26zl/cybersec-toolkit

| Component | What you get |
| --------- | ------------ |
| Installer | 670+ tools in 18 modules, 14 profiles, and 12 install methods for Debian/Ubuntu/Kali/Parrot, Fedora/RHEL, Arch, openSUSE, and Termux |
| MCP server | 15 tools for discovery, advice, and governed execution; external targets and script execution are off by default |
| Sandbox | One Kata Containers VM per session by default; --local runs the server on the host |
| Agent Skills | 872 skills (31 project-authored, 841 curated), also installable as a Claude Code plugin |
> __What makes it different:__ most toolkits stop at _installing_ tools. Here an AI can also _drive_ them: infer the problem type, pick tools from every module and profile, and work through the problem with you step by step. When you explicitly authorize it, the same toolchain runs an autonomous solver loop. __Companion by default; autonomous only when you ask.__ It complements Kali, Parrot, or BlackArch rather than replacing them: it runs on the machine you already have, Termux included.
Quick start · How it works · Trust & safety · Installer · MCP server · Agent Skills · Development · License
Quick start
__1. Install the tools__ on a supported Linux distro or on Termux:
__2. Connect an AI client.__ The tracked configs for Claude Code (.mcp.json, also read by the GitHub Copilot CLI), Codex, Gemini CLI, and OpenCode start the server through scripts/mcp-launch.sh, with external targets and script execution disabled. Choose where the tools run:
| Mode | Tools run | Host needs | One-time setup |
| ---- | --------- | ---------- | -------------- |
| Sandbox (default) | In a disposable Kata VM, from the sandbox image | Linux with KVM, Docker 23+ with a Kata runtime, Node.js 22+ | make sandbox-image, then npm --prefix sandbox ci --ignore-scripts |
| Host (--local) | As your user, with the tools install.sh installed | uv | Add --local to the launcher, or set CYBERSEC_SANDBOX_MODE=local in the client's env |
Kata needs KVM: on macOS, on Windows, and in VMs without nested virtualization, use host mode.
__3. Restart the client.__ The 15 tools appear (/mcp in Claude Code). Then ask for what you need, for example "triage this binary" or "map the attack surface of my lab at 10.10.0.0/24".
How it works
Two entry points share one tool registry. An __operator__ runs the bash installer to put tools on disk: on the host, or into the sandbox image at build time. An __AI agent__ talks to the MCP server, which runs inside a Kata VM by default, to discover, recommend, and execute those tools through one governed path. tools_config.json is the single source of truth that the modules define and the MCP advisors read; CI validators keep the Python and bash sides in sync.
Solid arrows are runtime or installation actions; dashed arrows are validation and context relationships. Client configurations enter through the root-aware launcher, which boots the VM through a Sandcastle Kata provider (sandbox/kata.mjs) — or, with --local, starts the server on the host. security.py governs run_tool and run_pipeline through the allowlist, argument checks, and network policy without invoking a shell. run_script is a separate, disabled-by-default capability that runs arbitrary code. Agent Skills stay outside the execution path: .claude/skills/ is canonical, and scripts/sync-skills.sh generates .agents/skills/ for clients that read the portable mirror. Mermaid source: assets/how-it-works.mmd.
Trust & safety
What runs, and what is gated:
- __Default-safe MCP.__ CYBERSEC_MCP_ALLOW_EXTERNAL=0 rejects network targets that do not resolve to private or loopback ranges, and CYBERSEC_MCP_ALLOW_SCRIPTS=0 disables run_script. External scopes and scripting are explicit opt-ins.
- __One gate for governed execution__ (mcp_server/security.py): registry allowlist, no shell (create_subprocess_exec, never shell=True), argument sanitization, a per-tool blocked-flag denylist (e.g. sqlmap --os-shell, nmap -iL, file-list and target-injection flags), target and network policy, rate limiting, output caps, and timeouts. The policy knows enough CLI grammar to tell a target from a header, wordlist, output path, or target-list flag. Tool output reaches the model without terminal escape sequences or LLM control markers, and lines addressed to an AI reader are flagged.
- __Tools run in a disposable VM by default.__ The launcher boots a Kata Containers VM with its own kernel, no host filesystem beyond an optional CYBERSEC_SANDBOX_WORKSPACE mount, no Docker socket, a non-root user with every capability dropped, and memory, CPU, and process limits. It is destroyed when the client disconnects. Startup fails closed instead of falling back to the host; --local is the explicit opt-out.