AynOps

A high-performance Model Context Protocol (MCP) server that brings real-time cybersecurity reconnaissance, attack surface mapping, and automated OSINT telemetry directly to AI agents.

📚 Table of Contents

• Overview
• Features
• Tools & Prompts
• Demo
• Prerequisites
• Installation
• Usage
• Examples
• Registries & Ecosystem
• LLM Client Behavior & Security Considerations
• Legal & Ethical Usage
• Known Limitations
• Project Structure
• Roadmap & Discussions
• Contributing
• License
• Author

🌐 Overview

Modern Large Language Models (LLMs) operate in sandboxed, non-deterministic execution environments devoid of native raw-socket access, packet crafting abilities, and live network reconnaissance primitives. When tasked with auditing an attack surface, AI agents are fundamentally constrained by static training cutoff boundaries and an inability to query live network interfaces.

AynOps bridges this operational divide. Built on top of the Model Context Protocol (MCP) specification using the FastMCP framework, AynOps exposes an extensible suite of deterministic cybersecurity reconnaissance tools directly to LLM agents (such as Cursor, VS Code, Claude Desktop, and custom MCP clients) over a standard JSON-RPC 2.0 stdio transport.

┌───────────────────────────┐         JSON-RPC 2.0 (stdio)         ┌────────────────────────────────────────────────────────┐

│ AI / LLM Client │ ◄──────────────────────────────────► │ AynOps MCP Server │ │ (Cursor, VS Code, Claude) │ │ (Local Daemon) │ └───────────────────────────┘ └──────────────────────────┬─────────────────────────────┘ │ ┌───────────────────────────────────────────────────────────┴──────────────────────────────┐ ▼ ▼ ▼ ┌──────────────────────────┐ ┌──────────────────────────┐ ┌──────────────────────────┐ │ Active Network │ │ DNS & OSINT │ │ Web & Cloud Audits │ │ • Nmap Port Scanner │ │ • Authoritative WHOIS │ │ • SSL/TLS X.509 Parser │ │ • Team Cymru ASN BGP │ │ • dnspython Resolver │ │ • HTTP Headers Linting │ │ • AbuseIPDB Threat Intel│ │ • crt.sh CT Log Parser │ │ • Multi-Cloud Storage │ └──────────────────────────┘ │ • Subdomain Takeover │ │ • Redirect Hop Tracer │ └──────────────────────────┘ └──────────────────────────┘

Architectural Highlights

• 🔒 Local-First & Zero-Telemetry Egress: AynOps runs entirely as a local daemon on your host or isolated container. Target queries, raw IP telemetry, and internal host details never transit through external telemetry collectors.
• ⚡ Wave-Based Concurrent Pipeline: Orchestrates complex reconnaissance tasks through an intelligent 3-wave async execution model, resolving foundational network primitives in parallel before dispatching dependent service, web, and threat intelligence probes.
• 🧠 Unified Heuristic Signal Extraction: Raw outputs from heterogeneous utilities (Nmap, dnspython, cryptography, socket APIs) are parsed and normalized into structured threat signals (tools/signals/) designed for direct ingestion by LLM reasoning layers.
• 🛠️ Standardized MCP Tool & Prompt Primitives: Fully compliant with the official Model Context Protocol standard, packaging ready-to-use tool declarations and meta-prompts (threat_analysis) for automated threat modeling workflows.

⚡ Features

AynOps is engineered from the ground up for cybersecurity engineers, red/blue teams, and security researchers seeking deterministic automation:

• 🔒 100% Local-First Execution: Self-hosted local daemon with zero telemetry leaks, preserving target confidentiality.
• ⚡ 3-Wave Asynchronous Recon Engine: Parallelized execution pipeline reducing end-to-end full recon duration by up to 70%.
• 🧠 Structured Heuristic Signal Extraction: Translates raw terminal outputs into normalized, machine-readable threat telemetry.
• 🌐 Comprehensive Perimeter Mapping: Authoritative WHOIS (RFC 3912), comprehensive DNS RR resolution, and multi-threaded dictionary subdomain brute-forcing.
• 📜 Certificate Transparency Log Extraction: Real-time querying of crt.sh append-only Merkle trees for passive subdomain and wildcard SSL discovery.
• 🛡️ Dangling DNS & Subdomain Takeover Detection: Resolves CNAME pointers against signatures for 8+ cloud providers (AWS S3, Azure, GitHub Pages, Heroku, Shopify, Fastly, Ghost, Pantheon) with active HTTP verification probing.
• ☁️ Multi-Cloud Storage Bucket Auditing: Generates domain keyword permutations and checks for unauthenticated public access across AWS S3, Azure Blob Storage, and Google Cloud Storage.
• 📧 RFC-Compliant Email Security Assessment: Audits SPF (v=spf1), DKIM selectors, and DMARC enforcement policies (p=reject/quarantine/none) with quantitative scoring (0–100).
• 🔍 Multi-Layer Web Technology Fingerprinting: 4-layer non-intrusive technology identification engine — HTTP response headers (Server, X-Powered-By, CDN markers), Set-Cookie cookie names, tag parsing, and HTML/asset-path substring matching — returning structured detections with confidence scores (0–100) and evidence strings.
• 🔀 Deep HTTP Redirect Chain & TLS Downgrade Tracer: Hop-by-hop 3xx status analysis detecting SSL stripping, RFC 1918 internal IP address leaks, redirect loops, and cross-domain hops.
• 🎯 Real-Time NIST NVD v2 CVE Querying: Direct REST API integration with NIST National Vulnerability Database for CVSS v3.1/v2 base scores, CWE vectors, and exploit references without requiring API keys.
• 🤖 Cognitive Threat Analysis Meta-Prompt: Native MCP prompt template converting raw scan telemetry into prioritized vulnerability matrices and remediation roadmaps.
• 📦 Container-Ready Architecture: Bundles a production-ready Dockerfile with pre-installed Nmap and Python 3.12 for zero-dependency stdio deployment.

🛠️ Tools & Prompts

AynOps provides 17 specialized reconnaissance tools alongside structured MCP prompt templates.

1. Multi-Wave Automated Reconnaissance Pipeline (full_recon)

The full_recon tool orchestrates a 3-wave concurrent pipeline designed to minimize scan latency while preserving dependency order across tools:

Target Domain

│ ├──► [Wave 1: Base Perimeter] ──► whois_lookup + dns_enumeration + ssl_inspect + email_security_check + asn_lookup │ ├──► [Wave 2: Service & Web] ──► port_scan (service) + tech_stack_detect + headers_analyzer + cert_transparency │ └──► [Wave 3: Threat Feeds] ──► ip_reputation (AbuseIPDB - dynamically bound to resolved IP address) │ ▼ Signal Aggregator (tools/signals/) ──► Unified Heuristic Security Telemetry Payload

2. Core Reconnaissance Tool Inventory (Included in full_recon)

Documentation status: Browse the tools documentation index for all tools and their documentation availability. Detailed reference pages are currently available for tools marked Available. Tools marked Pending are implemented and included in the inventory, but their dedicated documentation pages are not yet available.

| port_scan | target: str scan_type: str timeout: int | Nmap integration via python-nmap with configurable profiles | Port state (open/filtered), service banner detection (-sV), OS fingerprinting (-O), full-port scanning (-p-), and Nmap Scripting Engine vulnerability checks (--script vuln). | Available | | ssl_inspect | domain: str port: int = 443 | Direct TLS handshake & X.509 certificate parsing via cryptography | Certificate subject, issuer, serial number, validity window, days to expiration, Subject Alternative Names (SANs), negotiated cipher suite, and TLS protocol version; wildcard and self-signed detection, public key algorithm (RSA, ECDSA, Ed25519, …), TLS and cipher strength classification (Strong/Good/Weak), weak-version and weak-cipher flags, certificate status (Healthy/Expiring Soon/Expired), an overall security rating (Excellent/Good/Fair/Poor) with point-based scor