mukul975/Anthropic-Cybersecurity-Skills
A comprehensive open-source library featuring 754 structured cybersecurity skills for AI agents, mapped to five industry frameworks to provide expert-level guidance.
Awesome MCP › Security & Reverse Engineering
CrowdStrike/falcon-mcp
falcon-mcp is CrowdStrike's own Model Context Protocol server for the Falcon platform. It gives AI agents programmatic access to Falcon security data and operations so that detection triage, threat research and host management can run inside agentic workflows. Functionality is organised into modules that can be enabled selectively with a --modules flag, which keeps the exposed tool set small for a given task. Documented modules include Core connectivity, Detections, Hosts and Host Groups, Intel for threat actors, IOCs and intelligence reports, IOC management, Spotlight vulnerability data, Cloud Security covering Kubernetes containers, image vulnerabilities, CSPM inventory and IOM findings, Identity Protection, Discover for application inventory and unmanaged assets, NGSIEM for running CQL queries, Correlation Rules, Custom IOA behavioural rules, Data Protection, Exclusions, Firewall Management, Policies for prevention, sensor update, device control, response and content update policies, Quarantine, Real Time Response limited to read-only triage, Recon for dark web, leaked credential and typosquatting monitoring, Case Management, Scheduled Reports, Sensor Usage, Serverless function vulnerabilities and Shield SaaS security posture. Each module documents its required Falcon API scopes and FQL resources. Installation is through uv tool install or pip from PyPI; authentication uses FALCON_CLIENT_ID, FALCON_CLIENT_SECRET and FALCON_BASE_URL environment variables or a .env file. Editor integration is documented for uvx and for a container image hosted on Quay, with stdio and streamable HTTP transports. The project is registered in the MCP registry, available as a Gemini CLI extension, and documented in full at developer.crowdstrike.com. It is marked as a public preview under active development and not recommended for production deployments. MIT licensed.
https://github.com/CrowdStrike/falcon-mcp
Also in Security & Reverse Engineering
NVIDIA/SkillSpector
NVIDIA security scanner for AI agent skills and MCP tooling that detects prompt injection, data exfiltration, MCP tool poisoning and least-privilege problems, and can itself be run as an MCP server inside agent sessions.
mrexodia/ida-pro-mcp
ida-pro-mcp is an MCP server for IDA Pro that enables advanced reverse engineering capabilities through MCP-based interactions and automation.
LaurieWired/GhidraMCP
GhidraMCP is an MCP server that integrates Ghidra's reverse engineering capabilities with MCP clients, enabling automated binary analysis and decompilation through large language models.
invariantlabs-ai/mcp-scan
MCP-Scan is a security tool that statically and dynamically scans and monitors Model Context Protocol (MCP) connections to detect and prevent vulnerabilities such as prompt injections, tool poisoning, and cross-origin escalations.
zinja-coder/jadx-ai-mcp
JADX-AI-MCP is a JADX plugin integrating Model Context Protocol to enable AI-powered live reverse engineering, vulnerability detection, and code analysis of Android APKs using large language models like Claude.
mariocandela/beelzebub
Beelzebub is a secure low-code honeypot framework leveraging large language models and the Model Context Protocol (MCP) to detect and analyze cyber attacks, including prompt injection attempts against LLM agents.
svnscha/mcp-windbg
mcp-windbg is a Model Context Protocol server that enables AI models to analyze Windows crash dumps using WinDBG through natural language interaction and command execution.