gaoharimran29-glitch/Cybersecurity-MCP-Server

---
📚 Table of Contents
- Overview
- Features
- Tools & Prompts
- Demo
- Prerequisites
- Installation
- Usage
- Examples
- Registries & Ecosystem
- LLM Client Behavior & Security Considerations
- Legal & Ethical Usage
- Known Limitations
- Project Structure
- Roadmap & Discussions
- Contributing
- License
- Author
---
🌐 Overview
Modern Large Language Models (LLMs) operate in sandboxed, non-deterministic execution environments devoid of native raw-socket access, packet crafting abilities, and live network reconnaissance primitives. When tasked with auditing an attack surface, AI agents are fundamentally constrained by static training cutoff boundaries and an inability to query live network interfaces.
**AynOps bridges this operational divide.** Built on top of the **Model Context Protocol (MCP)** specification using the FastMCP framework, AynOps exposes an extensible suite of deterministic cybersecurity reconnaissance tools directly to LLM agents (such as Cursor, VS Code, Claude Desktop, and custom MCP clients) over a standard JSON-RPC 2.0 stdio transport.
Architectural Highlights
- **🔒 Local-First & Zero-Telemetry Egress**: AynOps runs entirely as a local daemon on your host or isolated container. Target queries, raw IP telemetry, and internal host details never transit through external telemetry collectors.
- **⚡ Wave-Based Concurrent Pipeline**: Orchestrates complex reconnaissance tasks through an intelligent 3-wave async execution model, resolving foundational network primitives in parallel before dispatching dependent service, web, and threat intelligence probes.
- **🧠 Unified Heuristic Signal Extraction**: Raw outputs from heterogeneous utilities (Nmap, dnspython, cryptography, socket APIs) are parsed and normalized into structured threat signals (tools/signals/) designed for direct ingestion by LLM reasoning layers.
- **🛠️ Standardized MCP Tool & Prompt Primitives**: Fully compliant with the official Model Context Protocol standard, packaging ready-to-use tool declarations and meta-prompts (threat_analysis) for automated threat modeling workflows.
---
⚡ Features
AynOps is engineered from the ground up for cybersecurity engineers, red/blue teams, and security researchers seeking deterministic automation:
- 🔒 **100% Local-First Execution**: Self-hosted local daemon with zero telemetry leaks, preserving target confidentiality.
- ⚡ **3-Wave Asynchronous Recon Engine**: Parallelized execution pipeline reducing end-to-end full recon duration by up to 70%.
- 🧠 **Structured Heuristic Signal Extraction**: Translates raw terminal outputs into normalized, machine-readable threat telemetry.
- 🌐 **Comprehensive Perimeter Mapping**: Authoritative WHOIS (RFC 3912), comprehensive DNS RR resolution, and multi-threaded dictionary subdomain brute-forcing.
- 📜 **Certificate Transparency Log Extraction**: Real-time querying of crt.sh append-only Merkle trees for passive subdomain and wildcard SSL discovery.
- 🛡️ **Dangling DNS & Subdomain Takeover Detection**: Resolves CNAME pointers against signatures for 8+ cloud providers (AWS S3, Azure, GitHub Pages, Heroku, Shopify, Fastly, Ghost, Pantheon) with active HTTP verification probing.
- ☁️ **Multi-Cloud Storage Bucket Auditing**: Generates domain keyword permutations and checks for unauthenticated public access across AWS S3, Azure Blob Storage, and Google Cloud Storage.
- 📧 **RFC-Compliant Email Security Assessment**: Audits SPF (v=spf1), DKIM selectors, and DMARC enforcement policies (p=reject/quarantine/none) with quantitative scoring (0–100).
- 🔍 **Multi-Layer Web Technology Fingerprinting**: 4-layer non-intrusive technology identification engine — HTTP response headers (Server, X-Powered-By, CDN markers), Set-Cookie cookie names, tag parsing, and HTML/asset-path substring matching — returning structured detections with confidence scores (0–100) and evidence strings.
- 🔀 **Deep HTTP Redirect Chain & TLS Downgrade Tracer**: Hop-by-hop 3xx status analysis detecting SSL stripping, RFC 1918 internal IP address leaks, redirect loops, and cross-domain hops.
- 🎯 **Real-Time NIST NVD v2 CVE Querying**: Direct REST API integration with NIST National Vulnerability Database for CVSS v3.1/v2 base scores, CWE vectors, and exploit references without requiring API keys.
- 🤖 **Cognitive Threat Analysis Meta-Prompt**: Native MCP prompt template converting raw scan telemetry into prioritized vulnerability matrices and remediation roadmaps.
- 📦 **Container-Ready Architecture**: Bundles a production-ready Dockerfile with pre-installed Nmap and Python 3.12 for zero-dependency stdio deployment.