MCP Servers

26zl/cybersec-toolkit

Name: 26zl/cybersec-toolkit
Author: Various

One command installs 670+ security tools on Linux & Termux.

Visit site ↗

Our verdict

Not reviewed yet

We have not reviewed 26zl/cybersec-toolkit yet

No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.

How we review records

From the listing

About 26zl/cybersec-toolkit

One command installs more than 670 security tools on Linux and Termux. Its authorization-gated MCP server works with Claude Code, OpenCode, Codex, Gemini CLI, Ollama-backed agents, and other MCP clients. It includes over 870 agent skills for CTF, pentesting, bug bounty, DFIR, and red or blue team work, acting as a companion by default and switching to autonomous mode when asked.

Best for

Security practitioners on Linux or Termux who want an AI agent ready with a broad offensive and defensive toolset

Use cases

Stand up a full security toolchain on a fresh Linux or Termux environment
Give an MCP-compatible coding agent access to pentesting and DFIR tooling
Attach a red or blue team skill library to an AI agent for CTF or bug bounty work

Notes

56 stars on GitHub. Last updated 2026-09-15. Licensed MIT.

Pros

Extremely broad tool and skill coverage in a single install
Works across many popular agent runtimes via MCP
Authorization gate gives agents safe default behavior

Cons

Small community with only 56 stars, so limited peer validation
No single vendor backing, which may affect long-term maintenance
Autonomous mode carries inherent risk if used on unauthorized systems

Key facts

What we have checked

Days since the last commit: 4; Checked 7 Nov 2026GitHub
GitHub forks: 18; Checked 7 Nov 2026GitHub
GitHub stars: 92; Checked 7 Nov 2026GitHub
Days to a first reply on issues: 58.2; Checked 7 Nov 2026GitHub
Open issues: 1; Checked 7 Nov 2026GitHub
Releases in the last 90 days: 5; Checked 7 Nov 2026GitHub

Each value shows when we last confirmed it and where it came from. Values we have not confirmed are left out, never guessed.

How to use

How to set it up

As the listing publishes it. We have not run this install.

Install

git clone --depth 1 --branch v1.4.0 https://github.com/26zl/cybersec-toolkit.git && cd cybersec-toolkit && sudo ./install.sh --profile ctf

Tools exposed

list_tools
check_installed
get_tool_info
get_module_info
get_profile_tools
suggest_for_ctf
suggest_for_bounty
guided_assessment
get_cve_info
recommend_install
list_profiles
run_tool
run_pipeline
run_script
manage_remote_hosts

Clients the listing names (not checked here)

Claude Desktop, Claude Code, Cursor, Cline, Continue, VS Code

Install

Add 26zl/cybersec-toolkit to your client

Not verified yet

Our lab has not run this server yet. "Config checked" on a client means the recipe matches that client's documented config format; it does not mean we ran it.

Claude Code

Config checked

Run in your terminal (runs on your computer)

claude mcp add --transport stdio 26zl-cybersec-toolkit -- docker run -i --rm --entrypoint uv --security-opt no-new-privileges ghcr.io/26zl/cybersec-toolkit:1.4.0 run --directory mcp_server fastmcp run server.py --transport stdio --no-banner

Version 1.4.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Claude Code's config docs

Claude Desktop

Config checked

Add to claude_desktop_config.json (runs on your computer)

{
  "mcpServers": {
    "26zl-cybersec-toolkit": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--entrypoint",
        "uv",
        "--security-opt",
        "no-new-privileges",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ]
    }
  }
}

Version 1.4.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Claude Desktop's config docs

Cursor

Config checked

Add to .cursor/mcp.json (runs on your computer)

{
  "mcpServers": {
    "26zl-cybersec-toolkit": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--entrypoint",
        "uv",
        "--security-opt",
        "no-new-privileges",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ]
    }
  }
}

Version 1.4.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Cursor's config docs

VS Code

Config checked

Add to .vscode/mcp.json (runs on your computer)

{
  "servers": {
    "26zl-cybersec-toolkit": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--entrypoint",
        "uv",
        "--security-opt",
        "no-new-privileges",
        "ghcr.io/26zl/cybersec-toolkit:1.4.0",
        "run",
        "--directory",
        "mcp_server",
        "fastmcp",
        "run",
        "server.py",
        "--transport",
        "stdio",
        "--no-banner"
      ]
    }
  }
}

Version 1.4.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against VS Code's config docs

Codex

Config checked

Add to ~/.codex/config.toml (runs on your computer)

[mcp_servers.26zl-cybersec-toolkit]
command = "docker"
args = ["run", "-i", "--rm", "--entrypoint", "uv", "--security-opt", "no-new-privileges", "ghcr.io/26zl/cybersec-toolkit:1.4.0", "run", "--directory", "mcp_server", "fastmcp", "run", "server.py", "--transport", "stdio", "--no-banner"]

Version 1.4.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Codex's config docs

ChatGPT: ChatGPT connects only to remote servers that need no API key.

Recipes come from the server's entry in the official MCP registry. Check the package name before you run it, and keep keys out of shared files.

Works with

What 26zl/cybersec-toolkit connects to

5 clients, each with how we know and when we checked.

Works with	Type	How we know	Checked
Claude Code	Client	Install recipe matches the client's documented formatRuns locally, version 1.4.0Config checked	24 Oct 2026Claude Code docs
Claude Desktop	Client	Install recipe matches the client's documented formatRuns locally, version 1.4.0Config checked	24 Oct 2026Claude Desktop docs
Cursor	Client	Install recipe matches the client's documented formatRuns locally, version 1.4.0Config checked	24 Oct 2026Cursor docs
VS Code	Client	Install recipe matches the client's documented formatRuns locally, version 1.4.0Config checked	24 Oct 2026VS Code docs
Codex	Client	Install recipe matches the client's documented formatRuns locally, version 1.4.0Config checked	24 Oct 2026Codex docs

Stars and usage

How 26zl/cybersec-toolkit is growing

GitHub stars

84 to 92

stars. 26 Oct 2026 to 7 Nov 2026, 3 readings.

Source: GitHub. Checked 7 Nov 2026.

Health and security

Is 26zl/cybersec-toolkit looked after, and what do its setup files show

Health score

45 out of 100

Does someone look after this repository? It does not say the code is good or safe. Worked out from GitHub signals checked 7 Nov 2026. How it is worked out

Part	Points	What we saw
Recent activity	30 of 30	Last push 4 days ago
Releases	15 of 15	5 releases in 90 days
Issue replies	0 of 20	First reply in 58.2 days (median)
Maintainer	0 of 15	Owned by a single user
Official source	0 of 20	Community server

Security check static checks

100 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 28 Oct 2026 by edna-static-v1. What it checks

Licence: MIT

Note No published npm or PyPI package of this repository was found, so package advisories were not checked.
Note The lab has not recorded this server's tool list yet, so tool permissions were not checked.

Sources

Where this comes from

GitHubRegistry
Checked 7 Nov 2026 · Days since the last commit, GitHub forks, GitHub stars, Days to a first reply on issues, Open issues, Releases in the last 90 days

A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.

Changelog

What changed

No changes recorded yet. Releases, price changes and deprecations appear here, with their dates, once we track them for this record.

Pairs with

Other entries in the index that connect to this one. Click through to see the chain.

Pairs with4 entries

MMCPlowCatalogue

LaurieWired/GhidraMCP

Various

MCP Server for Ghidra

★ 9,080

MMCPlowCatalogue

mrexodia/ida-pro-mcp

Various

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

★ 9,040

MMCPlowCatalogue

semgrep/semgrep

Various

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

★ 16,778

MMCPlowCatalogue

skill-seekers/Skill_Seekers

Various

Convert documentation websites, GitHub repositories, and PDFs into Claude AI skills with automatic conflict detection

★ 13,877

Free 27-page guide

Get the free Developer’s Field Guide

A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.

Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.

← Back to MCP Servers Submit your own entry →