Cybersec Toolkit

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/26zl-cybersec-toolkit

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

10 read · 0 write · 5 delete

Secrets

None asked for

Install scripts

None found

Runs as

Docker image

Tools (15)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_installedread-only

  Check if a specific cybersecurity tool is installed on the system. Uses six detection strategies: .versions tracking, PATH lookup, binary-name fallback, git clone directory, run_script venv, and docker image. When host is provided, checks installation on the remote host via SSH using 'which <binary>'. Args: tool_name: Name of the tool to check (as listed in tools_config.json). host: Optional remote host name (as configured via manage_remote_hosts). Returns: Installation status with detection method and details.

• get_cve_inforead-only

  Map a CVE to the toolkit's tools, skills, and modules, plus live-lookup commands. Local-first and deterministic: accepts a CVE id (e.g. "CVE-2021-44228") or a common nickname (e.g. "log4shell", "eternalblue", "zerologon", "printnightmare") and returns the curated exploitation skills, mapped registry tools with install status, and relevant modules. For live CVSS / CISA KEV / EPSS data it returns ready-to-run run_tool("curl", ...) commands rather than fetching itself — those hit external hosts and are subject to the CYBERSEC_MCP_ALLOW_EXTERNAL policy. Always clear the authorization-gate skill …

• get_module_inforead-only

  Get full details about a module: description, all tools, and management commands. Args: module: Module name (e.g. "web", "pwn", "forensics"). Returns: Module description, tool list with install status, and install/update/remove commands.

• get_profile_toolsread-only

  List every tool that a specific profile would install. Given a profile name, returns the complete list of tools grouped by module, with install status for each. This lets you see exactly what you get before running the install command. A full profile lists hundreds of tools; pass counts_only=True for just the per-module counts and totals when the full tool list is not needed. Args: profile: Profile name (e.g. "ctf", "redteam", "web", "full"). counts_only: If true, omit the per-tool entries and return only per-module and overall counts. Returns: All tools in the profile …

• get_tool_inforead-only

  Get detailed information about a cybersecurity tool. Returns the tool's install method, module, URL, installation status, module description, and management commands (install, update, remove). Args: tool_name: Name of the tool to look up. Returns: Full tool details including install/update/remove commands.

• guided_assessmentcan change or delete data

  Plan, guide, or autonomously solve a security task over the MCP toolchain. An orchestrator on top of the registry, advisors, install checks, audit logging, and execution policy. Bootstrap commands use the governed execute_tool() path, so target scope, external-network, shell-injection, and blocked-flag checks apply. By DEFAULT it auto-detects the right workflow + tools for the problem (workflow/ target_type="auto") and acts as a companion: it returns classification, triage gates, recommended skills, reporting next steps, a plan, tool install status, next actions, and the full MCP toolchain s…

• list_profilesread-only

  List all 14 available installation profiles with details. Each profile is a curated set of modules targeting a specific use case. Shows module count, tool count, and install command for each profile. Profiles range from 'osint' (2 modules) to 'full' (18 modules, 670+ tools). Returns: All profiles with descriptions, module lists, tool counts, and install commands.

• list_toolsread-only

  List and filter the 670+ cybersecurity tools in the registry. Returns the tools drawn from tools_config.json — the same registry the installer and the advisors share — with the total count, the filters still available to narrow the results, and one entry per tool. Combine the filters to scope the list: module="web" for web tools, method="pipx" for Python-packaged tools, installed_only=True for only what is on this host. Start here to discover what exists before check_installed or get_tool_info. The full list is large (~670 entries). Pass limit/offset to page through it and keep the response …

• manage_remote_hostscan change or delete data

  Add, list, test, or remove the SSH hosts that run_tool can target remotely. Manages the remote-host registry that lets run_tool (and check_installed) run a tool on a remote Kali/Linux box over SSH instead of locally, so the tool only has to be installed on the remote. The action selects the operation: "list" shows every configured host; "add" registers or updates a host (needs name and hostname, plus optional user, port, ssh_key, and a tool_allowlist that restricts which tools may run there); "remove" deletes a host by name; "test" opens an SSH connection to confirm the host is reachable. Co…

• recommend_installread-only

  Recommend which profile, modules, or individual tools to install. Analyzes a natural-language description of what the user wants to do and recommends the best installation approach — from a full profile down to just a few individual tools. Avoids installing everything when only a subset is needed. Examples: "I want to do CTF competitions" → ctf profile "web application pentesting" → web profile "I just need nmap and ffuf" → individual tools (networking + web modules) "crack some password hashes" → crackstation profile "forensics and incident response" → forensics profile …

• run_pipelinecan change or delete data

  Execute a pipeline of tools, piping stdout from each step into stdin of the next. Replaces shell piping (e.g. `strings binary | grep flag`) with a safe, no-shell alternative. Each step is validated individually (allowlist, argument sanitization, policy checks) before any process starts. Policy checks inspect each step's arguments only. A step that takes its target from stdin (what the previous step printed) is not scope-checked on that piped data, so a pipeline can reach an external target that a single run_tool call would reject under CYBERSEC_MCP_ALLOW_EXTERNAL=0. Treat pipelines as comman…

• run_scriptcan change or delete data

  Write and execute a Python or Bash script, returning its output. Writes the code to a temporary file, executes it via python3/bash, and returns stdout/stderr. The temp file is deleted after execution. Requires CYBERSEC_MCP_ALLOW_SCRIPTS=1. This is an explicit full-code execution opt-in: scripts run outside the MCP policy layer and are not constrained by CYBERSEC_MCP_ALLOW_EXTERNAL. Their only OS isolation is the launch mode: the Kata VM by default, none in --local mode. Use cases: - Pwntools exploits: buffer overflows, ROP chains, format strings - Z3 constraint solving: reverse engin…

• run_toolcan change or delete data

  Execute an installed cybersecurity tool or system utility and return its output. Runs tools from the 670+ registry as well as ~120 standard system utilities (strings, file, curl, grep, base64, xxd, jq, etc.) that are allowed without being in the registry. Arguments are sanitized to prevent shell injection. Timeout is clamped to 1-300s. Output is truncated at 200KB. Network tools (including curl, wget, ping, etc.) are restricted to local/private targets by default. Set CYBERSEC_MCP_ALLOW_EXTERNAL=1 to allow external targets. When host is provided, the tool is executed on the remote host via …

• suggest_for_bountyread-only

  Suggest cybersecurity tools for a bug bounty target type. Provides curated tool recommendations with installation status, methodology steps (starting with scope verification), common vulnerabilities, and quick wins for 7 target types: web_app, api, mobile_app, cloud, network, iot, llm. Also accepts aliases: web/webapp (web_app), rest/graphql (api), android/ios/mobile (mobile_app), aws/azure/gcp/k8s (cloud), infra/infrastructure (network), firmware/embedded (iot). Args: target_type: Type of bug bounty target (e.g. "web_app", "api", "cloud"). Returns: Suggested tools with install sta…

• suggest_for_ctfread-only

  Suggest cybersecurity tools for a CTF challenge category. Provides curated tool recommendations with installation status for 14 challenge types: web, crypto, pwn, reversing, forensics, stego, misc, networking, wireless, osint, cloud, mobile, blockchain, llm. Also accepts aliases: re/rev (reversing), binary/exploitation (pwn), steganography (stego), network (networking), recon (osint), etc. Args: challenge_type: Type of CTF challenge (e.g. "web", "crypto", "pwn"). Returns: Suggested tools with descriptions and install status, plus relevant modules.

Signals

Stars

80

Forks

16

Open issues

1

Last commit

Oct 23, 2026 (6 days ago)

Last release

Oct 15, 2026 (14 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.26zl/cybersec-toolkit

Version

1.4.0

Auth

No auth

Packages

oci ghcr.io/26zl/cybersec-toolkit:1.4.0

License

MIT

Repository

github.com/26zl/cybersec-toolkit

First seen

Oct 24, 2026

Last checked

Oct 25, 2026

Source

Official MCP Registrygithub-graphql