공격형 보안 MCP 서버
Production-ready, Dockerized MCP (Model Context Protocol) 서버를 위한 공격형 보안 도구입니다. Claude 와 같은 AI 어시스턴트를 사용하여 보안 평가, 취약점 스캔, 바이너리 분석을 수행할 수 있게 합니다.
38 MCP 서버 를 통해 Reconnaissance, 웹 보안, 바이너리 분석, 블록체인 보안, 클라우드 보안, 코드 보안, 시크릿 감지, 위협 지능, OSINT, Active Directory, fuzzing 등 다양한 기능을 제공합니다.
300+ 보안 도구 를 Claude 또는 다른 MCP 클라이언트를 통해 자연어로 접근할 수 있습니다.
Production Hardened - 비 루트 컨테이너 사용, 최소 이미지 크기, Trivy 스캔 적용
Docker Compose 를 통한 멀티 툴 워크플로우 오케스트레이션 지원
CI/CD Ready - GitHub Actions 을 통한 자동 빌드 및 보안 스캔 지원
리포지토리 복제
git clone https://github.com/FuzzingLabs/mcp-security-hub
cd mcp-security-hub
모든 MCP 서버 빌드
docker-compose build
특정 서버 시작
docker-compose up nmap-mcp nuclei-mcp -d
건강 상태 확인
docker-compose ps
Claude Desktop / Claude Code 설정
중요: 사용 전에 docker-compose build 로 이미지를 먼저 빌드해야 합니다.
Claude Desktop 설정에 예제 구성을 복사합니다:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"nmap": {
"command": "docker",
"args": ["run", "-i", "--rm", "--cap-add=NET_RAW", "nmap-mcp:latest"]
},
"nuclei": {
"command": "docker",
"args": ["run", "-i", "--rm", "nuclei-mcp:latest"]
},
"gitleaks": {
"command": "docker",
"args": ["run", "-i", "--rm", "-v", "/path/to/repos:/app/target:ro", "gitleaks-mcp:latest"]
},
"radare2": {
"command": "docker",
"args": ["run", "-i", "--rm", "-v", "/path/to/binaries:/samples:ro", "radare2-mcp:latest"]
}
}
}
프로젝트 수준 구성은 .mcp.json 을 프로젝트 루트로 복사합니다. 예제/ 폴더를 참조하여 모든 MCP 와 볼륨 마운트 패턴이 포함된 전체 구성 템플릿을 확인하세요.
Reconnaissance (8 서버)
Binary Analysis (6 서버)
Blockchain Security (3 서버)
| Server | Tools | Description |
| daml-viewer-mcp | 1 | DAML access-control table generation and run tracking |
| medusa-mcp | 4 | High-performance smart contract fuzzer for Solidity |
| solazy-mcp | 8 | Solana sBPF static analysis and reverse engineering |
Cloud Security (3 서버)
Secrets Detection (1 서버)
| Server | Tools | Description |
| gitleaks-mcp | 5 | Find secrets and credentials in git repos and files |
| Server | Tools | Description |
| boofuzz-mcp | 4 | Network protocol fuzzing using Boofuzz |
| dharma-mcp | 2 | Grammar-based test case generation |
Threat Intelligence (2 서버)
Active Directory (1 서버)
Password Cracking (1 서버)
| Server | Tools | Description |
| mcp-scan | - | Wrapper for mcp-scan - Scan MCP servers for vulnerabilities |
You: "Scan 192.168.1.0/24 for web servers and identify technologies"
Claude: I'll perform a network scan and technology fingerprinting.
[Uses nmap-mcp to scan ports 80,443,8080]
...
You: "Check example.com for common vulnerabilities"
Claude: I'll run a vulnerability scan using nuclei templates.
[Uses nuclei-mcp with cves, exposures, and misconfigurations templates]
...
You: "Analyze this firmware image for security issues"
Claude: I'll extract and analyze the firmware.
[Uses binwalk-mcp to extract filesystem]
...
All containers implement defense-in-depth:
| Control |
Implementation |
Non-root execution |
Runs as mcpuser (UID 1000) |
Minimal images |
Alpine/Debian slim base images |
Dropped capabilities |
cap_drop: ALL, selective cap_add |
No privilege escalation |
security_opt: no-new-privileges:true |
Read-only mounts |
Sample directories mounted read-only |
Resource limits |
CPU and memory constraints |
Health checks |
Built-in container health monitoring |
Vulnerability scanning |
Trivy scans in CI/CD pipeline |
mcp-security-hub/
├── reconnaissance/
│ ├── nmap-mcp/ # Port scanning
...
Run unit tests
pytest tests/ -v
Build and test all Docker images
./scripts/test_builds.sh
Test MCP protocol (after building)
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' |
docker run -i --rm nmap-mcp:latest
These tools are for authorized security testing only.
Before using:
Obtain written authorization from the target owner
Define scope - targets, timeline, allowed activities
Maintain audit logs of all operations
Follow responsible disclosure for any findings
Unauthorized access to computer systems is illegal. Users are responsible for compliance with applicable laws.
Contributions welcome! To add a new MCP server:
as your starting point
- Follow security hardening practices (non-root, minimal image)
- Include health checks and comprehensive README
- Ensure Trivy scan passes (no HIGH/CRITICAL vulnerabilities)
- Add tests to
tests/test_mcp_servers.py
MIT License - See LICENSE
Maintained by FuzzingLabs
Making AI-powered security testing accessible