mcp-security-hub MCP — Сценарии использования, Установка & Живое демо

Зачем использовать

Ключевые функции

38 Dockerized MCP servers covering all major security domains
300+ integrated security tools accessible via natural language
Security-hardened containers: non-root, dropped capabilities, read-only mounts
CI/CD integration with automated builds and Trivy vulnerability scanning
Docker Compose for multi-tool workflow orchestration

Живое демо

Как выглядит на практике

mcp-security-hub.replay ▶ готово

0/0

Установка

Выберите клиент

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "mcp-security-hub": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/FuzzingLabs/mcp-security-hub"
      ]
    }
  }
}

Откройте Claude Desktop → Settings → Developer → Edit Config. Перезапустите после сохранения.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "mcp-security-hub": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/FuzzingLabs/mcp-security-hub"
      ]
    }
  }
}

Cursor использует ту же схему mcpServers, что и Claude Desktop. Конфиг проекта приоритетнее глобального.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "mcp-security-hub": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/FuzzingLabs/mcp-security-hub"
      ]
    }
  }
}

Щёлкните значок MCP Servers на боковой панели Cline, затем "Edit Configuration".

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "mcp-security-hub": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/FuzzingLabs/mcp-security-hub"
      ]
    }
  }
}

Тот же формат, что и Claude Desktop. Перезапустите Windsurf для применения.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "mcp-security-hub",
      "command": "TODO",
      "args": [
        "See README: https://github.com/FuzzingLabs/mcp-security-hub"
      ]
    }
  ]
}

Continue использует массив объектов серверов, а не map.

~/.config/zed/settings.json

{
  "context_servers": {
    "mcp-security-hub": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/FuzzingLabs/mcp-security-hub"
        ]
      }
    }
  }
}

Добавьте в context_servers. Zed перезагружается автоматически.

claude mcp add mcp-security-hub -- TODO 'See README: https://github.com/FuzzingLabs/mcp-security-hub'

Однострочная команда. Проверить: claude mcp list. Удалить: claude mcp remove.

Сценарии использования

Реальные сценарии: mcp-security-hub

How to run automated reconnaissance with mcp-security-hub

👤 Security professionals conducting authorized assessments ⏱ ~60 min intermediate

Когда использовать: You need to run multiple recon tools against an authorized target.

Предварительные требования

Docker and Docker Compose installed — Install Docker Desktop or Docker Engine
Written authorization for the target — Signed penetration testing agreement

Поток

Start recon tools

Start the nmap-mcp and nuclei-mcp servers. Run port scanning and vulnerability scanning against the authorized target at 192.168.1.100.✓ Скопировано

→ Port scan results and vulnerability findings
Deep dive on findings

Found a web server on port 443. Run FFUF for directory fuzzing and check for common web vulnerabilities with Nuclei.✓ Скопировано

→ Directory listing and vulnerability scan results

Итог: Comprehensive reconnaissance results from multiple tools.

Подводные камни

Running all 38 servers at once consumes significant resources — Only start the servers you need. Use docker-compose up with specific service names.

Сочетать с: filesystem

Analyze a CTF binary with containerized reverse engineering tools

👤 CTF participants working on binary challenges ⏱ ~30 min intermediate

Когда использовать: You have a binary to reverse engineer and want containerized analysis tools.

Предварительные требования

Docker with security-hub cloned — git clone && docker-compose build

Поток

Analyze the binary

Start the radare2-mcp server. Load the CTF binary and show me the function list, strings, and entry point disassembly.✓ Скопировано

→ Binary overview with interesting functions and strings

Итог: Binary analysis insights from containerized tools.

Подводные камни

Binary needs host-specific libraries — Mount the binary directory into the container, or use the YARA/Capa servers for static analysis

Комбинации

Сочетайте с другими MCP — эффект x10

mcp-security-hub + filesystem

Save all security assessment results to organized report files

Run a full recon suite on the target and compile results into a pentest report at ~/reports/assessment.md.✓ Скопировано

Инструменты

Что предоставляет этот MCP

Инструмент	Входные данные	Когда вызывать
nmap-mcp	target, options	Network port scanning
nuclei-mcp	target, templates?	Template-based vulnerability scanning
sqlmap-mcp	url, params?	SQL injection testing
radare2-mcp	binary_path, command	Binary reverse engineering
trivy-mcp	target_image	Container and IaC vulnerability scanning

Стоимость и лимиты

Во что обходится

Квота API: N/A — all tools run locally in Docker
Токенов на вызов: 300–3000 tokens per tool output
Деньги: Free — all tools are open source. Shodan/similar may need their own API keys.
Совет: Only start servers you need. docker-compose up nmap-mcp nuclei-mcp instead of all 38.

Безопасность

Права, секреты, радиус поражения

Хранение учётных данных: Individual tool API keys (Shodan, etc.) via Docker env vars

Исходящий трафик: Scans connect to target IPs. OSINT tools call their respective APIs.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Containers are security-hardened but still execute real offensive tools.
Unauthorized scanning or exploitation is illegal. Always have written authorization.

Устранение неполадок

Частые ошибки и исправления

Docker build fails

Ensure Docker is installed and running. Some tools may need updated base images.

Проверить: docker --version && docker compose --version

Container can't reach target

Check Docker network settings. Use host networking mode for network scanning tools.

Проверить: docker exec <container> ping <target>

Out of disk space

Docker images can be large. Prune unused images: docker system prune

Проверить: docker system df

Альтернативы

mcp-security-hub в сравнении

Альтернатива	Когда использовать	Компромисс
hexstrike-ai	You want AI agents that autonomously orchestrate security tools	More AI intelligence but less Docker isolation
mcp-kali-server	You want a lightweight bridge to a full Kali installation instead of Docker	Simpler setup but less isolation

Ещё

Ресурсы

📖 Читать официальный README на GitHub

🐙 Открытые задачи

🔍 Все 400+ MCP-серверов и Skills