Security Operations Multi-Tool Platform (MCP)

The platform provides a consistent JSON output format across all integrated security tools. Every tool execution returns a response with the following structure:

• success: A boolean indicating if the tool ran successfully.
• error: A string containing error details (only present if success is false).
• results: An object containing the tool's specific output (only present if success is true).

{
    "success": boolean,
    "error": "string (if error)",
    "results": {}
}

The recommended way to deploy the Security Operations Multi-Tool Platform is via Docker. This ensures all underlying security tools are correctly configured within the container environment.

1. Clone the repository:

   git clone https://github.com/securityfortech/secops-mcp.git
   cd secops-mcp

2. Build the Docker image:

   docker build -t secops-mcp .

3. Run the container:

   docker run -it --rm secops-mcp

To install the platform manually, you must manage your own Python environment and ensure all underlying security tools are installed and available in your system's PATH.

1. Clone the repository:

   git clone https://github.com/securityfortech/secops-mcp.git
   cd secops-mcp

2. Create and activate a virtual environment:

   python -m venv venv
   source venv/bin/activate  # On Windows: venv\Scripts\activate

3. Install dependencies:

   pip install -r requirements.txt

4. Install required tools:
   • Follow the installation instructions for each tool located in the tools/ directory.
   • Ensure all tools are in your system PATH.

Each tool in the platform is managed via a wrapper located in the tools/ directory. You can configure tools using their respective wrapper parameters. Common configuration categories include:

• Output formats
• Timeouts
• Verbosity levels
• Custom wordlists
• Tool-specific parameters

Gospider integration allows for automated website crawling and URL discovery. It supports extension-based filtering, configurable depth, and secret discovery.

Available functions:

• gospider_scan(url, depth, include_subs): Performs a basic crawl.
• gospider_filtered_scan(url, extensions, exclude_extensions): Performs a crawl while filtering specific file types.

# Basic web crawling
gospider_scan("https://example.com", depth=3, include_subs=True)

# Filtered crawling for specific file types
gospider_filtered_scan(
    "https://example.com",
    extensions=["js", "json", "xml"],
    exclude_extensions=["png", "jpg", "css"]
)

Arjun integration is used to find hidden HTTP parameters in web applications. It supports multiple methods (GET, POST, PUT, etc.), bulk scanning, and custom headers.

Available functions:

• arjun_scan(url, method, data, stable): Scans a single URL. Use stable=True to reduce false positives.
• arjun_bulk_parameter_scan(urls): Scans multiple URLs simultaneously.

# Basic parameter discovery
arjun_scan("https://example.com/api", method="GET")

# POST parameter discovery with custom data
arjun_scan(
    "https://example.com/login",
    method="POST",
    data="username=test&password=test",
    stable=True
)

# Bulk parameter scanning
arjun_bulk_parameter_scan([
    "https://example.com/api/v1",
    "https://example.com/api/v2"
])

Use xsstrike_wrapper to detect Cross-Site Scripting (XSS) vulnerabilities. Setting crawl=True enables web crawling during the scan.

xsstrike_wrapper(url="https://example.com/search?q=test", crawl=True)

Use httpx_wrapper to probe multiple URLs. You can optionally filter results by a list of status_codes.

httpx_wrapper(urls=["https://a.com", "https://b.com"], status_codes=[200, 301])

Use nmap_wrapper to perform network discovery and port scanning. You can specify target ports and the scan type (default is sV for service version detection).

nmap_wrapper(target="192.168.1.1", ports="80,443", scan_type="-sC")

Use gospider_scan to crawl a target website. It returns a JSON-formatted string of the results. You can control depth, concurrency, timeouts, and whether to include subdomains or other sources.

gospider_scan(
    target="https://example.com",
    depth=5,
    concurrent=20,
    include_subs=True,
    output_format="json"
)

Use hashcat_wrapper to attempt to crack hashes. Requires the path to the hash file, a wordlist, and the specific hash_type.

hashcat_wrapper(hash_file="hashes.txt", wordlist="rockyou.txt", hash_type="0")

Use arjun_scan to discover hidden HTTP parameters. It supports different methods (default GET), custom wordlists, headers, and tuning parameters like threads, delay, and timeout.

arjun_scan(
    url="https://example.com/api",
    method="POST",
    threads=50,
    output_format="json"
)