{"id":"a9692fe4-579f-456f-9458-9cc69ef32c1b","slug":"cybersec","kind":"mcp","name":"cybersec","summary":"Empowers the AI to perform penetration testing, vulnerability assessment, reconnaissance, and security reporting — all through natural language conversation.","owner":"sukirman1901","repoUrl":"https://github.com/sukirman1901/cybersec","license":"MIT","licenseTier":"permissive","trust":"community","stars":19,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-06-27T17:44:06.000Z","addedAt":"2026-10-28T10:10:30.379Z","logoUrl":"https://avatars.githubusercontent.com/u/75514294?u=b313295b70eede15024dbc4cd74a61ce38c3a6e4&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","memory-knowledge"],"tags":["agents","ai-hacking","ai-agents","ai-penetration-testing","ai-pentesting","ai-security","bug-bounty","ctf-tools"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-28T10:10:52.961Z","sample":false,"url":"https://conduits.dev/tools/cybersec","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<p align=\"center\">\n  <img src=\"logo-cybersec.png\" alt=\"Cybersec Logo\" width=\"300\" />\n</p>\n\n# Cybersec — AI Cybersecurity Plugin\n\n**180+ pure-Python MCP security tools** + **23 pentesting methodology skills** for AI coding agents.\n\nWorks with: **Claude Code**, **Cursor**, **Codex**, **Gemini CLI**, **GitHub Copilot CLI**, **Kimi Code**, **OpenCode**, **Pi**.\n\nEmpowers the AI to perform penetration testing, vulnerability assessment, reconnaissance, and security reporting — all through natural language conversation.\n\n---\n\n## Table of Contents\n\n- [Installation](#installation)\n  - [Claude Code](#claude-code)\n  - [Cursor](#cursor)\n  - [Codex (App + CLI)](#codex)\n  - [Gemini CLI](#gemini-cli)\n  - [GitHub Copilot CLI](#github-copilot-cli)\n  - [Kimi Code](#kimi-code)\n  - [OpenCode](#opencode)\n  - [Pi](#pi)\n- [Quick Start](#quick-start)\n- [How It Works](#how-it-works)\n- [MCP Server Setup](#mcp-server-setup)\n- [MCP Tools Reference](#mcp-tools-reference)\n  - [Enterprise Tools (HackerOne / Pentest-Tools.com inspired)](#enterprise-tools)\n  - [Advanced Tools](#advanced-tools-16-new)\n- [Agents (OpenCode)](#agents-opencode)\n  - [Pentester (Primary)](#pentester-primary)\n  - [Recon (Subagent)](#recon-subagent)\n  - [Vuln Analyst (Subagent)](#vuln-analyst-subagent)\n  - [Report Writer (Subagent)](#report-writer-subagent)\n- [Skills Guide](#skills-guide)\n- [Troubleshooting](#troubleshooting)\n- [Requirements](#requirements)\n\n---\n\n## Installation\n\nInstallation differs by harness. If you use more than one, install Cybersec separately for each one.\n\n### Python Prerequisites (all platforms)\n\n```bash\ngit clone https://github.com/sukirman1901/cybersec.git\ncd cybersec\npython3 -m venv mcp/.venv\nsource mcp/.venv/bin/activate\npip install 'fastmcp>=3.4.2,<4' httpx dnspython 'impacket>=0.12.0'\ndeactivate\n```\n\n> The MCP server needs **FastMCP >=3.4.2,<4**, **httpx** and **dnspython**. Target-specific calls require an initialized and explicitly authorized engagement in the same MCP session. See [preflight and audit fixes](mcp/AUDIT-FIXES.md) for setup, result compatibility and enforcement limits.\n\n### Claude Code\n\n#### Official Marketplace\n\n- Install the plugin from Anthropic's official marketplace:\n  ```\n  /plugin install cybersec@claude-plugins-official\n  ```\n\n#### Cybersec Marketplace\n\n- Register the marketplace:\n  ```\n  /plugin marketplace add sukirman1901/cybersec\n  ```\n- Install the plugin:\n  ```\n  /plugin install cybersec@cybersec\n  ```\n\n#### Manual MCP Config\n\nCreate or edit `.mcp.json` in your project root:\n\n```json\n{\n  \"mcpServers\": {\n    \"cybersec\": {\n      \"command\": \"/path/to/cybersec/mcp/.venv/bin/python3\",\n      \"args\": [\"-m\", \"server\"],\n      \"cwd\": \"/path/to/cybersec/mcp\"\n    }\n  }\n}\n```\n\n### Cursor\n\n- In Cursor Agent chat, install from marketplace:\n  ```\n  /add-plugin cybersec\n  ```\n- Or search for \"cybersec\" in the plugin marketplace.\n\nThe plugin auto-registers skills and hooks. You also need to add the MCP server to Cursor's MCP settings.\n\n### Codex\n\nAvailable via the official Codex plugin marketplace.\n\n#### Codex App\n\n- In the Codex app, click on **Plugins** in the sidebar.\n- Search for `Cybersec` in the Security section.\n- Click the `+` next to Cybersec and follow the prompts.\n\n#### Codex CLI\n\n- Open the plugin search interface:\n  ```\n  /plugins\n  ```\n- Search for Cybersec:\n  ```\n  cybersec\n  ```\n- Select `Install Plugin`.\n\n### Gemini CLI\n\n- Install the extension:\n  ```bash\n  gemini extensions install https://github.com/sukirman1901/cybersec\n  ```\n- Update later:\n  ```bash\n  gemini extensions update cybersec\n  ```\n\nThe `GEMINI.md` file auto-loads the bootstrap context and tool mapping.\n\n### GitHub Copilot CLI\n\n- Register the marketplace:\n  ```bash\n  copilot plugin marketplace add sukirman1901/cybersec\n  ```\n- Install the plugin:\n  ```bash\n  copilot plugin install cybersec@cybersec\n  ```\n\n### Kimi Code\n\nAvailable in Kimi Code's plugin marketplace.\n\n- Open Kimi Code's plugin manager:\n  ```\n  /plugins\n  ```\n- Go to `Marketplace` > `Cybersec` and install it.\n\n- Or install directly from this repository:\n  ```\n  /plugins install https://github.com/sukirman1901/cybersec\n  ```\n\n### OpenCode\n\nOpenCode uses its own plugin install. The plugin auto-registers the MCP server and all skills — no manual MCP config needed.\n\n- Tell OpenCode:\n  ```\n  Fetch and follow instructions from https://raw.githubusercontent.com/sukirman1901/cybersec/refs/heads/main/.opencode/INSTALL.md\n  ```\n\nAdd to your `opencode.json`:\n\n```json\n{\n  \"plugin\": [\"cybersec@git+https://github.com/sukirman1901/cybersec.git\"]\n}\n```\n\nTo pin a specific version:\n\n```json\n{\n  \"plugin\": [\"cybersec@git+https://github.com/sukirman1901/cybersec.git#v1.0.0\"]\n}\n```\n\nRestart OpenCode. The plugin auto-registers the MCP server, skills directory, and bootstrap context.\n\n### Pi\n\nInstall Cybersec as a Pi package from this repository:\n\n```bash\npi install git:github.com/sukirman1901/cybersec\n```\n\nFor local development:\n\n```bash\npi -e /path/to/cybersec\n```\n\nThe Pi extension (`.pi/extensions/cybersec.ts`) loads skills and injects the bootstrap at session startup.\n\n---\n\n## Quick Start\n\nAfter installation, verify it works by asking your agent:\n\n> \"scan port 80,443 on example.com\"\n> \"check SSL for example.com\"\n> \"enumerate subdomains for example.com\"\n> \"audit example.com and generate a report\"\n\nThe AI will automatically load the right skill and use the MCP tools.\n\n### OpenCode Agents\n\nOn OpenCode, press **Tab** to switch to the **Pentester** agent (red), then:\n\n```\naudit example.com\n```\n\nOr invoke subagents directly:\n\n```\n@recon gather intelligence on example.com\n@vuln-analyst scan for vulnerabilities\n@report-writer generate a report\n```\n\n---\n\n## How It Works\n\n1. You ask something like _\"find subdomains for target.com and check for open ports\"_\n2. The AI detects the intent → matches the **cybersec-recon** skill\n3. The skill provides a methodology (step-by-step guide)\n4. The AI calls MCP tools like `subdomain_enum`, `port_scan`, `http_probe_target`\n5. Results are analyzed and presented\n\nThe AI follows a standard pentesting methodology: **Recon → OSINT → Scanning → Vulnerability Analysis → Web Testing → Bug Bounty → AD → Cloud → Password → AI → AI Safety → Desktop → Code Audit → Exploitation → Reporting**\n\nFor continuous monitoring: **CTEM** runs in parallel — Discovery → Validation → Prioritization → Remediation in a continuous loop.\n\n### Example Session\n\n**User:** \"Test security for example.com\"\n\nThe AI will:\n1. Load `cybersec-recon` skill → run `whois_lookup`, `dns_lookup`, `subdomain_enum`, `crt_search`\n2. Load `cybersec-scanning` skill → run `port_scan`, `http_probe_target`, `ssl_check`, `waf_detection`\n3. Load `cybersec-vulns` skill → run `cve_search`, `vuln_scan`\n4. Load `cybersec-web` skill → run `tech_detect`, `cors_check`, `dir_bruteforce`, **auto-CAPTCHA detection**\n5. Present findings in a structured report\n\n---\n\n## MCP Server Setup\n\nThe Cybersec MCP server provides 180+ security tools via stdio transport using FastMCP.\n\n### For Non-OpenCode Platforms\n\nOn platforms that don't auto-register the MCP server (Claude Code, Cursor, Codex, Gemini, etc.), add the MCP server to your platform's MCP configuration:\n\n```json\n{\n  \"mcpServers\": {\n    \"cybersec\": {\n      \"command\": \"/path/to/cybersec/mcp/.venv/bin/python3\",\n      \"args\": [\"-m\", \"server\"],\n      \"cwd\": \"/path/to/cybersec/mcp\"\n    }\n  }\n}\n```\n\n### Verify MCP Server\n\n```bash\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}' | ./mcp/.venv/bin/python3 -m server\n```\n\nExpected: 180+ tools listed.\n\n---\n\n## MCP Tools Reference\n\n### Core Scanners\n\n| Tool | Description |\n|------|-------------|\n| `port_scan` | TCP port scanning with service detection |\n| `dns_lookup` | DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME) |\n| `http_probe_target` | HTTP/HTTPS service probing, tech stack & headers |\n| `dir_bruteforce` | Directory/file brute-force on web targets |\n| `ssl_check` | SSL/TLS certificate and protocol analysis |\n| `cve_search` | CVE lookup by service name and version |\n| `waf_detection` | WAF detection and fingerprinting |\n| `dork_search` | Google dorking for exposed info |\n| `generate_report` | Pentest report generation (markdown/JSON) |\n| `subdomain_enum` | Passive subdomain enumeration (crt.sh, DNS brute, APIs) |\n| `param_discovery` | HTTP parameter discovery |\n| `tech_detect` | Web technology detection (CMS, frameworks, CDN) |\n| `vuln_scan` | Common vulnerability scan (headers, paths, CVEs), including PHP2SHELL version assessment |\n| `php2shell_scan` | Dedicated PHP2SHELL identification: bounded banner methods, phpinfo discovery, PHP presence and configuration evidence |\n| `whois_lookup` | Query WHOIS for domain registration |\n| `asn_lookup` | ASN information lookup (Team Cymru) |\n| `reverse_ip` | Find domains on same IP |\n| `crt_search` | Certificate Transparency log search |\n| `cors_check` | CORS misconfiguration testing |\n| `open_redirect` | Open redirect vulnerability testing |\n| `graphql_introspect` | GraphQL introspection endpoint check |\n| `jwt_analyze` | JWT token decode and security analysis |\n| `api_fuzz` | API endpoint fuzzing |\n| `smtp_enum` | SMTP user enumeration (VRFY, EXPN, RCPT) |\n| `smb_enum` | SMB service check (port 445) |\n| `snmp_enum` | SNMP service availability check |\n| `ssh_audit` | SSH server banner + algorithm audit |\n| `lfi_detect` | Local/Remote File Inclusion testing |\n| `ssti_detect` | Server-Side Template Injection testing |\n| `xxe_detect` | XML External Entity injection testing |\n| `ssrf_detect` | Server-Side Request Forgery testing |\n| `sub_takeover` | Subdomain takeover detection |\n| `origin_ip_discovery` | Origin IP behind CDN discovery |\n| `service_fingerprint` | Deep banner grabbing service fingerprint |\n\n### PHP2SHELL detection\n\nMCP tools identify CVE-2026-109618 and CVE-2026-109619 without PHP2SHELL\nexploit/load probes. The current server registers **209 tools**.\n\n- **Recommended for PHP2SHELL-only checks:**\n  `php2shell_scan(target=\"https://your-authorized-host.example\")` performs normal\n  GET/HEAD/OPTIONS and optional discovery of five common phpinfo pages. It is not\n  the broad `vuln_scan`; no credential checks run. Default 8 requests (hard max 12),\n  200 KB decoded body limit per response, TLS verified, 30-second whole-scan deadline.\n  Redirects must keep the same scheme, host and port (max 2 hops); HTTP 429 stops\n  scanning. Use `phpinfo_paths=false` to disable diagnostic-page discovery.\n- `vuln_scan(target=\"https://your-authorized-host.example\")` adds a `php2shell`\n  assessment from existing response headers. Existing unrelated scan checks still run.\n- `cve_search(service=\"php\", version=\"8.4.26\")` includes offline version-based\n  PHP2SHELL matches even if the NVD lookup fails.\n\n`php2shell.status` is `potentially_affected` (two probable CVE findings),\n`not_affected_by_version` (advertised version meets its branch fix), or `unknown`\n(insufficient evidence, EOL/future branch, prerelease or conflicting versions).\nFixed baselines: **8.2.35 / 8.3.36 / 8.4.27 / 8.5.12**.\nNeither a banner nor a Composer PHP constraint proves the deployed runtime.\nCheck vendor backports and actual serving workers before reporting affectedness\nor remediation. A hidden version is not evidence of safety.\n\nThe dedicated tool also returns `coverage`, per-request method/URL/status/error,\n`presence_signals`, and allowlisted phpinfo `configuration` with source URLs. It\ndistinguishes `access_blocked`, `php_detected_version_hidden`,\n`redirect_out_of_scope`, `network_error`, `rate_limited`, `budget_exhausted`,\n`timeout`, `conflicting_evidence`, `no_php_evidence` and `version_identified`.\n`version_unclassified` means version evidence exists but its branch/build cannot\nbe classified by the advisory table. These are collection outcomes, separate from\nthe CVE version assessment. Query strings, fragments and URL credentials are\nremoved from exported URLs. Requests ask for identity encoding; unexpectedly\ncompressed bodies are skipped and marked in the request record, not decompressed.\nNo raw phpinfo pages, cookie values, environment variables or secrets are exported.\n`session.upload_progress.enabled=Off` does not mean either CVE is patched.\n\nThe `cybersec-vulns` and `cybersec-verification` skills describe these evidence\nlimits. Restart the MCP server/client after updating. If your client uses an\ninstalled plugin/cache rather than this checkout, update that installation too;\nediting this source tree does not update an already-running server or cached skills.\n\nValidation: `mcp/.venv/bin/python -m unittest discover -s mcp/tests -p 'test_php2shell*.py' -v`.\nReferences: [PHP advisory](https://www.php.net/archive/2026.php#2026-10-21-5),\n[VulnCheck](https://www.vulncheck.com/blog/php2shell-vulnerabilities),\n[Ramikan](https://github.com/Ramikan/PHP2SHELL-Scanner),\n[JoasASantos](https://github.com/JoasASantos/php2shell-scanner).\nThe reference source was reviewed for banner/diagnostic/presence techniques;\nit is not executed or blindly wrapped. Exploit/race/malformed probes, uploads,\nsecrets-file probing, automatic subdomain expansion and origin bypass are excluded.\n\n### CLI Wrapper Tools\n\nRequire the corresponding CLI binary. Returns install hint if not found:\n\n| Tool | CLI Required | Description |\n|------|-------------|-------------|\n| `nikto_scan` | nikto | Web server vulnerability scanner |\n| `sqlmap_check` | sqlmap | SQL injection detection |\n| `amass_enum` | amass | Attack surface mapping |\n| `wpscan_check` | wpscan | WordPress vulnerability scanner |\n| `masscan_scan` | masscan | Ultra-fast TCP port scanner |\n| `xsstrike_check` | xsstrike | XSS vulnerability detection |\n| `gitleaks_check` | gitleaks | Git secret scanning |\n| `cmseek_check` | cmseek | CMS detection |\n| `testssl_check` | testssl | SSL/TLS server testing |\n| `sslyze_check` | sslyze | Fast SSL/TLS scanning |\n| `gobuster_dir` | gobuster | Directory/file brute-forcing |\n| `ffuf_fuzz` | ffuf | Fast web fuzzing |\n| `nuclei_scan` | nuclei | Template-based vulnerability scanner |\n| `nmap_scan` | nmap | Full network scan with service detection |\n| `hydra_brute` | hydra | Online password brute forcing |\n| `searchsploit` | searchsploit | Search exploit-db |\n\n### Web Vulnerability Testing\n\n| Tool | Description |\n|------|-------------|\n| `sqli_detect` | SQL injection detection (error-based, time-based, UNION) |\n| `xss_detect` | Active XSS injection testing |\n| `cmd_injection` | Command injection testing |\n| `nosql_inject` | NoSQL injection testing |\n| `csrf_detect` | CSRF token validation |\n| `idor_detect` | Insecure Direct Object Reference testing |\n| `upload_bypass` | File upload filter bypass |\n| `host_header_injection` | Host header injection testing |\n| `race_condition` | Race condition testing |\n| `prototype_pollution` | Prototype pollution testing |\n| `smuggling_check` | HTTP request smuggling |\n| `bypass_403` | 403 bypass techniques |\n| `log4j_scan` | Log4j JNDI injection |\n| `graphql_injection` | GraphQL injection testing |\n| `jwt_forgery` | JWT forgery testing |\n| `cookie_audit` | Cookie security audit |\n| `cookie_editor` | Cookie manipulation and forging |\n| `csp_analyze` | Content-Security-Policy analysis |\n| `websocket_test` | WebSocket endpoint testing |\n\n### CMS & Framework Scanners\n\n| Tool | Description |\n|------|-------------|\n| `wordpress_scan` | WordPress security scan |\n| `joomla_scan` | Joomla CMS scanner |\n| `drupal_scan` | Drupal security scan |\n| `magento_scan` | Magento security scan |\n| `laravel_scan` | Laravel app scan |\n| `nextjs_scan` | Next.js security scan |\n| `django_scan` | Django security scan |\n| `rails_scan` | Ruby on Rails scan |\n| `express_scan` | Express.js scan |\n| `spring_scan` | Spring Boot actuator scan |\n| `sharepoint_scan` | SharePoint scanner |\n\n### Deserialization & Injection\n\n| Tool | Description |\n|------|-------------|\n| `php_deserialize` | PHP deserialization testing |\n| `java_deserialize` | Java deserialization testing |\n\n### Exploit-DB & GHDB\n\n| Tool | Description |\n|------|-------------|\n| `exploit_db_search` | Search Exploit-DB for CVEs, types, platforms |\n| `exploit_db_detail` | Get Exploit-DB exploit details with code |\n| `exploit_db_download` | Download exploit code from Exploit-DB |\n| `ghdb_search` | Search Google Hacking Database |\n\n### Reconnaissance & OSINT\n\n| Tool | Description |\n|------|-------------|\n| `shodan_lookup` | Shodan search for exposed devices |\n| `wayback_urls` | Wayback Machine URL history |\n| `vhost_discovery` | Virtual host discovery |\n| `amass_enum` | Attack surface mapping |\n| `oob_test` | Blind OOB interaction test |\n\n### Active Directory\n\n| Tool | Description |\n|------|-------------|\n| `bloodhound_collect` | Collect AD data for BloodHound |\n| `ldap_enum` | LDAP anonymous bind enumeration |\n\n### Cloud Security\n\n| Tool | Description |\n|------|-------------|\n| `cloud_enum` | Enumerate cloud storage (S3, Azure, GCP) |\n| `s3_scanner` | Check S3 bucket public access |\n| `cloud_iam_audit` | Audit cloud IAM policies |\n| `cloud_infra` | Enumerate cloud infra config |\n| `k8s_scan` | Kubernetes API scan |\n| `docker_scan` | Docker socket exposure scan |\n\n### Code Audit\n\n| Tool | Description |\n|------|-------------|\n| `bandit_scan` | Python bandit SAST scanner |\n| `semgrep_scan` | Semgrep multi-language SAST |\n| `sast_review` | Pattern-based code review |\n| `secret_scanner` | Regex + entropy secret scanning |\n| `gitleaks_check` | Git secret scanning |\n| `ci_cd_scan` | CI/CD config scan |\n| `supply_chain` | Dependency vulnerability check |\n\n### AI & LLM Security\n\n| Tool | Description |\n|------|-------------|\n| `prompt_injection` | LLM prompt injection testing |\n| `llm_guardrails` | LLM safety guardrails check |\n| `llm_model_dos` | LLM DoS via token generation |\n| `llm_data_exposure` | LLM training data leakage test |\n| `llm_agent_hijack` | LLM agent function call injection |\n| `mcp_abuse_test` | MCP server abuse testing |\n| `browser_agent_hijack` | Browser AI agent hijack test |\n| `captcha_test` | CAPTCHA bypass testing |\n\n### Mobile & Desktop\n\n| Tool | Description |\n|------|-------------|\n| `apk_analyze` | Android APK analysis |\n| `ipa_analyze` | iOS IPA analysis |\n| `ios_data_storage` | iOS local data storage check |\n| `ios_frida` | Frida iOS runtime analysis |\n| `ios_objection` | Objection iOS exploration |\n| `ios_signing` | iOS app signing check |\n| `desktop_electron` | Electron app analysis |\n| `desktop_entitlements` | Desktop entitlements check |\n| `desktop_config` | Desktop config file scan |\n| `desktop_packages` | Desktop package CVE check |\n| `desktop_strings` | Desktop binary string extraction |\n| `binary_checksec` | Binary security analysis |\n| `stego_detect` | Steganography detection |\n\n### Other Tools\n\n| Tool | Description |\n|------|-------------|\n| `hash_analyze` | Hash type identification |\n| `hash_detect` | Hash type detection (20+ types) |\n| `redis_enum` | Redis server enumeration |\n| `metrics_check` | Exposed metrics endpoint check |\n| `log_exposure` | Exposed log file scan |\n| `exposed_git` | Exposed .git folder check |\n| `exposed_backup` | Exposed backup file scan |\n| `misplaced_files` | Misplaced sensitive file scan |\n| `oauth_scan` | OAuth/OIDC endpoint scan |\n| `ssl_pinning_check` | SSL pinning behavior check |\n| `oob_test` | OOB blind interaction test |\n\n### Enterprise Tools\n\nInspired by HackerOne and Pentest-Tools.com — workflow orchestration, findings management, continuous monitoring, and risk scoring.\n\n| Tool | Description |\n|------|-------------|\n| `attack_surface_map` | Aggregate scan results into an attack surface graph |\n| `findings_manager` | Centralized findings DB — add, list, update status, stats, export, clear. Deduplicates by hash |\n| `vuln_validate` | Verify exploitability, filter false positives with confidence score |\n| `pentest_workflow` | Chain tools with conditions. 5 templates: web-audit, recon-full, network-scan, bugbounty, cloud-audit |\n| `continuous_monitor` | Track target changes over time with snapshot diffing |\n| `retest_vuln` | Re-run heuristic probes; failed/blocked retests are inconclusive, negative probes are not proof of a fix. Supports sqli, xss, lfi, ssrf, open_redirect, ssti, log4j |\n| `bulk_scan` | Scan multiple targets at once (port_scan, http_probe, ssl_check, vuln_scan). Max 50 |\n| `vuln_diff` | Compare 2 scan results — new, resolved, changed findings + port changes |\n| `authenticated_scan` | Scan behind login (form/cookie/header auth). Detects IDOR, sensitive data, missing headers |\n| `report_export` | Export to HTML, CSV, markdown, JSON. HTML includes styled executive summary |\n| `risk_score` | CVSS + business impact + likelihood scoring |\n\n### Advanced Tools (16 new)\n\nAutomated exploitation, workflow management, OSINT, reporting, and integrations.\n\n| Tool | Description |\n|------|-------------|\n| `auto_exploit` | Auto-exploit chain: detect → verify → exploit (sqli, xss, lfi, ssrf, open_redirect) |\n| `scan_template` | Pre-defined tool combos: quick-recon, web-full, network-audit, api-security, cloud-audit, ad-pentest, code-audit, ctf |\n| `executive_summary` | Auto-generate executive summary — risk posture, severity breakdown, top findings, recommendations |\n| `compliance_map` | Map findings to SOC2, ISO27001, GDPR, PCI-DSS, NIST 800-53 control IDs |\n| `notify_webhook` | Send findings to Slack, Discord, or Microsoft Teams via webhook |\n| `jira_create` | Create Jira issue from security finding — custom project, labels, priority |\n| `people_osint` | Individual OSINT — GitHub profile, social media presence, email analysis |\n| `password_audit` | Multi-protocol password audit — SSH, FTP, SMTP, HTTP form, RDP with default wordlist |\n| `cloud_audit` | Comprehensive cloud audit — S3 public, K8s API, Docker socket, IAM, infra |\n| `sqli_exploit` | Generate PoC SQLi exploit payloads (error, union, boolean, time, stacked) |\n| `xss_exploit` | Generate PoC XSS exploit links (reflected, stored, DOM, WAF bypass, cookie steal) |\n| `http_logger` | Persistent HTTP request/response logger with search, stats, and export |\n| `branded_report` | White-label pentest reports — custom logo, colors, company name, disclaimer |\n| `vuln_database` | Local vulnerability database — add, search, update, delete, tags, import/export |\n| `github_issue` | Create GitHub issue from security finding — labels, severity, evidence |\n| `custom_wordlist` | Custom wordlist manager — create, merge, generate, import, upload |\n| `auth_macro_runner` | Multi-step auth session chain — form login, basic auth, bearer token, cookie persistence, custom step sequences |\n| `csrf_extract` | Extract and analyze anti-CSRF tokens from meta tags, hidden inputs, JS variables, cookies, and headers |\n| `idor_access_validation` | Multi-role IDOR/BOLA validation — sequential enum, cross-user access, negative/array bypass |\n| `injection_validator` | Unified injection validator — SQLi, XSS, NoSQL, CMD, LDAP, SSTI, XXE with multi-technique payloads |\n| `oast_callback_server` | OAST callback correlation for blind SSRF/XXE/OOB — generate, poll, status, retry |\n| `upload_exploit_chain` | Upload → Verify → Execute chain — PHP/JSP/ASP/SVG/PY/SH payloads with execution validation |\n| `cache_poison_check` | Web cache poisoning detection — header injection, cache deception, scheme bypass, key manipulation |\n| `cmd_oast_helper` | Blind command injection OAST — OOB callback correlation + time-based detection |\n| `report_schema_v2` | Standardized report schema v2 — validate, convert v1→v2, merge, create with evidence chain hash |\n| `vuln_validate` | **[UPGRADED]** Confidence engine v2 — evidence scoring, FP signal detection, reproducibility check, severity-adjusted recommendations |\n| `engagement_gate` | Pre-flight scope validation, authorization check, engagement rules, target verification |\n| `approval_artifact` | Digital approval workflow — request/approve/deny for destructive actions with audit trail |\n| `session_verification` | Validate session cookies, JWT, bearer tokens, API keys — check expiry, format, security flags |\n| `http_ingest` | Import URLs, cURL commands, raw HTTP, HAR, Burp XML, OpenAPI specs into standardized findings |\n| `raw_replay` | Faithful raw HTTP replay — send exact bytes, capture full response, template preview |\n| `evidence_manifest` | SHA256 hash chain for court-admissible evidence — add, verify, diff, ledger integrity |\n| `cleanup_tracking` | Log modifications/uploads, generate cleanup scripts, track artifact state |\n| `vulnerable_fixture` | Local vulnerable app (SQLi, XSS, LFI, CMD, SSRF) for E2E tool validation |\n\n---\n\n## Skills Guide\n\nThe plugin includes **23** methodology skills that guide the AI through structured security testing:\n\n| Skill | Triggers When User Says... |\n|-------|---------------------------|\n| **cybersec-recon** | \"recon\", \"enumerate\", \"find subdomains\", \"DNS\" |\n| **cybersec-osint** | \"osint\", \"shodan\", \"url history\", \"wayback\" |\n| **cybersec-scanning** | \"scan ports\", \"service detection\", \"fingerprint\" |\n| **cybersec-vulns** | \"find vulnerabilities\", \"CVEs\", \"weaknesses\" |\n| **cybersec-web** | \"web app test\", \"SQLi\", \"XSS\", \"CMS\" |\n| **cybersec-bugbounty** | \"bug bounty\", \"nuclei\", \"403 bypass\", \"smuggling\" |\n| **cybersec-ad** | \"active directory\", \"domain\", \"kerberos\", \"bloodhound\" |\n| **cybersec-cloud** | \"cloud\", \"AWS\", \"Azure\", \"GCP\", \"S3\", \"bucket\" |\n| **cybersec-password** | \"password\", \"hash\", \"brute force\", \"hydra\" |\n| **cybersec-exploit** | \"exploit\", \"PoC\", \"get shell\", \"metasploit\" |\n| **cybersec-crisis** | \"incident\", \"breach\", \"emergency\", \"compromised\" |\n| **cybersec-report** | \"report\", \"remediation\", \"fix\", \"document\" |\n| **cybersec-ai** | \"AI\", \"LLM\", \"prompt injection\", \"guardrails\" |\n| **cybersec-ai-safety** | \"AI safety\", \"bug bounty\", \"OpenAI\", \"agent hijack\" |\n| **cybersec-desktop** | \"desktop\", \"Electron\", \"binary\", \"strings\" |\n| **cybersec-code-audit** | \"code audit\", \"SAST\", \"secret scan\", \"source review\" |\n| **cybersec-ctf** | \"CTF\", \"capture the flag\", \"challenges\" |\n| **cybersec-verification** | \"verify\", \"evidence\", \"confirm\", \"double-check\" |\n| **cybersec-parallel** | \"parallel\", \"multi-target\", \"batch\", \"concurrent\" |\n| **cybersec-review** | \"review feedback\", \"false positive\", \"peer review\" |\n| **cybersec-skill-dev** | \"create skill\", \"new methodology\", \"edit skill\" |\n| **cybersec-ctem** | \"CTEM\", \"attack surface\", \"continuous monitoring\", \"exposure management\" |\n| **using-cybersec** | (bootstrap — auto-loaded every session) |\n\nSkills load automatically via intent detection. The AI follows the skill's methodology step by step.\n\n---\n\n## Agents (OpenCode + Cursor)\n\nOpenCode agents live in `.opencode/agents/`. Cursor-compatible mirrors ship in `agents/` (declared in `.cursor-plugin/plugin.json`) with the same roles: **pentester**, **recon**, **vuln-analyst**, **report-writer**. Cursor also loads `rules/cybersec-pipeline.mdc` for the default enterprise flow.\n\n**Default pipeline:** `engagement_gate` → `observe-first` / opt-in `staging-deep` → `findings_manager` → verification → `report_schema_v2` / `branded_report` → tickets → `retest_vuln`.\n\nOpenCode-compatible agents are included in `.opencode/agents/`. These agents have tailored permissions and prompts for different security testing phases.\n\n### Pentester (Primary)\n\n**File:** `.opencode/agents/pentester.md`\n**Mode:** Primary (cycle with Tab: Build → Plan → Pentester)\n**Color:** Red (`#DC2626`)\n**Permissions:** Full access (edit, bash, read, all MCP tools)\n\nThe default pentesting agent. Load this when you want the AI to act as a security tester. It has access to all 180+ MCP tools, can edit files, run bash commands, and dispatch subagents.\n\n**Usage:**\n1. Press **Tab** in OpenCode until you see **Pentester** (red)\n2. Ask: `\"audit example.com\"` or `\"find vulnerabilities in this codebase\"`\n\n**Flow:**\n```\nUser: \"audit example.com\"\n  → Pentester auto-loads cybersec-recon skill\n  → Calls @recon subagent for passive intel\n  → Calls @vuln-analyst subagent for active scanning\n  → Calls @report-writer subagent for report\n  → Output: Full penetration testing report\n```\n\n### Recon (Subagent)\n\n**File:** `.opencode/agents/recon.md`\n**Mode:** Subagent (invoke with `@recon`)\n**Color:** Blue (`#3B82F6`)\n**Permissions:** Read-only (no edit, no bash)\n\nPassive reconnaissance and OSINT specialist. Gathers intelligence without actively probing the target.\n\n**Skills:** `cybersec-recon`, `cybersec-osint`\n\n**Tools:** `subdomain_enum`, `dns_lookup`, `whois_lookup`, `crt_search`, `shodan_lookup`, `wayback_urls`, `dork_search`, `ghdb_search`, `reverse_ip`, `asn_lookup`\n\n**Usage:**\n```\n@recon gather intelligence on example.com\n@recon find subdomains for target.com\n@recon run OSINT on this domain\n```\n\n### Vuln Analyst (Subagent)\n\n**File:** `.opencode/agents/vuln-analyst.md`\n**Mode:** Subagent (invoke with `@vuln-analyst`)\n**Color:** Amber (`#F59E0B`)\n**Permissions:** Bash + read (no file editing)\n\nActive vulnerability analyst. Scans, fingerprints, and tests for vulnerabilities. Can run bash commands and MCP tools but cannot edit project files.\n\n**Skills:** `cybersec-scanning`, `cybersec-vulns`, `cybersec-web`, `cybersec-bugbounty`, `cybersec-ad`, `cybersec-cloud`, `cybersec-password`, `cybersec-ai`, `cybersec-ai-safety`, `cybersec-desktop`, `cybersec-code-audit`, `cybersec-ctf`, `cybersec-exploit`\n\n**Tools:** `port_scan`, `nmap_scan`, `ssl_check`, `vuln_scan`, `sqli_detect`, `xss_detect`, `nuclei_scan`, `nikto_scan`, `sqlmap_check`, `exploit_db_search`, `cloud_enum`, `s3_scanner`, `bloodhound_collect`, `ldap_enum`, `bandit_scan`, `semgrep_scan`, `prompt_injection`, `apk_analyze`, `ipa_analyze`, and 80+ more\n\n**Usage:**\n```\n@vuln-analyst scan ports on example.com\n@vuln-analyst test for SQL injection in this URL\n@vuln-analyst run nuclei scan on target\n@vuln-analyst audit this codebase for vulnerabilities\n```\n\n### Report Writer (Subagent)\n\n**File:** `.opencode/agents/report-writer.md`\n**Mode:** Subagent (invoke with `@report-writer`)\n**Color:** Green (`#10B981`)\n**Permissions:** Edit + read (no bash)\n\nSecurity report writer. Verifies findings and generates professional penetration testing reports with remediation plans.\n\n**Skills:** `cybersec-report`, `cybersec-verification`, `cybersec-review`\n\n**Tools:** `generate_report`, plus all read-only MCP tools for verification\n\n**Usage:**\n```\n@report-writer generate a pentest report from these findings\n@report-writer verify these vulnerabilities and write a report\n@report-writer create a remediation plan for these issues\n```\n\n**Report structure:**\n```\n# Penetration Testing Report\n## Executive Summary\n## Scope\n## Methodology\n## Findings (sorted by severity: Critical → High → Medium → Low → Info)\n  - Description, Evidence, Reproduction, Impact, Remediation\n## Remediation Summary\n## References (CVEs, OWASP, etc.)\n```\n\n### Agent Workflow Diagram\n\n```\n                    ┌─────────────────────────────────┐\n                    │       PENTESTER (primary)       │\n                    │   Tab → Build → Plan → Pentester │\n                    │     Full access, all skills     │\n                    └──────────────┬──────────────────┘\n                                   │\n                    ┌──────────────┼──────────────┐\n                    │              │              │\n                    ▼              ▼              ▼\n             ┌──────────┐  ┌─────────────┐  ┌──────────────┐\n             │  @recon  │  │@vuln-analyst│  │@report-writer│\n             │ read-only│  │ bash + read │  │  edit + read │\n             │ passive  │  │   active    │  │    report    │\n             │ OSINT    │  │  scanning   │  │  verify+write│\n             └──────────┘  └─────────────┘  └──────────────┘\n```\n\n### Creating Custom Agents\n\nYou can create your own agents by adding markdown files to `.opencode/agents/`:\n\n```markdown\n---\ndescription: Custom security analyst for your workflow\nmode: subagent\npermission:\n  edit: deny\n  bash: allow\n---\nYour custom prompt here.\n```\n\nSee the [OpenCode Agents documentation](https://opencode.ai/docs/agents/) for full reference.\n\n---\n\n## Troubleshooting\n\n### MCP Server not found\n\n```bash\n# Verify MCP server works\n./mcp/.venv/bin/python3 -m server\n# Should start a stdio MCP server — test with:\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}' | ./mcp/.venv/bin/python3 -m server\n```\n\nExpected output: 180+ tools listed.\n\n### OpenCode plugin not loading\n\n1. Check `~/.config/opencode/opencode.json` for the plugin line\n2. Restart OpenCode\n3. Check logs: `opencode run --print-logs \"hello\" 2>&1 | grep -i cybersec`\n\n### Claude Code plugin not loading\n\n1. Check `.mcp.json` MCP server config\n2. Restart Claude Code\n3. Verify: `/plugin list` should show cybersec\n\n### Module not found errors\n\n```bash\nsource mcp/.venv/bin/activate\npip install 'fastmcp>=3.4.2,<4' httpx dnspython 'impacket>=0.12.0'\n```\n\n### CLI tools not found\n\nCLI wrapper tools (nikto, sqlmap, etc.) return an error with install instructions when the binary is missing. The core 25+ tools work without any external dependencies.\n\n---\n\n## Requirements\n\n- **Python 3.10+**\n- Any supported AI coding agent (Claude Code, Cursor, Codex, Gemini CLI, Copilot CLI, Kimi Code, OpenCode, Pi)\n- Python packages: `fastmcp>=3.4.2,<4`, `httpx`, `dnspython` (installed in `.venv`)\n- Optional CLI tools: nikto, sqlmap, amass, wpscan, masscan, xsstrike, gitleaks, cmseek, testssl, sslyze, gobuster, ffuf, nuclei, nmap, hydra, searchsploit\n\n---\n\n## License\n\nMIT License - see LICENSE file for details.\n"}