AynOps

Name: AynOps
Author: AynOps

by AynOpsversion 1.2.1i★ –iRuns on your computer

Registry nameio.github.AynOps/AynOps

Install

Overview

Description from the maker (original English)

AynOps is a reconnaissance focused MCP Server which gives reconnaissance capabilities to AI Clients

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: ABUSEIPDB_API_KEY, HIBP_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: ABUSEIPDB_API_KEY, HIBP_API_KEY

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "aynops": {
      "command": "uvx",
      "args": [
        "AynOps"
      ],
      "env": {
        "ABUSEIPDB_API_KEY": "your-value",
        "HIBP_API_KEY": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add aynops --env ABUSEIPDB_API_KEY=your-value --env HIBP_API_KEY=your-value -- uvx AynOps

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "aynops": {
      "command": "uvx",
      "args": [
        "AynOps"
      ],
      "env": {
        "ABUSEIPDB_API_KEY": "your-value",
        "HIBP_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "aynops": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "AynOps"
      ],
      "env": {
        "ABUSEIPDB_API_KEY": "your-value",
        "HIBP_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

ABUSEIPDB_API_KEY secret env
Required for ip_reputation tool. Get free key at abuseipdb.com
HIBP_API_KEY secret env
Required for hibp_check tool. Get a key at haveibeenpwned.com

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account AynOps, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32433 servers in this category
Published to the registry more recently than 74% of the other 32433 servers in this category
Basic checks equal to or better than 100% of the other 32433 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is AynOps safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: ABUSEIPDB_API_KEY, HIBP_API_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.2.1) reached the registry 12 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Symantec Cloud DLP AIops

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

Symantec Cloud DLP AIops

by AIops-tools

Governed Symantec Cloud DLP — 14 MCP tools, read-only with audit.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

A high-performance Model Context Protocol (MCP) server that brings real-time cybersecurity reconnaissance, attack surface mapping, and automated OSINT telemetry directly to AI agents.

📚 Table of Contents

Overview
Features
Tools & Prompts
Demo
Prerequisites
Installation
Usage
Examples
Registries & Ecosystem
LLM Client Behavior & Security Considerations
Legal & Ethical Usage
Known Limitations
Project Structure
Roadmap & Discussions
Contributing
License
Author

🌐 Overview

Modern Large Language Models (LLMs) operate in sandboxed, non-deterministic execution environments devoid of native raw-socket access, packet crafting abilities, and live network reconnaissance primitives. When tasked with auditing an attack surface, AI agents are fundamentally constrained by static training cutoff boundaries and an inability to query live network interfaces.

AynOps bridges this operational divide. Built on top of the Model Context Protocol (MCP) specification using the FastMCP framework, AynOps exposes an extensible suite of deterministic cybersecurity reconnaissance tools directly to LLM agents (such as Cursor, VS Code, Claude Desktop, and custom MCP clients) over a standard JSON-RPC 2.0 stdio transport.

┌───────────────────────────┐         JSON-RPC 2.0 (stdio)         ┌────────────────────────────────────────────────────────┐

│ AI / LLM Client │ ◄──────────────────────────────────► │ AynOps MCP Server │ │ (Cursor, VS Code, Claude) │ │ (Local Daemon) │ └───────────────────────────┘ └──────────────────────────┬─────────────────────────────┘ │ ┌───────────────────────────────────────────────────────────┴──────────────────────────────┐ ▼ ▼ ▼ ┌──────────────────────────┐ ┌──────────────────────────┐ ┌──────────────────────────┐ │ Active Network │ │ DNS & OSINT │ │ Web & Cloud Audits │ │ • Nmap Port Scanner │ │ • Authoritative WHOIS │ │ • SSL/TLS X.509 Parser │ │ • Team Cymru ASN BGP │ │ • dnspython Resolver │ │ • HTTP Headers Linting │ │ • AbuseIPDB Threat Intel│ │ • crt.sh CT Log Parser │ │ • Multi-Cloud Storage │ └──────────────────────────┘ │ • Subdomain Takeover │ │ • Redirect Hop Tracer │ └──────────────────────────┘ └──────────────────────────┘

Architectural Highlights

🔒 Local-First & Zero-Telemetry Egress: AynOps runs entirely as a local daemon on your host or isolated container. Target queries, raw IP telemetry, and internal host details never transit through external telemetry collectors.
⚡ Wave-Based Concurrent Pipeline: Orchestrates complex reconnaissance tasks through an intelligent 3-wave async execution model, resolving foundational network primitives in parallel before dispatching dependent service, web, and threat intelligence probes.
🧠 Unified Heuristic Signal Extraction: Raw outputs from heterogeneous utilities (Nmap, dnspython, cryptography, socket APIs) are parsed and normalized into structured threat signals (tools/signals/) designed for direct ingestion by LLM reasoning layers.
🛠️ Standardized MCP Tool & Prompt Primitives: Fully compliant with the official Model Context Protocol standard, packaging ready-to-use tool declarations and meta-prompts (threat_analysis) for automated threat modeling workflows.

⚡ Features

AynOps is engineered from the ground up for cybersecurity engineers, red/blue teams, and security researchers seeking deterministic automation:

🔒 100% Local-First Execution: Self-hosted local daemon with zero telemetry leaks, preserving target confidentiality.
⚡ 3-Wave Asynchronous Recon Engine: Parallelized execution pipeline reducing end-to-end full recon duration by up to 70%.
🧠 Structured Heuristic Signal Extraction: Translates raw terminal outputs into normalized, machine-readable threat telemetry.
🌐 Comprehensive Perimeter Mapping: Authoritative WHOIS (RFC 3912), comprehensive DNS RR resolution, and multi-threaded dictionary subdomain brute-forcing.
📜 Certificate Transparency Log Extraction: Real-time querying of crt.sh append-only Merkle trees for passive subdomain and wildcard SSL discovery.
🛡️ Dangling DNS & Subdomain Takeover Detection: Resolves CNAME pointers against signatures for 8+ cloud providers (AWS S3, Azure, GitHub Pages, Heroku, Shopify, Fastly, Ghost, Pantheon) with active HTTP verification probing.
☁️ Multi-Cloud Storage Bucket Auditing: Generates domain keyword permutations and checks for unauthenticated public access across AWS S3, Azure Blob Storage, and Google Cloud Storage.
📧 RFC-Compliant Email Security Assessment: Audits SPF (v=spf1), DKIM selectors, and DMARC enforcement policies (p=reject/quarantine/none) with quantitative scoring (0–100).
🔍 Multi-Layer Web Technology Fingerprinting: 4-layer non-intrusive technology identification engine — HTTP response headers (Server, X-Powered-By, CDN markers), Set-Cookie cookie names, tag parsing, and HTML/asset-path substring matching — returning structured detections with confidence scores (0–100) and evidence strings.
🔀 Deep HTTP Redirect Chain & TLS Downgrade Tracer: Hop-by-hop 3xx status analysis detecting SSL stripping, RFC 1918 internal IP address leaks, redirect loops, and cross-domain hops.
🎯 Real-Time NIST NVD v2 CVE Querying: Direct REST API integration with NIST National Vulnerability Database for CVSS v3.1/v2 base scores, CWE vectors, and exploit references without requiring API keys.
🤖 Cognitive Threat Analysis Meta-Prompt: Native MCP prompt template converting raw scan telemetry into prioritized vulnerability matrices and remediation roadmaps.
📦 Container-Ready Architecture: Bundles a production-ready Dockerfile with pre-installed Nmap and Python 3.12 for zero-dependency stdio deployment.

🛠️ Tools & Prompts

AynOps provides 17 specialized reconnaissance tools alongside structured MCP prompt templates.

1. Multi-Wave Automated Reconnaissance Pipeline (`full_recon`)

The full_recon tool orchestrates a 3-wave concurrent pipeline designed to minimize scan latency while preserving dependency order across tools:

Target Domain

│ ├──► [Wave 1: Base Perimeter] ──► whois_lookup + dns_enumeration + ssl_inspect + email_security_check + asn_lookup │ ├──► [Wave 2: Service & Web] ──► port_scan (service) + tech_stack_detect + headers_analyzer + cert_transparency │ └──► [Wave 3: Threat Feeds] ──► ip_reputation (AbuseIPDB - dynamically bound to resolved IP address) │ ▼ Signal Aggregator (tools/signals/) ──► Unified Heuristic Security Telemetry Payload

2. Core Reconnaissance Tool Inventory (Included in `full_recon`)

Documentation status: Browse the tools documentation index for all tools and their documentation availability. Detailed reference pages are currently available for tools marked Available. Tools marked Pending are implemented and included in the inventory, but their dedicated documentation pages are not yet available.

Tool	Parameters	Underlying Mechanics / Standards	Telemetry Output	Docs
`whois_lookup`	`domain: str`	RFC 3912 socket lookup via `python-whois`	Registrar metadata, registration/update/expiry timestamps, nameservers, registrant organization, and ICANN domain status codes.	Available
`dns_enumeration`	`domain: str`	Multi-record DNS resolver (`dnspython`) + concurrent dictionary brute-forcing	Core Resource Records (`A`, `AAAA`, `MX`, `NS`, `TXT`, `CNAME`, `SOA`, `CAA`), enterprise SRV records, DNSSEC records (`DNSKEY`, `DS`, `RRSIG`, `NSEC`, `NSEC3`), CNAME chain tracing, reverse DNS PTR lookups, and active subdomains.	Available

| port_scan | target: str scan_type: str timeout: int | Nmap integration via python-nmap with configurable profiles | Port state (open/filtered), service banner detection (-sV), OS fingerprinting (-O), full-port scanning (-p-), and Nmap Scripting Engine vulnerability checks (--script vuln). | Available | | ssl_inspect | domain: str port: int = 443 | Direct TLS handshake & X.509 certificate parsing via cryptography | Certificate subject, issuer, serial number, validity window, days to expiration, Subject Alternative Names (SANs), negotiated cipher suite, and TLS protocol version; wildcard and self-signed detection, public key algorithm (RSA, ECDSA, Ed25519, …), TLS and cipher strength classification (Strong/Good/Weak), weak-version and weak-cipher flags, certificate status (Healthy/Expiring Soon/Expired), an overall security rating (Excellent/Good/Fair/Poor) with point-based scor

Only the beginning is shown; read the rest in the repo

AynOps

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Symantec Cloud DLP AIops

README from the maker

📚 Table of Contents

🌐 Overview

Architectural Highlights

⚡ Features

🛠️ Tools & Prompts

1. Multi-Wave Automated Reconnaissance Pipeline (full_recon)

2. Core Reconnaissance Tool Inventory (Included in full_recon)

1. Multi-Wave Automated Reconnaissance Pipeline (`full_recon`)

2. Core Reconnaissance Tool Inventory (Included in `full_recon`)