Mcp Security Hub

reason-machines/security-skills/skills/mcp-security-hub

作者 reason-machines304c245fe992無授權條款11 個星標收錄於 2026年10月9日更新於 2026年10月9日儲存庫2 個月前更新

Deploy and orchestrate 38 MCP servers for offensive security tools (Nmap, Nuclei, Ghidra, SQLMap, etc.) via Docker

僅含說明SecurityDevOps & Cloud
AI 產生的概覽

部署並設定 38 個 Docker 化 MCP 伺服器，將攻擊性安全工具接入 AI 助理。

功能
此技能提供建置與協調 38 個 Docker 化 MCP 伺服器的說明，涵蓋偵察、Web 安全、二進位分析、雲端與區塊鏈安全、密鑰偵測及密碼破解。文件包含 Docker Compose 建置與執行指令、Claude Desktop 及專案層級 MCP 設定、API 金鑰環境變數，以及目標資料的磁碟區掛載方式。此外也涵蓋健康監控、疑難排解、安全強化，以及網路、Web、二進位與雲端評估的範例工作流程。
適用情境
當你想把 Nmap、Nuclei、SQLMap、Gitleaks、radare2 或 Trivy 等攻擊性安全工具接入相容 MCP 的 AI 用戶端時使用。它適合用來架設、設定或排查這些 Docker 化安全伺服器，並透過自然語言提示執行評估工作流程。
執行需求
需要 Docker 20.10+ 與 Docker Compose 2.0+，以及相容 MCP 的用戶端（例如 Claude Desktop）。部分伺服器需要 API 金鑰（Shodan、VirusTotal、ZoomEye、Burp Suite）、NET_RAW 等 Linux 能力、Docker 套接字存取權限，以及對目標目錄的唯讀磁碟區掛載。需要網路存取以拉取映像並連線外部服務。此技能不附帶指令碼，僅為說明文件。

mcp-security-hub

Skill by ara.so — Security Skills collection.

Overview

mcp-security-hub is a production-ready collection of 38 Dockerized MCP (Model Context Protocol) servers that expose 300+ offensive security tools to AI assistants like Claude. It enables natural language security assessments, vulnerability scanning, binary analysis, and penetration testing workflows.

Key capabilities:

  • 8 reconnaissance servers (Nmap, Shodan, ProjectDiscovery tools, WhatWeb, Masscan, ZoomEye)
  • 6 web security servers (Nuclei, SQLMap, Nikto, ffuf, Burp Suite)
  • 6 binary analysis servers (radare2, Ghidra, Binwalk, YARA, Capa, IDA Pro)
  • 3 blockchain security servers (DAML Viewer, Medusa, Solazy)
  • 3 cloud security servers (Trivy, Prowler, RoadRecon)
  • Plus: secrets detection, fuzzing, OSINT, threat intelligence, Active Directory, password cracking

Installation

Prerequisites

  • Docker 20.10+
  • Docker Compose 2.0+
  • Claude Desktop or MCP-compatible client

Clone and Build

bash
git clone https://github.com/FuzzingLabs/mcp-security-hub.gitcd mcp-security-hub
# Build all MCP serversdocker-compose build
# Or build specific serversdocker-compose build nmap-mcp nuclei-mcp gitleaks-mcp

Verify Installation

bash
# Check built imagesdocker images | grep mcp
# Start specific serversdocker-compose up nmap-mcp nuclei-mcp -d
# Verify healthdocker-compose ps

Configuration

Claude Desktop Integration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    },    "gitleaks": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/repos:/app/target:ro",        "gitleaks-mcp:latest"      ]    },    "radare2": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "${HOME}/binaries:/samples:ro",        "radare2-mcp:latest"      ]    },    "sqlmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "sqlmap-mcp:latest"]    },    "trivy": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-v", "/var/run/docker.sock:/var/run/docker.sock:ro",        "trivy-mcp:latest"      ]    }  }}

Project-Level Configuration

Create .mcp.json in your project root:

json
{  "mcpServers": {    "nmap": {      "command": "docker",      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]    },    "nuclei": {      "command": "docker",      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]    }  }}

Environment Variables

Many MCP servers require API keys for external services:

bash
# Shodanexport SHODAN_API_KEY=your_key_here
# VirusTotalexport VT_API_KEY=your_key_here
# ZoomEyeexport ZOOMEYE_API_KEY=your_key_here
# Burp Suiteexport BURP_API_KEY=your_key_here

Pass environment variables to Docker containers:

json
{  "mcpServers": {    "shodan": {      "command": "docker",      "args": [        "run", "-i", "--rm",        "-e", "SHODAN_API_KEY=${SHODAN_API_KEY}",        "shodan-mcp:latest"      ]    }  }}

Key MCP Servers

Nmap MCP (Network Scanning)

Available tools (8):

  • scan_hosts - Basic host discovery
  • scan_ports - Port scanning with service detection
  • scan_os - OS fingerprinting
  • scan_vuln - Vulnerability scanning with NSE scripts
  • scan_custom - Custom nmap command execution
  • list_nse_scripts - List available NSE scripts
  • get_nse_script_info - Get NSE script details
  • scan_with_script - Run specific NSE script

Example prompts:

  • "Scan 192.168.1.0/24 for open ports"
  • "Perform OS detection on 10.0.0.1"
  • "Run vulnerability scan on example.com"

Nuclei MCP (Vulnerability Scanning)

Available tools (7):

  • scan_target - Scan with default templates
  • scan_with_severity - Filter by severity (critical, high, medium, low)
  • scan_with_tags - Use specific tags (cve, exposure, xss, sqli)
  • scan_with_templates - Use custom template paths
  • list_templates - Show available templates
  • update_templates - Update template database
  • scan_multiple_targets - Bulk scanning

Example prompts:

  • "Scan https://example.com for critical vulnerabilities"
  • "Check example.com for CVEs using nuclei"
  • "Run nuclei with exposure and misconfiguration templates"

Gitleaks MCP (Secrets Detection)

Available tools (5):

  • scan_repo - Scan git repository
  • scan_file - Scan individual file
  • scan_directory - Scan directory tree
  • generate_baseline - Create baseline for false positives
  • scan_commits - Scan specific commit range

Example prompts:

  • "Scan /app/target/myrepo for secrets"
  • "Check this project for exposed API keys"
  • "Find credentials in the last 10 commits"

Volume mounting required:

json
{  "gitleaks": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/repos:/app/target:ro",      "gitleaks-mcp:latest"    ]  }}

Radare2 MCP (Binary Analysis)

Available tools (32+):

  • analyze_binary - Load and analyze binary
  • disassemble - Disassemble functions
  • decompile - Decompile to C-like code
  • list_functions - Show all functions
  • find_strings - Extract strings
  • find_imports - List imported functions
  • find_exports - List exported functions
  • search_bytes - Search byte patterns
  • analyze_entropy - Detect packed sections

Example prompts:

  • "Analyze /samples/malware.exe for suspicious functions"
  • "Decompile main function in this binary"
  • "Find strings in /samples/firmware.bin"

Volume mounting required:

json
{  "radare2": {    "command": "docker",    "args": [      "run", "-i", "--rm",      "-v", "/path/to/binaries:/samples:ro",      "radare2-mcp:latest"    ]  }}

SQLMap MCP (SQL Injection)

Available tools (8):

  • test_url - Test URL for SQL injection
  • dump_database - Extract database contents
  • dump_table - Extract specific table
  • list_databases - Enumerate databases
  • list_tables - Enumerate tables
  • get_dbs - Get database names
  • get_current_user - Get DB user
  • test_forms - Test web forms for SQLi

Example prompts:

Trivy MCP (Container Security)

Available tools (7):

  • scan_image - Scan Docker image
  • scan_filesystem - Scan local filesystem
  • scan_config - Scan IaC files (Terraform, K8s)
  • scan_repo - Scan git repository
  • list_vulnerabilities - Show known CVEs
  • get_sbom - Generate SBOM
  • scan_kubernetes - Scan K8s cluster

Example prompts:

  • "Scan nginx:latest for vulnerabilities"
  • "Check this Dockerfile for security issues"
  • "Generate SBOM for python:3.11 image"

Common Workflows

Network Reconnaissance Workflow

bash
# 1. Build reconnaissance serversdocker-compose build nmap-mcp whatweb-mcp masscan-mcp
# 2. Start servicesdocker-compose up nmap-mcp whatweb-mcp -d
# 3. Use in Claude# "Scan 10.0.0.0/24 for web servers, then fingerprint each one"

Web Application Security Assessment

bash
# Build web security stackdocker-compose build nuclei-mcp sqlmap-mcp ffuf-mcp
# Start servicesdocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d
# In Claude:# "Scan example.com with nuclei, test any forms for SQL injection,#  and fuzz for hidden directories"

Binary Analysis Pipeline

bash
# Build binary analysis toolsdocker-compose build radare2-mcp binwalk-mcp yara-mcp capa-mcp
# Mount binaries directorydocker-compose up radare2-mcp binwalk-mcp yara-mcp capa-mcp -d
# In Claude:# "Analyze /samples/suspicious.exe - extract filesystem if packed,#  scan for malware patterns, and identify capabilities"

Secrets Scanning in CI/CD

bash
# Build gitleaksdocker-compose build gitleaks-mcp
# Run as one-off scandocker run -i --rm \  -v "$(pwd):/app/target:ro" \  gitleaks-mcp:latest <<EOF{  "jsonrpc": "2.0",  "method": "tools/call",  "params": {    "name": "scan_directory",    "arguments": {      "path": "/app/target"    }  },  "id": 1}EOF

Cloud Security Audit

bash
# Build cloud security toolsdocker-compose build trivy-mcp prowler-mcp
# Mount Docker socket for Trivydocker-compose up trivy-mcp prowler-mcp -d
# In Claude:# "Scan all running containers for CVEs, then audit AWS account#  for security misconfigurations"

Docker Compose Orchestration

Start All Services

bash
docker-compose up -d

Start Specific Category

bash
# Reconnaissance onlydocker-compose up nmap-mcp whatweb-mcp masscan-mcp -d
# Web security onlydocker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d

Resource Limits

Edit docker-compose.yml to adjust resource constraints:

yaml
services:  nmap-mcp:    image: nmap-mcp:latest    deploy:      resources:        limits:          cpus: '2.0'          memory: 1G        reservations:          cpus: '0.5'          memory: 256M

Health Monitoring

bash
# Check health statusdocker-compose ps
# View logsdocker-compose logs -f nmap-mcp
# Restart unhealthy servicesdocker-compose restart nmap-mcp

Development

Building Individual Servers

bash
cd reconnaissance/nmap-mcpdocker build -t nmap-mcp:latest .

Testing MCP Server

bash
# Run interactive testdocker run -it --rm nmap-mcp:latest
# Send JSON-RPC requestecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Adding Custom MCP Server

bash
mkdir -p custom-category/mytool-mcpcd custom-category/mytool-mcp
# Create Dockerfilecat > Dockerfile <<'EOF'FROM python:3.11-slimRUN useradd -m -u 1000 mcpuserRUN pip install mcp mytoolUSER mcpuserWORKDIR /appCOPY server.py .CMD ["python", "server.py"]EOF
# Create server.py with MCP protocol implementation# Add to docker-compose.yml

Security Hardening

All MCP servers follow security best practices:

dockerfile
# Example hardened Dockerfile patternFROM alpine:3.19RUN adduser -D -u 1000 mcpuserRUN apk add --no-cache tool-nameUSER mcpuserWORKDIR /app# Drop all capabilities by default# Add only required capabilities in docker-compose.yml

Required Capabilities

Some tools need specific Linux capabilities:

yaml
nmap-mcp:  cap_drop:    - ALL  cap_add:    - NET_RAW  # Required for SYN scanning
trivy-mcp:  volumes:    - /var/run/docker.sock:/var/run/docker.sock:ro  # Docker scanning

Read-Only Mounts

Always mount target directories read-only:

yaml
gitleaks-mcp:  volumes:    - ./repos:/app/target:ro  # Read-only prevents modification

Troubleshooting

MCP Server Not Responding

bash
# Check if container is runningdocker ps | grep mcp
# View logsdocker logs nmap-mcp
# Restart servicedocker-compose restart nmap-mcp
# Test JSON-RPC directlyecho '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \  docker run -i --rm nmap-mcp:latest

Permission Denied Errors

bash
# Nmap requires NET_RAW capability# Add to docker-compose.yml:cap_add:  - NET_RAW
# Or run with --cap-adddocker run --cap-add=NET_RAW nmap-mcp:latest

Volume Mount Issues

bash
# Ensure absolute pathsdocker run -v /absolute/path:/app/target:ro gitleaks-mcp
# Check permissions (container runs as UID 1000)chown -R 1000:1000 /path/to/repos
# Verify mount inside containerdocker run -it --rm -v $(pwd):/app/target:ro gitleaks-mcp shls -la /app/target

Claude Desktop Not Finding MCP Servers

bash
# Verify config location# macOS: ~/Library/Application Support/Claude/claude_desktop_config.json# Windows: %APPDATA%\Claude\claude_desktop_config.json
# Check JSON syntaxcat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq .
# Restart Claude Desktop after config changes
# Verify image existsdocker images | grep nmap-mcp

API Key Authentication Failures

bash
# Verify environment variable is setecho $SHODAN_API_KEY
# Pass to Docker containerdocker run -e SHODAN_API_KEY=$SHODAN_API_KEY shodan-mcp
# For Claude Desktop, use full env var syntax{  "command": "docker",  "args": ["-e", "SHODAN_API_KEY=${SHODAN_API_KEY}", ...]}

Network Connectivity Issues

bash
# Some tools need host network accessdocker run --network host nmap-mcp
# Or create custom networkdocker network create security-netdocker run --network security-net nmap-mcp

Container Build Failures

bash
# Clear Docker build cachedocker builder prune -a
# Rebuild with no cachedocker-compose build --no-cache nmap-mcp
# Check base image availabilitydocker pull alpine:3.19docker pull python:3.11-slim

Advanced Usage

Custom Nuclei Templates

bash
# Mount custom template directorydocker run -i --rm \  -v $(pwd)/custom-templates:/nuclei-templates:ro \  nuclei-mcp:latest
# In Claude: "Use custom nuclei templates from /nuclei-templates"

Multi-Stage Binary Analysis

bash
# 1. Extract firmwaredocker run -v $(pwd)/firmware:/samples:ro binwalk-mcp
# 2. Scan extracted filesdocker run -v $(pwd)/firmware/_extracted:/samples:ro yara-mcp
# 3. Analyze suspicious binariesdocker run -v $(pwd)/firmware/_extracted:/samples:ro radare2-mcp

Automated Scanning Pipeline

bash
#!/bin/bash# scan-pipeline.sh
TARGET=$1
# Network scandocker run --rm --cap-add=NET_RAW nmap-mcp \  -A $TARGET > nmap-results.txt
# Web fingerprintingdocker run --rm whatweb-mcp $TARGET > whatweb-results.txt
# Vulnerability scandocker run --rm nuclei-mcp -u $TARGET -severity high,critical \  > nuclei-results.txt

Integration with Existing Tools

bash
# Export Trivy results to JSONdocker run --rm -v /var/run/docker.sock:/var/run/docker.sock \  trivy-mcp image nginx:latest -f json > trivy-report.json
# Parse and filter with jqcat trivy-report.json | jq '.Results[] | select(.Vulnerabilities)'

References

來源與署名

來源：reason-machines/security-skills位於skills/mcp-security-hub提交304c245

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 reason-machines/security-skills 的技能

Vibe Pentest Ai Security Testing

reason-machines

針對網頁應用程式、API 與管理後台的 AI 多代理自動化滲透測試，並產出安全報告。

Security112 個月前更新

Unisecurityguard Academic Whistleblower Archive

reason-machines

指導建立以 GitHub 為基礎的學術職場舉報與遭審查社群媒體證據典藏平台。

Security112 個月前更新

Security Detections Mcp

reason-machines

用於搜尋與分析安全偵測規則並對應 MITRE ATT&CK 涵蓋範圍的 MCP 伺服器技能。

Security112 個月前更新

Security Threat Awareness

reason-machines

提醒使用者警覺偽裝成破解安全軟體的 GitHub 惡意軟體散布倉庫。

Security112 個月前更新

S800 Vehicle Network Security Testing

reason-machines

指導車用 CAN 匯流排與車載網路的安全測試，涵蓋流量擷取、模糊測試、ECU 掃描、重播與 UDS 診斷。

Security112 個月前更新

Pentest Agents Bug Bounty Framework

reason-machines

自主漏洞賞金框架，內含狩獵代理、驗證關卡、漏洞利用鏈與平台 MCP 伺服器。

Security112 個月前更新

更多Security技能

Kyc Rules

anthropics

精選

將公司的 KYC/AML 規則表套用於已解析的開戶紀錄，評定風險並給出處理路由。

Security39K2 週前更新

Compliance Tracking

anthropics

精選

追蹤合規要求、稽核準備情況，以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的證據。

Security27K今天更新

Dpop Adoption

google

精選

指導為 Google OAuth 平台實作 OAuth 2.0 DPoP（RFC 9449）傳送方約束的更新權杖。

Security21K今天更新

Secops Triage

google

精選

引導 SOC 分析師對 Google SecOps 安全警示進行分診，從調查到結案或升級。

Security21K今天更新

Secops Investigate

google

精選

指導 SOC 分析師在 Google SecOps 中使用 UDM 查詢與時間軸進行深入的安全事件與實體調查。

Security21K今天更新

Secops Hunt

google

精選

指導在 Google SecOps 中使用 UDM 查詢、IoC 回溯、普遍性與異常分析進行主動威脅狩獵。

Security21K今天更新