security-mcp-server by avi686 - MCP Server

Security Testing MCP Server

A Model Context Protocol (MCP) server that provides penetration testing tools for educational purposes using Kali Linux security tools.

Purpose

This MCP server provides a comprehensive interface for AI assistants to perform security testing using popular Kali Linux tools for educational and authorized testing purposes.

Features

Current Implementation

nmap_scan - Network port scanning and service detection with multiple scan types
nikto_scan - Web vulnerability scanning with plugin support
sqlmap_test - SQL injection testing with advanced options
wpscan_test - WordPress vulnerability scanning with API token support
dirb_scan - Directory and file brute forcing with custom wordlists
searchsploit_lookup - Exploit database searching with filters
ping_sweep - Network discovery and connectivity testing
custom_scan - Execute custom commands with whitelisted tools

Quick Start

Clone and Build:

git clone https://github.com/avi686/security-mcp-server.git
cd security-mcp-server
docker build -t security-mcp-server .

Set up MCP Configuration:
```
mkdir -p ~/.docker/mcp/catalogs
```

Create custom catalog (~/.docker/mcp/catalogs/custom.yaml):

version: 2
name: custom
displayName: Custom MCP Servers
registry:
  security:
    description: "Comprehensive penetration testing tools for educational and authorized use"
    title: "Security Testing Tools"
    type: server
    dateAdded: "2025-09-24T00:00:00Z"
    image: security-mcp-server:latest
    ref: ""
    tools:
      - name: nmap_scan
      - name: nikto_scan
      - name: sqlmap_test
      - name: wpscan_test
      - name: dirb_scan
      - name: searchsploit_lookup
      - name: ping_sweep
      - name: custom_scan
    metadata:
      category: security
      tags:
        - penetration-testing
        - security
        - kali-linux
        - educational
      license: MIT
      owner: local

Update registry (~/.docker/mcp/registry.yaml):
```
registry:
  security:
    ref: ""
```

Configure Claude Desktop (add to your config):

{
  "mcpServers": {
    "mcp-toolkit-gateway": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network=host",
        "-v", "/var/run/docker.sock:/var/run/docker.sock",
        "-v", "/path/to/your/home/.docker/mcp:/mcp",
        "docker/mcp-gateway",
        "--catalog=/mcp/catalogs/docker-mcp.yaml",
        "--catalog=/mcp/catalogs/custom.yaml",
        "--config=/mcp/config.yaml",
        "--registry=/mcp/registry.yaml",
        "--tools-config=/mcp/tools.yaml",
        "--transport=stdio"
      ]
    }
  }
}

Restart Claude Desktop

Usage Examples

In Claude Desktop, you can ask:

"Scan example.com for open ports using nmap"
"Check https://testsite.com for web vulnerabilities with nikto"
"Search for Apache exploits in the database"
"Test WordPress site at https://myblog.com for vulnerabilities"
"Brute force directories on https://target.com with custom extensions"
"Perform SQL injection testing on https://webapp.com/page?id=1"

Environment Variables

SCAN_TIMEOUT: Maximum scan time in seconds (default: 300)
DEFAULT_INTENSITY: Nmap timing template T1-T5 (default: T3)
DIRB_WORDLIST: Path to directory wordlist (default: common.txt)
MAX_THREADS: Maximum thread count for tools (default: 10)

Security and Legal Notice

IMPORTANT: This tool is for educational purposes and authorized testing only. Users are responsible for:

Obtaining proper authorization before scanning any systems
Complying with local laws and regulations
Using tools ethically and responsibly
Not using for malicious purposes

The developers assume no responsibility for misuse of these tools.

License

MIT License