AynOps/AynOps

## 📚 Table of Contents
Overview
Features
Tools & Prompts
Demo
Prerequisites
Installation
Usage
Examples
Registries & Ecosystem
LLM Client Behavior & Security Considerations
Legal & Ethical Usage
Known Limitations
Project Structure
Roadmap & Discussions
Contributing
License
Author
## 🌐 Overview
Modern Large Language Models (LLMs) operate in sandboxed, non-deterministic execution environments devoid of native raw-socket access, packet crafting abilities, and live network reconnaissance primitives. When tasked with auditing an attack surface, AI agents are fundamentally constrained by static training cutoff boundaries and an inability to query live network interfaces.
AynOps bridges this operational divide. Built on top of the Model Context Protocol (MCP) specification using the FastMCP framework, AynOps exposes an extensible suite of deterministic cybersecurity reconnaissance tools directly to LLM agents (such as Cursor, VS Code, Claude Desktop, and custom MCP clients) over a standard JSON-RPC 2.0 stdio transport.
┌───────────────────────────┐ JSON-RPC 2.0 (stdio) ┌────────────────────────────────────────────────────────┐
│ AI / LLM Client │ ◄──────────────────────────────────► │ AynOps MCP Server │
│ (Cursor, VS Code, Claude) │ │ (Local Daemon) │
└───────────────────────────┘ └──────────────────────────┬─────────────────────────────┘
┌───────────────────────────────────────────────────────────┴──────────────────────────────┐
▼ ▼ ▼
┌──────────────────────────┐ ┌──────────────────────────┐ ┌──────────────────────────┐
│ Active Network │ │ DNS & OSINT │ │ Web & Cloud Audits │
│ • Nmap Port Scanner │ │ • Authoritative WHOIS │ │ • SSL/TLS X.509 Parser │
│ • Team Cymru ASN BGP │ │ • dnspython Resolver │ │ • HTTP Headers Linting │
│ • AbuseIPDB Threat Intel│ │ • crt.sh CT Log Parser │ │ • Multi-Cloud Storage │
└──────────────────────────┘ │ • Subdomain Takeover │ │ • Redirect Hop Tracer │
└──────────────────────────┘ └──────────────────────────┘
### Architectural Highlights
🔒 Local-First & Zero-Telemetry Egress: AynOps runs entirely as a local daemon on your host or isolated container. Target queries, raw IP telemetry, and internal host details never transit through external telemetry collectors.
⚡ Wave-Based Concurrent Pipeline: Orchestrates complex reconnaissance tasks through an intelligent 3-wave async execution model, resolving foundational network primitives in parallel before dispatching dependent service, web, and threat intelligence probes.
🧠 Unified Heuristic Signal Extraction: Raw outputs from heterogeneous utilities (Nmap, dnspython, cryptography, socket APIs) are parsed and normalized into structured threat signals (tools/signals/) designed for direct ingestion by LLM reasoning layers.
🛠️ Standardized MCP Tool & Prompt Primitives: Fully compliant with the official Model Context Protocol standard, packaging ready-to-use tool declarations and meta-prompts (threat_analysis) for automated threat modeling workflows.
## ⚡ Features
AynOps is engineered from the ground up for cybersecurity engineers, red/blue teams, and security researchers seeking deterministic automation:
🔒 100% Local-First Execution: Self-hosted local daemon with zero telemetry leaks, preserving target confidentiality.