MCP Security Hub

mcp-security-hub

Skill by ara.so — Security Skills collection.

Overview

mcp-security-hub is a production-ready collection of 38 Dockerized MCP (Model Context Protocol) servers that expose 300+ offensive security tools to AI assistants like Claude. It enables natural language security assessments, vulnerability scanning, binary analysis, and penetration testing workflows.

Key capabilities:

• 8 reconnaissance servers (Nmap, Shodan, ProjectDiscovery tools, WhatWeb, Masscan, ZoomEye)
• 6 web security servers (Nuclei, SQLMap, Nikto, ffuf, Burp Suite)
• 6 binary analysis servers (radare2, Ghidra, Binwalk, YARA, Capa, IDA Pro)
• 3 blockchain security servers (DAML Viewer, Medusa, Solazy)
• 3 cloud security servers (Trivy, Prowler, RoadRecon)
• Plus: secrets detection, fuzzing, OSINT, threat intelligence, Active Directory, password cracking

Installation

Prerequisites

• Docker 20.10+
• Docker Compose 2.0+
• Claude Desktop or MCP-compatible client

Clone and Build

git clone https://github.com/FuzzingLabs/mcp-security-hub.git
cd mcp-security-hub

# Build all MCP servers
docker-compose build

# Or build specific servers
docker-compose build nmap-mcp nuclei-mcp gitleaks-mcp

Verify Installation

# Check built images
docker images | grep mcp

# Start specific servers
docker-compose up nmap-mcp nuclei-mcp -d

# Verify health
docker-compose ps

Configuration

Claude Desktop Integration

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "nmap": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]
    },
    "nuclei": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]
    },
    "gitleaks": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "${HOME}/repos:/app/target:ro",
        "gitleaks-mcp:latest"
      ]
    },
    "radare2": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "${HOME}/binaries:/samples:ro",
        "radare2-mcp:latest"
      ]
    },
    "sqlmap": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "sqlmap-mcp:latest"]
    },
    "trivy": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/var/run/docker.sock:/var/run/docker.sock:ro",
        "trivy-mcp:latest"
      ]
    }
  }
}

Project-Level Configuration

Create .mcp.json in your project root:

{
  "mcpServers": {
    "nmap": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]
    },
    "nuclei": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "nuclei-mcp:latest"]
    }
  }
}

Environment Variables

Many MCP servers require API keys for external services:

# Shodan
export SHODAN_API_KEY=your_key_here

# VirusTotal
export VT_API_KEY=your_key_here

# ZoomEye
export ZOOMEYE_API_KEY=your_key_here

# Burp Suite
export BURP_API_KEY=your_key_here

Pass environment variables to Docker containers:

{
  "mcpServers": {
    "shodan": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "SHODAN_API_KEY=${SHODAN_API_KEY}",
        "shodan-mcp:latest"
      ]
    }
  }
}

Key MCP Servers

Nmap MCP (Network Scanning)

Available tools (8):

• scan_hosts - Basic host discovery
• scan_ports - Port scanning with service detection
• scan_os - OS fingerprinting
• scan_vuln - Vulnerability scanning with NSE scripts
• scan_custom - Custom nmap command execution
• list_nse_scripts - List available NSE scripts
• get_nse_script_info - Get NSE script details
• scan_with_script - Run specific NSE script

Example prompts:

• "Scan 192.168.1.0/24 for open ports"
• "Perform OS detection on 10.0.0.1"
• "Run vulnerability scan on example.com"

Nuclei MCP (Vulnerability Scanning)

Available tools (7):

• scan_target - Scan with default templates
• scan_with_severity - Filter by severity (critical, high, medium, low)
• scan_with_tags - Use specific tags (cve, exposure, xss, sqli)
• scan_with_templates - Use custom template paths
• list_templates - Show available templates
• update_templates - Update template database
• scan_multiple_targets - Bulk scanning

Example prompts:

• "Scan https://example.com for critical vulnerabilities"
• "Check example.com for CVEs using nuclei"
• "Run nuclei with exposure and misconfiguration templates"

Gitleaks MCP (Secrets Detection)

Available tools (5):

• scan_repo - Scan git repository
• scan_file - Scan individual file
• scan_directory - Scan directory tree
• generate_baseline - Create baseline for false positives
• scan_commits - Scan specific commit range

Example prompts:

• "Scan /app/target/myrepo for secrets"
• "Check this project for exposed API keys"
• "Find credentials in the last 10 commits"

Volume mounting required:

{
  "gitleaks": {
    "command": "docker",
    "args": [
      "run", "-i", "--rm",
      "-v", "/path/to/repos:/app/target:ro",
      "gitleaks-mcp:latest"
    ]
  }
}

Radare2 MCP (Binary Analysis)

Available tools (32+):

• analyze_binary - Load and analyze binary
• disassemble - Disassemble functions
• decompile - Decompile to C-like code
• list_functions - Show all functions
• find_strings - Extract strings
• find_imports - List imported functions
• find_exports - List exported functions
• search_bytes - Search byte patterns
• analyze_entropy - Detect packed sections

Example prompts:

• "Analyze /samples/malware.exe for suspicious functions"
• "Decompile main function in this binary"
• "Find strings in /samples/firmware.bin"

Volume mounting required:

{
  "radare2": {
    "command": "docker",
    "args": [
      "run", "-i", "--rm",
      "-v", "/path/to/binaries:/samples:ro",
      "radare2-mcp:latest"
    ]
  }
}

SQLMap MCP (SQL Injection)

Available tools (8):

• test_url - Test URL for SQL injection
• dump_database - Extract database contents
• dump_table - Extract specific table
• list_databases - Enumerate databases
• list_tables - Enumerate tables
• get_dbs - Get database names
• get_current_user - Get DB user
• test_forms - Test web forms for SQLi

Example prompts:

• "Test https://example.com/page?id=1 for SQL injection"
• "Dump database from vulnerable URL"
• "Check this form for SQL injection vulnerabilities"

Trivy MCP (Container Security)

Available tools (7):

• scan_image - Scan Docker image
• scan_filesystem - Scan local filesystem
• scan_config - Scan IaC files (Terraform, K8s)
• scan_repo - Scan git repository
• list_vulnerabilities - Show known CVEs
• get_sbom - Generate SBOM
• scan_kubernetes - Scan K8s cluster

Example prompts:

• "Scan nginx:latest for vulnerabilities"
• "Check this Dockerfile for security issues"
• "Generate SBOM for python:3.11 image"

Common Workflows

Network Reconnaissance Workflow

# 1. Build reconnaissance servers
docker-compose build nmap-mcp whatweb-mcp masscan-mcp

# 2. Start services
docker-compose up nmap-mcp whatweb-mcp -d

# 3. Use in Claude
# "Scan 10.0.0.0/24 for web servers, then fingerprint each one"

Web Application Security Assessment

# Build web security stack
docker-compose build nuclei-mcp sqlmap-mcp ffuf-mcp

# Start services
docker-compose up nuclei-mcp sqlmap-mcp ffuf-mcp -d

# In Claude:
# "Scan example.com with nuclei, test any forms for SQL injection,
#  and fuzz for hidden directories"

Binary Analysis Pipeline

# Build binary analysis tools
docker-compose build radare2-mcp binwalk-mcp yara-mcp capa-mcp

# Mount binaries directory
docker-compose up radare2-mcp binwalk-mcp yara-mcp capa-mcp -d