Skip to main content
affpapa.org
RU EN
skill CX Codex

mcp-security-hub — Claude Code skill: 38 MCP servers in Docker

This skill spins up 38 Dockerized MCP servers for offensive security tooling and wires them into an AI assistant.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill mcp-security-hub -a claude-code
Open on GitHub

What mcp-security-hub does

The skill deploys and orchestrates 38 MCP servers covering more than 300 security tools. The set spans reconnaissance (Nmap, Shodan, Masscan, WhatWeb, ZoomEye, ProjectDiscovery), web security (Nuclei, SQLMap, Nikto, ffuf, Burp Suite), binary analysis (radare2, Ghidra, Binwalk, YARA, Capa, IDA Pro), blockchain, cloud (Trivy, Prowler, RoadRecon), secrets detection, fuzzing, OSINT, Active Directory and password cracking. Scans, binary triage and pentest tasks start from a plain sentence in chat.

Setup runs through Docker: clone the repository, then docker-compose build — you can build only what you need, for instance nmap-mcp nuclei-mcp gitleaks-mcp. Servers are then declared in the client config, either claude_desktop_config.json or a .mcp.json at the project root. Several servers need volume mounts: gitleaks reads repos from /app/target, radare2 reads binaries from /samples, trivy needs docker.sock. Skip the mounts and those tools see nothing.

Docker 20.10+ and Docker Compose 2.0+ are required. External services need keys — SHODAN_API_KEY, VT_API_KEY, ZOOMEYE_API_KEY, BURP_API_KEY — passed into the container with -e. Nmap scanning needs the --cap-add=NET_RAW flag.

What it helps with

  • stand up MCP servers for security tools with one build command
  • scan a subnet for open ports and fingerprint the OS
  • check a site for critical vulnerabilities with Nuclei templates
  • hunt leaked keys and credentials across a git repository
  • pull strings and imports out of a suspicious binary

Example prompts for the agent

  • Bring up nmap-mcp and scan 192.168.1.0/24 for open ports
  • Check https://example.com for critical vulnerabilities with nuclei
  • Find secrets in the repository at /app/target/myrepo

How to install mcp-security-hub

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill mcp-security-hub -a claude-code

2Manually: put the files in place

~/.claude/skills/mcp-security-hub/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/mcp-security-hub/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about mcp-security-hub

How do I install mcp-security-hub in Claude Code?

Run npx skills add reason-machines/security-skills --skill mcp-security-hub -a claude-code, then check ~/.claude/skills/mcp-security-hub/SKILL.md.

What does mcp-security-hub do?

It deploys 38 Dockerized MCP servers holding over 300 tools for reconnaissance, web security, binary analysis, cloud checks and secrets detection, so an AI assistant can call them from chat.

What does mcp-security-hub need to run?

Docker 20.10+ and Docker Compose 2.0+. Servers for external services need API keys such as SHODAN_API_KEY or VT_API_KEY, and Nmap needs the --cap-add=NET_RAW flag.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set24

security-threat-awareness Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub. CX Codex +1 1,000installs malware-analysis-dragonflyTomb-avast A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs avast-premium-security-malware-detection This skill inspects suspicious repositories posing as antivirus installers and points out where malware distribution starts. CX Codex +1 989installs malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor