skills.rest
reason-machines
reason-machinesOFFICIAL
Explore all skills by this author →
Website𝕏@reasonmachinesGitHub

mcp-security-hub

Integrates Dockerized offensive security tools with AI assistants via MCP servers.

7|2|Updated May 16, 2026
Search Tags:#Docker#vulnerability assessment#MCP#penetration testing#security scanning#claude desktop#nmap
One-click install
npx skills add https://github.com/reason-machines/mcp-skills --skill mcp-security-hub-reason-machines
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mcp-security-hub
Source: https://github.com/reason-machines/mcp-skills/tree/main/skills/mcp-security-hub
Command: npx skills add https://github.com/reason-machines/mcp-skills --skill mcp-security-hub-reason-machines

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security professionals and developers need to run complex offensive security tools like Nmap, Nuclei, SQLMap, and Ghidra, but configuring and orchestrating them manually is time-consuming. This Skill connects 38 Docker-based MCP servers to AI assistants so security assessments can be driven through natural language. ## Core Features & Use Cases - 300+ Security Tools Across 13 Categories: Covers reconnaissance, web security, binary analysis, cloud auditing, secrets detection, and OSINT through dedicated MCP servers. - Docker-Based Hardened Architecture: Containers run as non-root with dropped capabilities, read-only mounts, resource limits, and Trivy vulnerability scanning in CI/CD. - Multi-Tool Orchestration: Docker Compose stacks let Claude chain tools, such as scanning a subnet with nmap-mcp, fingerprinting hosts with whatweb-mcp, then testing for SQL injection with sqlmap-mcp. - Use Case: Ask Claude to perform a full security assessment of example.com, and it orchestrates port scanning, technology fingerprinting, CVE scanning, SQLi testing, directory fuzzing, and secrets detection into one consolidated report. ## Quick Start Clone the FuzzingLabs mcp-security-hub repository, run docker-compose build, then add the desired servers to your Claude Desktop MCP configuration and restart Claude.

Frequently Asked Questions about mcp-security-hub

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect Nmap or Nuclei to Claude Desktop?▼

Build the server image with docker-compose build nmap-mcp, then add an entry to claude_desktop_config.json using the docker run command with the image name. Restart Claude Desktop completely to load the new MCP server.

What security tools does MCP Security Hub include?▼

It packages 38 Dockerized MCP servers covering 300+ tools across 13 categories, including Nmap, Masscan, Nuclei, SQLMap, ffuf, radare2, Binwalk, YARA, Gitleaks, Trivy, and Prowler for reconnaissance, web, binary, cloud, and secrets workflows.

Why does nmap-mcp fail with permission denied errors?▼

Network scanning tools need raw socket access, which Docker blocks by default. Add --cap-add=NET_RAW to the docker run arguments in your Claude Desktop configuration for nmap-mcp and masscan-mcp.

Can radare2-mcp analyze binaries on my local machine?▼

Yes, but the container cannot see your filesystem by default. Mount the binaries directory with a read-only volume flag, such as -v /path/to/binaries:/samples:ro, then reference files under /samples in your prompts.

How do I use Shodan or VirusTotal MCP servers with API keys?▼

Export the API key as an environment variable and pass it into the container with the -e flag, or define it in the env block of the Claude Desktop config. The server reads the key from its container environment at runtime.

What are the limitations of Docker-based MCP security servers?▼

Each tool runs in an isolated container, so file analysis requires explicit volume mounts and network tools need added capabilities. API-based servers depend on external keys, and all servers require a running Docker daemon and an MCP-compatible client.

Related Skills

Explore More Software Engineering Skills→
oriolriusoriolrius

gitea

Deploy and operate self-hosted Gitea Git services with Docker Compose or standalone binaries.

Community
Advanced
AnthonyCongHieuAnthonyCongHieu

vulnerability-scanner

Identify and prioritize security vulnerabilities in software projects.

Community
Advanced
JingyueCongJingyueCong

shodan-reconnaissance

Discovers and analyzes internet-exposed assets using the Shodan API.

Community
Advanced
mejangomejango

semgrep

Automate code security scanning and pattern detection with Semgrep.

Community
Advanced