A Model Context Protocol (MCP) server that gives AI Clients real-time cybersecurity reconnaissance capabilities. Instead of manually running tools across different terminals, just tell Claude "analyze google.com" and get a complete security breakdown instantly.
What is this?
Claude by default has zero native cybersecurity tooling. No WHOIS. No DNS enumeration. No port scanning. No SSL inspection.
This MCP server fixes that — extending Claude with real-world security tools that run live against any domain or IP. Reconnaissance that normally requires multiple specialized tools and 20+ minutes of manual work becomes a single prompt.
This is a local MCP server — it runs entirely on your machine. Your data never leaves your computer. It is also listed on glama mcp registry.
Tools Available
| Tool | Description |
|---|---|
whois_lookup |
Domain registration data — owner, registrar, creation date, expiry, name servers |
dns_enumeration |
A, AAAA, MX, NS, TXT, CNAME, SOA records + common subdomain brute-forcing |
port_scan |
Nmap-powered scanner with service/version detection and security warnings |
ssl_inspect |
SSL/TLS certificate — issuer, expiry, cipher strength, SANs, TLS version |
headers_analyzer |
Analyzes HTTP security headers — checks HSTS, CSP, X-Frame-Options, and more with severity ratings and misconfiguration details |
email_security_check |
Checks SPF, DKIM, and DMARC DNS records — returns a security_score, rating, and actionable recommendations for missing or weak configurations |
tech_stack_detect |
Web server, CMS, JS frameworks, CDN, analytics, and security header scoring |
cert_transparency |
Subdomain discovery via crt.sh Certificate Transparency logs with an automatic fallback to HackerTarget passive DNS on timeouts |
asn_lookup |
Autonomous System Number (ASN) and network ownership lookup — identifies hosting provider, ISP, organization, geolocation, and infrastructure ownership for domains or IP addresses |
cve_lookup |
Search NVD for known CVEs by software name and version (no API key required) |
ip_reputation |
Check if an IP is flagged as malicious via AbuseIPDB (api key requied) |
full_recon |
Runs all core tools in parallel and returns combined results with claude analysis |
