{"id":"430ccd23-8b2a-463e-a09a-9063c000cac7","slug":"cyberboba-security-suite","kind":"mcp","name":"cyberboba-security-suite","summary":"Per-app network control for Linux: Proxifier-style routing rules, WireGuard/OpenVPN manager, intercepting HTTPS proxy, DNS blocklists, application firewall and bandwidth monitor in one daemon, driven","owner":"cyberbobas","repoUrl":"https://github.com/cyberbobas/cyberboba-security-suite","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":2,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-10-15T00:07:18.000Z","addedAt":"2026-10-21T09:51:07.459Z","logoUrl":"https://avatars.githubusercontent.com/u/260427176?u=79792c75492c856ea32764c5ee9e4963dce0f329&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra"],"tags":["ai-agents","bandwidth-monitor","dns-adblock","firewall","golang","linux","mitm-proxy","network-monitor"],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T13:52:37.232Z","sample":false,"url":"https://conduits.dev/tools/cyberboba-security-suite","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# CyberBoba Security Suite\n\nPer-application network control for Linux in one daemon: Proxifier-style\nrouting rules, a WireGuard/OpenVPN manager, an intercepting HTTPS proxy, DNS\nblocklists, an application firewall and a bandwidth monitor. Everything is\ndriven the same three ways: HTTP API, CLI and an MCP server, with a web UI and\nan optional desktop app on top.\n\n[![CI](https://github.com/cyberbobas/cyberboba-security-suite/actions/workflows/ci.yml/badge.svg)](https://github.com/cyberbobas/cyberboba-security-suite/actions/workflows/ci.yml)\n[![Go](https://img.shields.io/badge/Go-1.26%2B-00ADD8?logo=go&logoColor=white)](https://go.dev)\n[![Platform](https://img.shields.io/badge/platform-Linux-333)](#requirements)\n[![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)\n\n![demo](docs/demo.gif)\n\n## What it does\n\n- **Per-app routing (Proxifier for Linux).** Rules match a process (name,\n  path, command line, user, tag) and a destination (host, IP/CIDR, port,\n  protocol) and send the connection direct, through a SOCKS5/HTTP proxy or a\n  proxy chain, through a VPN, into the interceptor, or block it. Transparent:\n  applications are not reconfigured.\n- **VPN manager.** WireGuard (`wg-quick`) and OpenVPN profiles. `full` mode is\n  a classic VPN (default route for everything). `selective` mode keeps the\n  tunnel off the main routing table and only rule-routed traffic uses it, so\n  several tunnels can be up at once. Kill switch, auto-reconnect, rotation\n  groups. A tunnel brought up outside the daemon (`wg-quick up` by hand) is\n  detected and shown as `up (external)`.\n- **Intercepting HTTPS proxy.** Own CA, request/response history, hold and\n  edit, repeater, match-and-replace rewrites, sessions, HAR export, and a\n  passive scanner that flags leaked secrets, cleartext credentials, insecure\n  cookies, missing security headers and CORS problems.\n- **Application firewall.** Ask/allow/block per program and zone (LAN vs\n  internet), a host blocklist that applies to every program, inbound stealth\n  mode and an internet-lock switch. Prompts are delivered system-wide by the\n  desktop app (notification banners with Allow / Allow always / Deny).\n- **DNS filtering.** Pi-hole-style blocklists (hosts and domain lists),\n  manual block/allow entries, NXDOMAIN or sinkhole answers, live query log.\n- **Monitoring.** Live connection table with the owning process, per-app\n  bandwidth with data-usage history and anomaly alerts, a geographic live map,\n  a traffic map that shows the real path of every rule and connection\n  (including an active full tunnel), process viewer and system stats.\n- **AI agents view.** Recognises common AI coding agents (Claude Code, Codex,\n  Gemini CLI, Cursor, Copilot, aider, ...) and shows what they connect to and\n  whether a recorded request carried an API key or token.\n\nScreenshots: [dashboard](docs/screenshots/dashboard.png) ·\n[firewall](docs/screenshots/firewall.png) · [live map](docs/screenshots/live-map.png) ·\n[intercept](docs/screenshots/intercept.png) · [AI agents](docs/screenshots/ai-agents.png) ·\n[bandwidth](docs/screenshots/bandwidth.png) · [DNS](docs/screenshots/dns.png) ·\n[processes](docs/screenshots/processes.png)\n\n## Requirements\n\n- Linux with netfilter: `iptables` (legacy or nft backend), `ip` from\n  iproute2. The daemon runs as root (transparent interception, routing tables,\n  `/proc` access for process attribution).\n- Optional: `wireguard-tools` and/or `openvpn` for VPN profiles,\n  `libnss3-tools` (`certutil`) to import the intercept CA into Firefox and\n  Chromium profiles.\n- To build from source: Go 1.26 or newer.\n- Desktop app (optional): Node.js 20+ and npm. Firewall prompts with buttons\n  use the desktop's notification service through `python3-gi` (preinstalled on\n  GNOME and most desktops).\n\nTested on Ubuntu 24.04-based systems (Zorin OS 18) and Ubuntu 20.04-based\nsystems (Linux Mint 20). Other distributions with systemd and iptables should\nwork the same way.\n\n## Install\n\n### From source (recommended)\n\n```sh\ngit clone https://github.com/cyberbobas/cyberboba-security-suite.git\ncd cyberboba-security-suite\n\nmake build                 # builds bin/cyberbobad (daemon) and bin/cyberboba (CLI)\nsudo make install          # /usr/local/bin, /etc/cyberboba/config.yaml, systemd unit\nsudo systemctl daemon-reload\nsudo systemctl enable --now cyberboba\n\ncyberboba status           # daemon status; web UI at http://127.0.0.1:7471\ncyberboba doctor           # checks iptables, ip, wg, openvpn, certutil, /dev/net/tun\n```\n\n`make install` never overwrites an existing `/etc/cyberboba/config.yaml`.\n\nTo upgrade:\n\n```sh\ngit pull\nmake build && sudo make install && sudo systemctl restart cyberboba\n```\n\n### From a release tarball\n\nEach [release](https://github.com/cyberbobas/cyberboba-security-suite/releases/latest)\nships `cyberboba-<version>-linux-amd64.tar.gz` with the two binaries only. It\nis meant for upgrading an existing install; for a first install use the source\nsteps above, which also put the config and the systemd unit in place.\n\n```sh\ntar xzf cyberboba-v*-linux-amd64.tar.gz\nsudo install -m 0755 cyberbobad cyberboba /usr/local/bin/\nsudo systemctl restart cyberboba\n```\n\n### Desktop app\n\nThe desktop app is an Electron shell around the daemon's web UI. It adds a\ntray icon, \"start hidden at login\", and the system-wide alerts: firewall\nprompts as notification banners with Allow / Allow always / Deny, an\nalways-on-top prompt window with the details, and notifications for blocked\nconnections, bandwidth anomalies and VPN state changes.\n\n```sh\ncd desktop\nnpm install\nnpm start\n```\n\nIt is not packaged; `npm start` runs it from the source tree. The release\nworkflow also attaches a best-effort AppImage to each release.\n\n### Arch Linux\n\n`packaging/aur/PKGBUILD` builds the binaries, the unit and the default config\nwith `makepkg -si`. It is maintained in-tree and not published on the AUR.\n\n### Trust the intercept CA\n\nNeeded only for the intercepting proxy, so browsers accept the rewritten TLS:\n\n```sh\nsudo cyberboba intercept ca install    # system trust store + Firefox/Chromium NSS databases\n```\n\n### Uninstall\n\n```sh\nsudo make uninstall                              # stops the service, removes binaries and unit\nsudo rm -rf /etc/cyberboba /var/lib/cyberboba    # config, CA, state (optional)\n```\n\n### Without root\n\n`make run-dev` starts the daemon from the source tree without netfilter. The\nweb UI, API, rule engine, upstream proxies and the SOCKS5 (`:7472`) / HTTP\n(`:7473`) inbound proxies work; transparent interception, VPNs and the\nfirewall need the root install.\n\n## First steps\n\n```sh\ncyberboba rules                                   # ordered rule list\ncyberboba rules test firefox example.com:443      # which rule would match\ncyberboba route-test https://ifconfig.me/ip       # dial through the matched route, show exit IP\ncyberboba conns -follow                           # live connection log with owning process\ncyberboba vpn import office ~/office.conf         # WireGuard/OpenVPN profile, full mode by default\ncyberboba vpn up office\ncyberboba firewall mode ask                       # prompt for every new program\ncyberboba dns on                                  # DNS blocklists\ncyberboba bandwidth                               # per-app speed and data usage\ncyberboba intercept record firefox                # record one app's HTTPS in the interceptor\ncyberboba run -tag pentest -- firefox             # rules can match \"tag:pentest\"\n```\n\nExample rules in `/etc/cyberboba/config.yaml`:\n\n```yaml\nrules:\n  - {name: LAN, targets: [lan], action: direct}\n  - {name: Capture browsers, apps: [firefox, chrome], ports: [\"80\", \"443\"], action: intercept}\n  - {name: Pentest tools, apps: [\"tag:pentest\"], action: proxy, proxy: socks-home}\n  - {name: Work via office VPN, apps: [slack, \"*teams*\"], action: vpn, vpn: office}\n  - {name: Kill telemetry, targets: [\"*.telemetry.microsoft.com\"], action: block}\n  - {name: Default, action: direct}\n```\n\nThe web UI has a visual RouteBuilder for the same thing: this machine, then\nVPN and proxy hops, then the internet, scoped to all traffic or to chosen\napplications.\n\n## Agents: API, CLI, MCP\n\nEvery feature is reachable through the HTTP API, the CLI (`--json` for\nmachine output, `cyberboba api METHOD /path` for raw calls) and the MCP server\n(92 tools, stdio and HTTP transports):\n\n```sh\nclaude mcp add cyberboba -- cyberboba mcp         # Claude Code\ncyberboba --json conns                            # same data as the UI\ncyberboba api GET /api/topology                   # any endpoint directly\n```\n\nThe API listens on loopback; set `api.token` in the config before exposing it.\nReference: [docs/API.md](docs/API.md), [docs/CONFIG.md](docs/CONFIG.md),\n[docs/AGENTS.md](docs/AGENTS.md), `GET /api/openapi.json`.\n\n## How it works\n\n- Outbound TCP from the machine is redirected by an iptables `REDIRECT` rule\n  in a `CYBERBOBA_OUT` chain to the daemon's transparent listener. The daemon\n  reads the original destination (`SO_ORIGINAL_DST`), resolves the owning\n  process with a `sock_diag` netlink query plus `/proc/<pid>/fd`, sniffs the\n  SNI or Host header, evaluates the rules and dials upstream: direct, through\n  a proxy or chain, through a VPN (packets marked with `SO_MARK`, policy\n  routing table per selective tunnel), or into the interceptor.\n- DNS from the machine is redirected to the daemon's forwarder, which applies\n  the blocklists and remembers IP-to-hostname mappings for the rules.\n- A full-mode VPN owns the default route, so it becomes the first hop of every\n  connection that is not pinned to another tunnel; the traffic map and\n  RouteBuilder draw it that way. Because `wg-quick` installs an anti-spoofing\n  rule that would drop the replies of redirected connections, the daemon\n  relaxes that rule for loopback (both the iptables and the nftables flavour).\n- The daemon's own traffic is excluded from redirection by mark and uid, so\n  it cannot loop through itself.\n\n## Project layout\n\n```\ncmd/cyberbobad       daemon          internal/proxy      transparent + SOCKS5/HTTP engine, SNI/Host sniff\ncmd/cyberboba        CLI             internal/upstream   SOCKS5 / HTTP CONNECT / chains / SO_MARK dialer\ninternal/config      YAML config     internal/netfilter  iptables chains, policy routing, wg-quick fix-ups\ninternal/rules       rule engine     internal/dnsfwd     DNS forwarder, blocklists, ip-to-host cache\ninternal/procinfo    socket to pid   internal/vpn        WireGuard and OpenVPN backends\ninternal/stats       live table/SSE  internal/firewall   application firewall\ninternal/bandwidth   per-app meter   internal/aiagents   AI agent registry\ninternal/intercept   MITM proxy: CA, flows, hold/edit, repeater, passive scanner, HAR\ninternal/sysstat     CPU/mem/temps   internal/topology   traffic map and live geographic map\ninternal/api         HTTP API        internal/mcp        MCP server (stdio and HTTP)\nweb/                 embedded web UI (vanilla JS)\ndesktop/             Electron shell, tray, system-wide alerts (alerts.js, notifier.py)\n```\n\n## Security and responsible use\n\nCyberBoba is a defensive and introspection tool for machines you own or are\nauthorised to administer. It intercepts TLS with a CA you install, routes\ntraffic through proxies and VPNs, and firewalls processes. Use it only on\nsystems and traffic you are permitted to inspect. The intercept CA private key\nlives in `/etc/cyberboba/ca`; protect it like any private key.\n\n## Limitations\n\n- Only TCP and DNS are intercepted transparently. Other UDP goes direct; QUIC\n  is blocked by default so HTTPS stays on TCP. Use a `full` VPN for all UDP.\n- Interception covers locally generated traffic (`OUTPUT` chain); forwarded\n  traffic from other hosts is not touched.\n- Intercepted TLS is HTTP/1.1 only; certificate-pinned apps belong in\n  `intercept.passthrough`.\n- Process attribution needs the socket to still exist when the connection is\n  accepted. A program that connects and exits immediately shows up as\n  \"unknown program\" with a best-effort guess from earlier connections.\n- Linux only. Nothing here runs on macOS or Windows.\n\n## License\n\nApache-2.0, see [LICENSE](LICENSE).\n"}