Cybersec Toolkit

Name: Cybersec Toolkit
Author: 26zl

by 26zlversion 1.4.0i★ –iRuns on your computer

Registry nameio.github.26zl/cybersec-toolkit

Install

Overview

Description from the maker (original English)

Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Cybersecurity

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: CYBERSEC_MCP_ALLOW_EXTERNAL, CYBERSEC_MCP_ALLOW_SCRIPTS

You need

DockerDocker installed

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "cybersec-toolkit": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "CYBERSEC_MCP_ALLOW_EXTERNAL",
        "-e",
        "CYBERSEC_MCP_ALLOW_SCRIPTS",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ],
      "env": {
        "CYBERSEC_MCP_ALLOW_EXTERNAL": "your-value",
        "CYBERSEC_MCP_ALLOW_SCRIPTS": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add cybersec-toolkit --env CYBERSEC_MCP_ALLOW_EXTERNAL=your-value --env CYBERSEC_MCP_ALLOW_SCRIPTS=your-value -- docker run -i --rm -e CYBERSEC_MCP_ALLOW_EXTERNAL -e CYBERSEC_MCP_ALLOW_SCRIPTS ghcr.io/26zl/cybersec-toolkit:1.4.0 run --directory mcp_server fastmcp run server.py --transport stdio --no-banner

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "cybersec-toolkit": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "CYBERSEC_MCP_ALLOW_EXTERNAL",
        "-e",
        "CYBERSEC_MCP_ALLOW_SCRIPTS",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ],
      "env": {
        "CYBERSEC_MCP_ALLOW_EXTERNAL": "your-value",
        "CYBERSEC_MCP_ALLOW_SCRIPTS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "cybersec-toolkit": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "CYBERSEC_MCP_ALLOW_EXTERNAL",
        "-e",
        "CYBERSEC_MCP_ALLOW_SCRIPTS",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ],
      "env": {
        "CYBERSEC_MCP_ALLOW_EXTERNAL": "your-value",
        "CYBERSEC_MCP_ALLOW_SCRIPTS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

CYBERSEC_MCP_ALLOW_EXTERNAL env
Set to 1 only for explicitly authorized external scopes.
CYBERSEC_MCP_ALLOW_SCRIPTS env
Set to 1 to enable unsandboxed run_script execution.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account 26zl, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Cybersecurityi

More stars than 0% of the other 1003 servers in this category
Published to the registry more recently than 62% of the other 1003 servers in this category
Basic checks equal to or better than 100% of the other 1003 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Cybersec Toolkit safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.4.0) reached the registry 24 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.

What can I use instead?

In the same category: Zeqqat, 4da MCP Server, Dependency Vulnerability Tracker — package security advisories ($0.01/query)

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Zeqqat

The safe MCP for Dokploy: agents deploy and fix apps without holding keys or seeing secrets.

by zeqqatVery newUpdated today

Runs in the cloud

Install

4da MCP Server

Upgrade intelligence for AI agents: what an upgrade changes, where it touches your code, CVE scans.

by 4DA-SystemsVery new↓ 254/wkUpdated today

Runs on your computer

Install

Dependency Vulnerability Tracker — package security advisories ($0.01/query)

Dependency vulns & malicious-package advisories. Be born in one call — free testnet funds.

by ee324EarlyUpdated today

Runs in the cloud✓ a2awire.com

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

    /\   /\        ______      __              _____

(o ) ( o) / ____/_ __/ /_ _ _/ _/_ ___ \ \_/ / / / / / / / __ \/ _ \/ _/\ \/ _ \/ _/ <==\ /==> / /_/ /_/ / /_/ / / / _/ / / / \ V / \__/\, /_._/\_/_/ /__/\_/\___/ /_ _\ /____/ by 26zl |_| Toolkit

A security toolkit that AI agents can drive, under rules you set. One command installs 670+ security tools on Linux or Termux. An MCP (Model Context Protocol) server lets Claude Code, Codex, Gemini CLI, OpenCode, and other MCP clients discover, recommend, and run those tools through a governed execution path, inside a disposable Kata Containers VM by default. 872 Agent Skills supply the methodology for CTF, pentest, bug bounty, DFIR, and blue-team work.

Component	What you get
Installer	670+ tools in 18 modules, 14 profiles, and 12 install methods for Debian/Ubuntu/Kali/Parrot, Fedora/RHEL, Arch, openSUSE, and Termux
MCP server	15 tools for discovery, advice, and governed execution; external targets and script execution are off by default
Sandbox	One Kata Containers VM per session by default; `--local` runs the server on the host
Agent Skills	872 skills (31 project-authored, 841 curated), also installable as a Claude Code plugin

What makes it different: most toolkits stop at _installing_ tools. Here an AI can also _drive_ them: infer the problem type, pick tools from every module and profile, and work through the problem with you step by step. When you explicitly authorize it, the same toolchain runs an autonomous solver loop. Companion by default; autonomous only when you ask. It complements Kali, Parrot, or BlackArch rather than replacing them: it runs on the machine you already have, Termux included.

Quick start · How it works · Trust & safety · Installer · MCP server · Agent Skills · Development · License

Quick start

1. Install the tools on a supported Linux distro or on Termux:

git clone --depth 1 --branch v1.4.0 https://github.com/26zl/cybersec-toolkit.git && cd cybersec-toolkit

./install.sh --doctor # read-only preflight: distro, prerequisites, MCP server, sandbox sudo ./install.sh --profile ctf # one profile; with no flags, all 18 modules

2. Connect an AI client. The tracked configs for Claude Code (.mcp.json, also read by the GitHub Copilot CLI), Codex, Gemini CLI, and OpenCode start the server through scripts/mcp-launch.sh, with external targets and script execution disabled. Choose where the tools run:

Mode	Tools run	Host needs	One-time setup
Sandbox (default)	In a disposable Kata VM, from the sandbox image	Linux with KVM, Docker 23+ with a Kata runtime, Node.js 22+	`make sandbox-image`, then `npm --prefix sandbox ci --ignore-scripts`
Host (`--local`)	As your user, with the tools `install.sh` installed	uv	Add `--local` to the launcher, or set `CYBERSEC_SANDBOX_MODE=local` in the client's `env`

Kata needs KVM: on macOS, on Windows, and in VMs without nested virtualization, use host mode.

3. Restart the client. The 15 tools appear (/mcp in Claude Code). Then ask for what you need, for example "triage this binary" or "map the attack surface of my lab at 10.10.0.0/24".

How it works

Two entry points share one tool registry. An operator runs the bash installer to put tools on disk: on the host, or into the sandbox image at build time. An AI agent talks to the MCP server, which runs inside a Kata VM by default, to discover, recommend, and execute those tools through one governed path. tools_config.json is the single source of truth that the modules define and the MCP advisors read; CI validators keep the Python and bash sides in sync.

Solid arrows are runtime or installation actions; dashed arrows are validation and context relationships. Client configurations enter through the root-aware launcher, which boots the VM through a Sandcastle Kata provider (sandbox/kata.mjs) — or, with --local, starts the server on the host. security.py governs run_tool and run_pipeline through the allowlist, argument checks, and network policy without invoking a shell. run_script is a separate, disabled-by-default capability that runs arbitrary code. Agent Skills stay outside the execution path: .claude/skills/ is canonical, and scripts/sync-skills.sh generates .agents/skills/ for clients that read the portable mirror. Mermaid source: assets/how-it-works.mmd.

Trust & safety

What runs, and what is gated:

Default-safe MCP. CYBERSEC_MCP_ALLOW_EXTERNAL=0 rejects network targets that do not resolve to private or loopback ranges, and CYBERSEC_MCP_ALLOW_SCRIPTS=0 disables run_script. External scopes and scripting are explicit opt-ins.
One gate for governed execution (mcp_server/security.py): registry allowlist, no shell (create_subprocess_exec, never shell=True), argument sanitization, a per-tool blocked-flag denylist (e.g. sqlmap --os-shell, nmap -iL, file-list and target-injection flags), target and network policy, rate limiting, output caps, and timeouts. The policy knows enough CLI grammar to tell a target from a header, wordlist, output path, or target-list flag. Tool output reaches the model without terminal escape sequences or LLM control markers, and lines addressed to an AI reader are flagged.
Tools run in a disposable VM by default. The launcher boots a Kata Containers VM with its own kernel, no host filesystem beyond an optional CYBERSEC_SANDBOX_WORKSPACE mount, no Docker socket, a non-root user with every capability dropped, and memory, CPU, and process limits. It is destroyed when the client disconnects. Startup fails closed instead of falling back to the host; --local is the explicit opt-out.
Know the limits. The VM is not a network boundary: it reaches whatever its Docker network reaches, and CYBERSEC_MCP_ALLOW_EXTERNAL is a preflight check on resolved addresses, not a firewall (set CYBERSEC_SANDBOX_NETWORK=none or use a filtered network). Inside the VM, and on your host in --local mode, allowed tools run with the server user's permissions, and some of them spawn child processes or load plugins.
Tool output goes to your model provider. Whatever a tool prints — scan results, page content, and any credential or personal data it finds on a target — is returned to the AI client and sent to the model it uses. By default only the local audit log is redacted; set CYBERSEC_MCP_REDACT_OUTPUT=1 to also redact credential-shaped strings from what the client receives. If an engagement's rules forbid sharing client data with a third party, drive the server from a local model (see AI clients).
Repository hooks run automatically. Opening this repository in Claude Code runs the tracked hooks in .claude/settings.json: scripts/agent-guard.sh at session start and before each Bash command. They only emit routing context or a deny decision, make no network calls, and fail open; set CYBERSEC_AGENT_GUARD=0 to disable them.
Audit trail without leaks. Actions are logged as JSON lines to an owner-only (0600), rotating log under the user's state directory (~/.local/state/cybersec-tools-mcp/audit.log by default). Script bodies are never stored, only their SHA256 and length, and credential-shaped strings are redacted from tool arguments. A sandboxed server mirrors its records to the same host log, and records are hash-chained, so an edited or deleted record inside a chain shows up in make audit-verify (limits).
Least privilege in the installer. It runs as root but drops to the invoking user ($SUDO_USER) for cloned-repo builds, go/cargo/gem builds, and project setup steps (theHarvester, pwndbg); binary releases are SHA256-verified when checksums are published. pipx installs (into the shared /opt/pipx) and global npm installs still run as root, so their build and install scripts execute with root privileges — see the supply chain model. Go binaries are copied into /usr/local/bin as root-owned files; cargo, gem, cloned-repo, source-build, patator and Foundry tools are exposed there as links or wrappers into trees the invoking user owns, so that user can change what those commands run.
Dual-use tooling is gated. C2 and phishing frameworks (Sliver, Caldera, gophish, evilginx, …) are off by default and install only with --include-c2 (the redteam and full profiles set it); the MCP layer reflects this and never auto-runs them.
Authorized use only. See SECURITY.md, the supply chain model, and the disclaimer.

Installer

Requirements

A supported Linux distro (Debian/Ubuntu/Kali/Parrot, Fedora/RHEL, Arch, openSUSE) or Termux. Runtimes (Python, Go, Ruby, Java, Rust, Node.js), dev libraries, pipx, and build tools are installed automatically. The installer does not run on macOS or native Windows; use WSL or Docker.

Docker is needed for --enable-docker (C2 frameworks, MobSF, BeEF, BloodHound, TheHive, Cortex) and for the blueteam, redteam, blockchain, and mobile profiles, which enable Docker images by default (see Profiles). Install it yourself: Docker Engine docs.
GitHub authentication is recommended. The installer download

Only the beginning is shown; read the rest in the repo

Cybersec Toolkit

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Cybersecurityi

Common questions

Alternatives

Zeqqat

4da MCP Server

Dependency Vulnerability Tracker — package security advisories ($0.01/query)

README from the maker

Quick start

How it works

Trust & safety

Installer

Requirements