# cybersec-toolkit

This MCP server lets an agent find and run security tools for CTFs, pentests, and DFIR. External targets and script execution need explicit permission.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 80
- Author: 26zl
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/26zl/cybersec-toolkit
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/cybersec-toolkit

## What it does

cybersec-toolkit exposes 15 MCP tools for tool discovery, recommendations, and governed execution. Its collection covers 670+ security tools for CTF, pentest, DFIR, and blue-team work. An agent can select tools for a problem and work through it step by step.

The server runs in a disposable Kata Containers VM by default. Sandbox mode requires Linux with KVM, Docker 23+ with a Kata runtime, and Node.js 22+; use host mode on macOS or Windows. External targets and script execution are disabled by default. Those capabilities require explicit authorization.

## Requirements
- Needs: Docker
- Environment variables: `CYBERSEC_MCP_ALLOW_EXTERNAL`, `CYBERSEC_MCP_ALLOW_SCRIPTS` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env CYBERSEC_MCP_ALLOW_EXTERNAL=<CYBERSEC_MCP_ALLOW_EXTERNAL> --env CYBERSEC_MCP_ALLOW_SCRIPTS=<CYBERSEC_MCP_ALLOW_SCRIPTS> --transport stdio cybersec-toolkit -- docker run -i --rm -e CYBERSEC_MCP_ALLOW_EXTERNAL -e CYBERSEC_MCP_ALLOW_SCRIPTS ghcr.io/26zl/cybersec-toolkit:1.4.0
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add cybersec-toolkit --env CYBERSEC_MCP_ALLOW_EXTERNAL=<CYBERSEC_MCP_ALLOW_EXTERNAL> --env CYBERSEC_MCP_ALLOW_SCRIPTS=<CYBERSEC_MCP_ALLOW_SCRIPTS> -- docker run -i --rm -e CYBERSEC_MCP_ALLOW_EXTERNAL -e CYBERSEC_MCP_ALLOW_SCRIPTS ghcr.io/26zl/cybersec-toolkit:1.4.0
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "cybersec-toolkit": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "CYBERSEC_MCP_ALLOW_EXTERNAL",
                "-e",
                "CYBERSEC_MCP_ALLOW_SCRIPTS",
                "ghcr.io/26zl/cybersec-toolkit:1.4.0"
            ],
            "env": {
                "CYBERSEC_MCP_ALLOW_EXTERNAL": "<CYBERSEC_MCP_ALLOW_EXTERNAL>",
                "CYBERSEC_MCP_ALLOW_SCRIPTS": "<CYBERSEC_MCP_ALLOW_SCRIPTS>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "cybersec-toolkit": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "CYBERSEC_MCP_ALLOW_EXTERNAL",
                "-e",
                "CYBERSEC_MCP_ALLOW_SCRIPTS",
                "ghcr.io/26zl/cybersec-toolkit:1.4.0"
            ],
            "env": {
                "CYBERSEC_MCP_ALLOW_EXTERNAL": "<CYBERSEC_MCP_ALLOW_EXTERNAL>",
                "CYBERSEC_MCP_ALLOW_SCRIPTS": "<CYBERSEC_MCP_ALLOW_SCRIPTS>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e CYBERSEC_MCP_ALLOW_EXTERNAL=<CYBERSEC_MCP_ALLOW_EXTERNAL> -e CYBERSEC_MCP_ALLOW_SCRIPTS=<CYBERSEC_MCP_ALLOW_SCRIPTS> cybersec-toolkit docker run -i --rm -e CYBERSEC_MCP_ALLOW_EXTERNAL -e CYBERSEC_MCP_ALLOW_SCRIPTS ghcr.io/26zl/cybersec-toolkit:1.4.0
```
Replace <…> with your own values

## When to use it
- find tools for a CTF challenge
- investigate a suspicious binary
- map a lab network’s attack surface
- select tools for a DFIR investigation

## Example prompts
- Analyze this binary and suggest suitable tools for the investigation.
- Map the attack surface of my lab network at 10.10.0.0/24.
- Find tools for this incident investigation and propose a sequence of steps.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md