shyhurricane
by double16
Overview
An MCP server to assist AI in offensive security testing, addressing challenges with LLMs executing noisy/long-running commands, inefficient website enumeration, and prolonged port scans, by providing consistent tools and indexing content.
Installation
docker compose up -dEnvironment Variables
- OLLAMA_MODEL
- OLLAMA_HOST
- GEMINI_API_KEY
- GEMINI_MODEL
- OPENAI_MODEL
- OPENAI_API_KEY
- BEDROCK_MODEL
- AWS_ACCESS_KEY_ID
- AWS_SECRET_ACCESS_KEY
- OAST_PROVIDER
- WEBHOOK_API_KEY
- INTERACT_SERVER
- INTERACT_TOKEN
- DISABLE_ELICITATION
- LOW_POWER
- OPEN_WORLD
- ASSISTANT_TOOLS
Security Notes
This server is designed for offensive security testing, inherently involving high-risk operations. It grants significant privileges to the AI agent, including arbitrary Unix command execution via a Docker-in-Docker setup, which runs with `--privileged` flags and can build/manage other containers. This means a compromised or misbehaving AI could fully compromise the host's Docker daemon. The `DISABLE_ELICITATION: True` setting (default in `docker-compose.dev.yml`) allows the AI to execute commands without explicit user confirmation, further increasing risk. Logging of HTTP requests/responses by `mitm_to_katana.py` and the use of OAST providers, while standard in security testing, could be vectors for sensitive data exposure or exfiltration if not properly isolated.
Similar Servers
mcp-scanner
A Python tool for scanning Model Context Protocol (MCP) servers and tools to detect potential security findings by leveraging Cisco AI Defense API, YARA rules, and LLM-as-a-judge.
VibeShift
VibeShift is an intelligent security agent that integrates with AI coding assistants to analyze AI-generated code for vulnerabilities, suggest remediations, and facilitate web test recording, crawling, and execution.
Reversecore_MCP
The Reversecore_MCP server provides a Micro-Capability Platform (MCP) enabling AI agents to perform comprehensive binary analysis, malware detection, vulnerability research, and security report generation using integrated tools like Radare2, Ghidra, LIEF, and YARA.
MalwareBazaar_MCP
An AI-driven MCP server interfacing with Malware Bazaar for real-time threat intelligence and sample metadata, supporting cybersecurity research workflows.