=your_key_here
# ZoomEyeexport ZOOMEYE_API_KEY=your_key_here
# Burp Suiteexport BURP_API_KEY=your_key_here

Pass environment variables to Docker containers:

json
{  "mcpServers": {    "shodan": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-e", "SHODAN_API_KEY=${SHODAN_API_KEY}",        "shodan-mcp:latest"      ]    }  }}

Key MCP Servers

Nmap MCP (Network Scanning)

Available tools (8):

  • scan_hosts - Basic host discovery
  • scan_ports - Port scanning with service detection
  • scan_os - OS fingerprinting
  • scan_vuln - Vulnerability scanning with NSE scripts
  • scan_custom - Custom nmap command execution
  • list_nse_scripts - List available NSE scripts
  • get_nse_script_info - Get NSE script details
  • scan_with_script - Run specific NSE script

Example prompts:

  • "Scan 192.168.1.0/24 for open ports"
  • "Perform OS detection on 10.0.0.1"
  • "Run vulnerability scan on example.com"

Nuclei MCP (Vulnerability Scanning)

Available tools (7):

  • scan_target - Scan with default templates
  • scan_with_severity - Filter by severity (critical, high, medium, low)
  • scan_with_tags - Use specific tags (cve, exposure, xss, sqli)
  • scan_with_templates - Use custom template paths
  • list_templates - Show available templates
  • update_templates - Update template database
  • scan_multiple_targets - Bulk scanning

Example prompts:

  • "Scan https://example.com for critical vulnerabilities"
  • "Check example.com for CVEs using nuclei"
  • "Run nuclei with exposure and misconfiguration templates"

Gitleaks MCP (Secrets Detection)

Available tools (5):

  • scan_repo - Scan git repository
  • scan_file - Scan individual file
  • scan_directory - Scan directory tree
  • generate_baseline - Create baseline for false positives
  • scan_commits - Scan specific commit range

Example prompts:

  • "Scan /app/target/myrepo for secrets"
  • "Check this project for exposed API keys"
  • "Find credentials in the last 10 commits"

Volume mounting required:

json
{  "gitleaks": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/repos:/app/target:ro",      "gitleaks-mcp:latest"    ]  }}

Radare2 MCP (Binary Analysis)

Available tools (32+):

  • analyze_binary - Load and analyze binary
  • disassemble - Disassemble functions
  • decompile - Decompile to C-like code
  • list_functions - Show all functions
  • find_strings - Extract strings
  • find_imports - List imported functions
  • find_exports - List exported functions
  • search_bytes - Search byte patterns
  • analyze_entropy - Detect packed sections

Example prompts:

  • "Analyze /samples/malware.exe for suspicious functions"
  • "Decompile main function in this binary"
  • "Find strings in /samples/firmware.bin"

Volume mounting required:

json
{  "radare2": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/binaries:/samples:ro",      "radare2-mcp:latest"    ]  }}

SQLMap MCP (SQL Injection)

Available tools (8):

  • test_url - Test URL for SQL injection
  • dump_database - Extract database contents
  • dump_table - Extract specific table
  • list_databases - Enumerate databases
  • list_tables - Enumerate tables
  • get_dbs - Get database names
  • get_current_user - Get DB user
  • test_forms - Test web forms for SQLi

Example prompts:

Trivy MCP (Container Security)

Available tools (7):

  • scan_image - Scan Docker image
  • scan_filesystem - Scan local filesystem
  • scan_config - Scan IaC files (Terraform, K8s)
  • scan_repo - Scan git repository
  • list_vulnerabilities - Show known CVEs
  • get_sbom - Generate SBOM
  • scan_kubernetes - Scan K8s cluster

Example prompts:

  • "Scan nginx:latest for vulnerabilities"
  • "Check this Dockerfile for security issues"
  • "Generate SBOM for python:3.11 image"

Common Workflows

Network Reconnaissance Workflow

bash
# 1. Build reconnaissance serversdocker-compose build nmap-mcp whatweb-mcp masscan-mcp
# 2. Start servicesdocker-compose up nmap-mcp whatweb-mcp -d
# 3. Use in Claude# "Scan 10.0.0.0/24 for web servers, then fingerprint each one"

Web Application Security Assessment

bash
# Build web security stackdocker-compose build nuclei-mcp sqlmap-mcp ffuf-mcp
# Start servicesdocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d
# In Claude:# "Scan example.com with nuclei, test any forms for SQL injection,#  and fuzz for hidden directories"

Binary Analysis Pipeline

bash
# Build binary analysis toolsdocker-compose build radare2-mcp binwalk-mcp yara-mcp capa-mcp
# Mount binaries directorydocker-compose up radare2-mcp binwalk-mcp yara-mcp capa-mcp -d
# In Claude:# "Analyze /samples/suspicious.exe - extract filesystem if packed,#  scan for malware patterns, and identify capabilities"

Secrets Scanning in CI/CD

bash
# Build gitleaksdocker-compose build gitleaks-mcp
# Run as one-off scandocker run -i --rm \  -v "$(pwd):/app/target:ro" \  gitleaks-mcp:latest <<EOF{  "jsonrpc": "2.0",  "method": "tools/call",  "params": {    "name": "scan_directory",    "arguments": {      "path": "/app/target"    }  },  "id": 1}EOF

Cloud Security Audit

bash
# Build cloud security toolsdocker-compose build trivy-mcp prowler-mcp
# Mount Docker socket for Trivydocker-compose up trivy-mcp prowler-mcp -d
# In Claude:# "Scan all running containers for CVEs, then audit AWS account#  for security misconfigurations"

Docker Compose Orchestration

Start All Services

bash
docker-compose up -d

Start Specific Category

bash
# Reconnaissance onlydocker-compose up nmap-mcp whatweb-mcp masscan-mcp -d
# Web security onlydocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d

Resource Limits

Edit docker-compose.yml to adjust resource constraints:

yaml
services:  nmap-mcp:    image: nmap-mcp:latest    deploy:      resources:        limits:          cpus: '2.0'          memory: 1G        reservations:          cpus: '0.5'          memory: 256M

Health Monitoring

bash
# Check health statusdocker-compose ps
# View logsdocker-compose logs -f nmap-mcp
# Restart unhealthy servicesdocker-compose restart nmap-mcp

Development

Building Individual Servers

bash
cd reconnaissance/nmap-mcpdocker build -t nmap-mcp:latest .

Testing MCP Server

bash
# Run interactive testdocker run -it --rm nmap-mcp:latest
# Send JSON-RPC requestecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Adding Custom MCP Server

bash
mkdir -p custom-category/mytool-mcpcd custom-category/mytool-mcp
# Create Dockerfilecat > Dockerfile <<'EOF'FROM python:3.11-slimRUN useradd -m -u 1000 mcpuserRUN pip install mcp mytoolUSER mcpuserWORKDIR /appCOPY server.py .CMD ["python", "server.py"]EOF
# Create server.py with MCP protocol implementation# Add to docker-compose.yml

Security Hardening

All MCP servers follow security best practices:

dockerfile
# Example hardened Dockerfile patternFROM alpine:3.19RUN adduser -D -u 1000 mcpuserRUN apk add --no-cache tool-nameUSER mcpuserWORKDIR /app# Drop all capabilities by default# Add only required capabilities in docker-compose.yml

Required Capabilities

Some tools need specific Linux capabilities:

yaml
nmap-mcp:  cap_drop:    - ALL  cap_add:    - NET_RAW  # Required for SYN scanning
trivy-mcp:  volumes:    - /var/run/docker.sock:/var/run/docker.sock:ro  # Docker scanning

Read-Only Mounts

Always mount target directories read-only:

yaml
gitleaks-mcp:  volumes:    - ./repos:/app/target:ro  # Read-only prevents modification

Troubleshooting

MCP Server Not Responding

bash
# Check if container is runningdocker ps | grep mcp
# View logsdocker logs nmap-mcp
# Restart servicedocker-compose restart nmap-mcp
# Test JSON-RPC directlyecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Permission Denied Errors

bash
# Nmap requires NET_RAW capability# Add to docker-compose.yml:cap_add:  - NET_RAW
# Or run with --cap-adddocker run --cap-add=NET_RAW nmap-mcp:latest

Volume Mount Issues

bash
# Ensure absolute pathsdocker run -v /absolute/path:/app/target:ro gitleaks-mcp
# Check permissions (container runs as UID 1000)chown -R 1000:1000 /path/to/repos
# Verify mount inside containerdocker run -it --rm -v $(pwd):/app/target:ro gitleaks-mcp shls -la /app/target

Claude Desktop Not Finding MCP Servers

bash
# Verify config location# macOS: ~/Library/Application Support/Claude/claude_desktop_config.json# Windows: %APPDATA%\Claude\claude_desktop_config.json
# Check JSON syntaxcat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq .
# Restart Claude Desktop after config changes
# Verify image existsdocker images | grep nmap-mcp

API Key Authentication Failures

bash
# Verify environment variable is setecho $SHODAN_API_KEY
# Pass to Docker containerdocker run -e SHODAN_API_KEY=$SHODAN_API_KEY shodan-mcp
# For Claude Desktop, use full env var syntax{  "command": "docker",  "args": ["-e", "SHODAN_API_KEY=${SHODAN_API_KEY}", ...]}

Network Connectivity Issues

bash
# Some tools need host network accessdocker run --network host nmap-mcp
# Or create custom networkdocker network create security-netdocker run --network security-net nmap-mcp

Container Build Failures

bash
# Clear Docker build cachedocker builder prune -a
# Rebuild with no cachedocker-compose build --no-cache nmap-mcp
# Check base image availabilitydocker pull alpine:3.19docker pull python:3.11-slim

Advanced Usage

Custom Nuclei Templates

bash
# Mount custom template directorydocker run -i --rm \  -v $(pwd)/custom-templates:/nuclei-templates:ro \  nuclei-mcp:latest
# In Claude: "Use custom nuclei templates from /nuclei-templates"

Multi-Stage Binary Analysis

bash
# 1. Extract firmwaredocker run -v $(pwd)/firmware:/samples:ro binwalk-mcp
# 2. Scan extracted filesdocker run -v $(pwd)/firmware/_extracted:/samples:ro yara-mcp
# 3. Analyze suspicious binariesdocker run -v $(pwd)/firmware/_extracted:/samples:ro radare2-mcp

Automated Scanning Pipeline

bash
#!/bin/bash# scan-pipeline.sh
TARGET=$1
# Network scandocker run --rm --cap-add=NET_RAW nmap-mcp \  -A $TARGET > nmap-results.txt
# Web fingerprintingdocker run --rm whatweb-mcp $TARGET > whatweb-results.txt
# Vulnerability scandocker run --rm nuclei-mcp -u $TARGET -severity high,critical \  > nuclei-results.txt

Integration with Existing Tools

bash
# Export Trivy results to JSONdocker run --rm -v /var/run/docker.sock:/var/run/docker.sock \  trivy-mcp image nginx:latest -f json > trivy-report.json
# Parse and filter with jqcat trivy-report.json | jq '.Results[] | select(.Vulnerabilities)'

References

来源与署名

来源：reason-machines/security-skills位于skills/mcp-security-hub提交304c245

许可证： 无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 reason-machines/security-skills 的技能

Vibe Pentest Ai Security Testing

reason-machines

面向 Web 应用、API 和管理后台的 AI 多智能体自动化渗透测试，输出安全报告。

Security112个月前更新

Unisecurityguard Academic Whistleblower Archive

reason-machines

指导搭建基于 GitHub 的学术职场举报与遭审查社交媒体证据存档平台。

Security112个月前更新

Security Detections Mcp

reason-machines

用于搜索和分析安全检测规则并映射 MITRE ATT&CK 覆盖范围的 MCP 服务器技能。

Security112个月前更新

Security Threat Awareness

reason-machines

提醒用户警惕伪装成破解安全软件的 GitHub 恶意软件分发仓库。

Security112个月前更新

S800 Vehicle Network Security Testing

reason-machines

指导汽车 CAN 总线与车载网络的安全测试，涵盖流量捕获、模糊测试、ECU 扫描、重放与 UDS 诊断。

Security112个月前更新

Pentest Agents Bug Bounty Framework

reason-machines

自主漏洞赏金框架，包含狩猎代理、验证关卡、漏洞利用链和平台 MCP 服务器。

Security112个月前更新

更多Security技能

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K今天更新

Secops Triage

google

精选

指导 SOC 分析师对 Google SecOps 安全告警进行分诊，从调查到关闭或升级。

Security21K今天更新

Secops Investigate

google

精选

指导 SOC 分析师在 Google SecOps 中使用 UDM 查询和时间线进行深入的安全事件与实体调查。

Security21K今天更新

Secops Hunt

google

精选

指导在 Google SecOps 中使用 UDM 查询、IoC 回溯、普遍性与异常分析进行主动威胁狩猎。

Security21K今天更新