mcp-for-security
MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan and more. Integrate security testing and penetration testing into AI workflows.
No outside reports on file
This tool gives AI direct power to run real hacking and network scanning tools, so use it only in isolated lab environments with explicit permission and strict controls on what targets it can reach.
Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (cyproxio/mcp-for-security)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/cyproxio/mcp-for-security ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-27.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About MCP For Security
This is a Model Context Protocol (MCP) connector that plugs security testing tools—like SQLMap, FFUF, Nmap, and Masscan—into AI assistants so they can run penetration tests and security scans through natural language commands. It aims to automate security workflows by letting AI coordinate these hacking and scanning tools.
Who it’s for
Security researchers and penetration testers who want to integrate automated security tools into AI-assisted workflows. It's for people who already know how to use these tools and want to orchestrate them via AI.
Alternatives
- Metasploit Framework (stand-alone penetration testing, not MCP-integrated)
- OWASP ZAP (web application security scanner, manual or API-driven)
- Custom Python scripts with security libraries (full control, no AI automation)
- Commercial red-team platforms like Burp Suite Enterprise (more safety controls)
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README on GitHub for installation steps. Typically you would clone the repository and configure it in your Claude Desktop mcpServers JSON block, but exact setup depends on which security tools you have installed locally.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 628
- Listing last refreshed
- 2026-10-27
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Direct system access: These tools can scan, probe, and exploit network targets; the AI could accidentally or maliciously run scans against systems you don't own or aren't authorized to test.
- Credential exposure: API keys, database passwords, or authentication tokens used by security tools could be logged, cached, or leaked through AI conversations.
- Unintended scope: The AI might misunderstand which networks or systems to target and run aggressive scans in the wrong place.
- Tool misuse: Security scanners like SQLMap can cause damage if pointed at production databases; an AI might not understand the consequences.
- Injection in results: If tool output contains specially crafted data, it could trick the AI into taking harmful actions or revealing sensitive findings.
How to lower the risk
Least-privilege permissions
- Run the connector on an unprivileged local account with no admin rights.
- Restrict network access so scans can only reach approved lab systems, not production.
Network isolation
- Use a separate, air-gapped network or sandbox for security testing.
- Never connect it to systems containing real customer data or live services.
Monitoring
- Log all commands the AI sends to security tools and their results.
- Alert on any unexpected targets or unusual scan patterns.
Red flags to watch for
- AI suggesting scans outside your approved test targets.
- Requests to scan competitor or third-party systems.
- Attempts to enable debug or verbose output that might leak secrets.
Questions
How do I install MCP For Security?
MCP For Security does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/cyproxio/mcp-for-security.
Are there security reports about MCP For Security?
No reports found for this package in our research (last checked 2026-10-30). MCP For Security currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include direct system access, credential exposure, unintended scope.
Is MCP For Security actively maintained?
MCP For Security has 628 GitHub stars. Our directory data was last refreshed on 2026-10-27. Check recent commit activity, release tags, and open issues at github.com/cyproxio/mcp-for-security before pinning it in production.
What are alternatives to MCP For Security?
Notable alternatives to MCP For Security include Metasploit Framework, OWASP ZAP, Custom Python scripts, Commercial red-team platforms. You can also compare MCP For Security side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use MCP For Security? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/cyproxio-mcp-for-security)HTML embed:
<a href="https://agentarmorhq.com/skills/cyproxio-mcp-for-security"><img src="https://agentarmorhq.com/api/badge/cyproxio-mcp-for-security" alt="AgentArmorHQ Risk Grade for MCP For Security" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "cyproxio-mcp-for-security"Share with your security lead
Need sign-off to use mcp-for-security? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: mcp-for-security
- **Listing URL:** https://agentarmorhq.com/skills/cyproxio-mcp-for-security
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 628 GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (cyproxio/mcp-for-security)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/cyproxio/mcp-for-security
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- cyproxio
- Source code
- github.com/cyproxio/mcp-for-security
- Est. context load
- ~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
- Popularity
- 628 GitHub stars
- Last updated
- 2026-10-27
- Last graded
- 2026-10-27
Community
Discussions for MCP For Security
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude