mukul975/Anthropic-Cybersecurity-Skills
A comprehensive open-source library featuring 754 structured cybersecurity skills for AI agents, mapped to five industry frameworks to provide expert-level guidance.
Awesome MCP › Security & Reverse Engineering
gbrigandi/mcp-server-wazuh
Wazuh MCP Server is a Rust implementation of a Model Context Protocol server that connects the Wazuh SIEM to MCP clients such as Claude Desktop. It queries both halves of a Wazuh deployment, the Indexer for alerts and the Manager for agents, rules, vulnerabilities and statistics, and converts the API responses into MCP tool results, so a security analyst can ask questions in natural language instead of assembling API calls. The documented tools cover several areas. Alert handling uses get_wazuh_alert_summary for triage and trend analysis. Vulnerability management uses get_wazuh_vulnerability_summary and get_wazuh_critical_vulnerabilities to assess the posture of individual agents and prioritise patching. Host forensics uses get_wazuh_agent_processes for running processes, get_wazuh_agent_ports for open ports and network services, and get_wazuh_running_agents for agent connectivity and coverage. Detection engineering uses get_wazuh_rules_summary to review rule definitions. Operational monitoring uses get_wazuh_weekly_stats, get_wazuh_remoted_stats, get_wazuh_log_collector_stats, get_wazuh_cluster_health and get_wazuh_cluster_nodes. Incident investigation uses search_wazuh_manager_logs and get_wazuh_manager_error_logs. The README highlights compliance work as a target use case, with questions framed against frameworks such as PCI-DSS, HIPAA, SOX and GDPR, and notes that responses can be produced in multiple languages for distributed teams. The author also maintains companion MCP servers for Cortex (artifact analysis and IOC enrichment across many analyzers), TheHive (case management and response orchestration) and MISP (threat intelligence lookup, sightings and galaxies), and documents a combined workflow in which an indicator from a Wazuh alert is checked against MISP, analysed in Cortex, and tracked as a TheHive case. It targets SOC analysts, incident responders and compliance teams already running Wazuh.
https://github.com/gbrigandi/mcp-server-wazuh
Also in Security & Reverse Engineering
NVIDIA/SkillSpector
NVIDIA security scanner for AI agent skills and MCP tooling that detects prompt injection, data exfiltration, MCP tool poisoning and least-privilege problems, and can itself be run as an MCP server inside agent sessions.
mrexodia/ida-pro-mcp
ida-pro-mcp is an MCP server for IDA Pro that enables advanced reverse engineering capabilities through MCP-based interactions and automation.
LaurieWired/GhidraMCP
GhidraMCP is an MCP server that integrates Ghidra's reverse engineering capabilities with MCP clients, enabling automated binary analysis and decompilation through large language models.
invariantlabs-ai/mcp-scan
MCP-Scan is a security tool that statically and dynamically scans and monitors Model Context Protocol (MCP) connections to detect and prevent vulnerabilities such as prompt injections, tool poisoning, and cross-origin escalations.
zinja-coder/jadx-ai-mcp
JADX-AI-MCP is a JADX plugin integrating Model Context Protocol to enable AI-powered live reverse engineering, vulnerability detection, and code analysis of Android APKs using large language models like Claude.
mariocandela/beelzebub
Beelzebub is a secure low-code honeypot framework leveraging large language models and the Model Context Protocol (MCP) to detect and analyze cyber attacks, including prompt injection attempts against LLM agents.
svnscha/mcp-windbg
mcp-windbg is a Model Context Protocol server that enables AI models to analyze Windows crash dumps using WinDBG through natural language interaction and command execution.