Qué puede hacer: io.github.26zl/cybersec-toolkit
Servidor MCP · 26zl
Lo que io.github.26zl/cybersec-toolkit declara, pide y ejecuta, según los marketplaces que leemos. Se ejecuta en tu equipo, en un contenedor iniciado desde esta imagen: ghcr.io/26zl/cybersec-toolkit:1.3.0. Variables de entorno que pide: 2, de ellas secretos: 0. Según nuestra pasada por los marketplaces del 2026-10-13.
Esto no es una auditoría de seguridad. Mostramos lo que los marketplaces publican sobre este plugin: lo que declara, lo que pide y lo que ejecuta. No ejecutamos ni revisamos su código, y la marca de verificado es una afirmación del marketplace, no nuestra.
Dónde se ejecuta
- Se ejecuta en tu equipo, en un contenedor iniciado desde esta imagen:
ghcr.io/26zl/cybersec-toolkit:1.3.0 - Se instala en la herramienta de IA como paquete de plugins; lo que inicia se indica abajo.
Qué declara
Ninguno de los marketplaces que leemos publica una lista de herramientas para él.
Prompts y recursos: los marketplaces que leemos no los publican.
Qué pide
Variables de entorno que pide: 2, de ellas secretos: 0. Según lo declarado en: Official MCP Registry.
CYBERSEC_MCP_ALLOW_EXTERNALCYBERSEC_MCP_ALLOW_SCRIPTS
Variables de entorno que pide: 2, de ellas secretos: 0. Según lo declarado en: Community GitHub marketplaces.
CYBERSEC_MCP_ALLOW_EXTERNALobligatoriaCYBERSEC_MCP_ALLOW_SCRIPTSobligatoria
Solo nombres: no guardamos valores, ejemplos ni descripciones de estas variables. Los marketplaces que leemos no publican los scopes de OAuth ni los ajustes de instalación.
Qué ejecuta además de MCP
Skills: 199 Según lo declarado en: Community GitHub marketplaces.
acquiring-disk-image-with-dd-and-dcflddadd-toolai-llm-security-reviewai-threat-testinganalyzing-active-directory-acl-abuseanalyzing-android-malware-with-apktoolanalyzing-api-gateway-access-logsanalyzing-apt-group-with-mitre-navigatoranalyzing-azure-activity-logs-for-threatsanalyzing-bootkit-and-rootkit-samplesanalyzing-browser-forensics-with-hindsightanalyzing-campaign-attribution-evidence
Mostrar los otros 187
analyzing-certificate-transparency-for-phishinganalyzing-cloud-storage-access-patternsanalyzing-cobalt-strike-beacon-configurationanalyzing-cobaltstrike-malleable-c2-profilesanalyzing-command-and-control-communicationanalyzing-cyber-kill-chainanalyzing-disk-image-with-autopsyanalyzing-dns-logs-for-exfiltrationanalyzing-docker-container-forensicsanalyzing-email-headers-for-phishing-investigationanalyzing-ethereum-smart-contract-vulnerabilitiesanalyzing-golang-malware-with-ghidraanalyzing-heap-spray-exploitationanalyzing-indicators-of-compromiseanalyzing-ios-app-security-with-objectionanalyzing-kubernetes-audit-logsanalyzing-linux-audit-logs-for-intrusionanalyzing-linux-elf-malwareanalyzing-linux-kernel-rootkitsanalyzing-linux-system-artifactsanalyzing-lnk-file-and-jump-list-artifactsanalyzing-macro-malware-in-office-documentsanalyzing-malicious-pdf-with-peepdfanalyzing-malicious-url-with-urlscananalyzing-malware-behavior-with-cuckoo-sandboxanalyzing-malware-family-relationships-with-malpediaanalyzing-malware-persistence-with-autorunsanalyzing-malware-sandbox-evasion-techniquesanalyzing-memory-dumps-with-volatilityanalyzing-memory-forensics-with-lime-and-volatilityanalyzing-mft-for-deleted-file-recoveryanalyzing-network-covert-channels-in-malwareanalyzing-network-flow-data-with-netflowanalyzing-network-packets-with-scapyanalyzing-network-traffic-for-incidentsanalyzing-network-traffic-of-malwareanalyzing-network-traffic-with-wiresharkanalyzing-office365-audit-logs-for-compromiseanalyzing-outlook-pst-for-email-forensicsanalyzing-packed-malware-with-upx-unpackeranalyzing-pdf-malware-with-pdfidanalyzing-persistence-mechanisms-in-linuxanalyzing-powershell-empire-artifactsanalyzing-powershell-script-block-logginganalyzing-prefetch-files-for-execution-historyanalyzing-ransomware-encryption-mechanismsanalyzing-ransomware-leak-site-intelligenceanalyzing-ransomware-network-indicatorsanalyzing-ransomware-payment-walletsanalyzing-sbom-for-supply-chain-vulnerabilitiesanalyzing-security-logs-with-splunkanalyzing-slack-space-and-file-system-artifactsanalyzing-supply-chain-malware-artifactsanalyzing-threat-actor-ttps-with-mitre-attackanalyzing-threat-actor-ttps-with-mitre-navigatoranalyzing-threat-intelligence-feedsanalyzing-threat-landscape-with-mispanalyzing-tls-certificate-transparency-logsanalyzing-typosquatting-domains-with-dnstwistanalyzing-uefi-bootkit-persistenceanalyzing-usb-device-connection-historyanalyzing-web-server-logs-for-intrusionanalyzing-windows-amcache-artifactsanalyzing-windows-event-logs-in-splunkanalyzing-windows-lnk-files-for-artifactsanalyzing-windows-prefetch-with-pythonanalyzing-windows-registry-for-artifactsanalyzing-windows-shellbag-artifactsauditing-aws-s3-bucket-permissionsauditing-azure-active-directory-configurationauditing-cloud-with-cis-benchmarksauditing-gcp-iam-permissionsauditing-kubernetes-cluster-rbacauditing-terraform-infrastructure-for-securityauditing-tls-certificate-transparency-logsauthorization-gateautomating-ioc-enrichmentbb-methodologyblockchain-securitybounty-apibounty-mobilebounty-reconbounty-webbug-bountybuilding-adversary-infrastructure-tracking-systembuilding-attack-pattern-library-from-cti-reportsbuilding-automated-malware-submission-pipelinebuilding-c2-infrastructure-with-sliver-frameworkbuilding-cloud-siem-with-sentinelbuilding-detection-rule-with-splunk-splbuilding-detection-rules-with-sigmabuilding-devsecops-pipeline-with-gitlab-cibuilding-identity-federation-with-saml-azure-adbuilding-identity-governance-lifecycle-processbuilding-incident-response-dashboardbuilding-incident-response-playbookbuilding-incident-timeline-with-timesketchbuilding-ioc-defanging-and-sharing-pipelinebuilding-ioc-enrichment-pipeline-with-openctibuilding-malware-incident-communication-templatebuilding-patch-tuesday-response-processbuilding-phishing-reporting-button-workflowbuilding-ransomware-playbook-with-cisa-frameworkbuilding-red-team-c2-infrastructure-with-havocbuilding-role-mining-for-rbac-optimizationbuilding-soc-escalation-matrixbuilding-soc-metrics-and-kpi-trackingbuilding-soc-playbook-for-ransomwarebuilding-threat-actor-profile-from-osintbuilding-threat-feed-aggregation-with-mispbuilding-threat-hunt-hypothesis-frameworkbuilding-threat-intelligence-enrichment-in-splunkbuilding-threat-intelligence-feed-integrationbuilding-threat-intelligence-platformbuilding-vulnerability-aging-and-sla-trackingbuilding-vulnerability-dashboard-with-defectdojobuilding-vulnerability-exception-tracking-systembuilding-vulnerability-scanning-workflowbypassing-authentication-with-forced-browsingcodeqlcollecting-indicators-of-compromisecollecting-open-source-intelligencecollecting-threat-intelligence-with-mispcollecting-volatile-evidence-from-compromised-hostconducting-api-security-testingconducting-cloud-incident-responseconducting-cloud-penetration-testingconducting-domain-persistence-with-dcsyncconducting-external-reconnaissance-with-osintconducting-full-scope-red-team-engagementconducting-internal-network-penetration-testconducting-internal-reconnaissance-with-bloodhound-ceconducting-malware-incident-responseconducting-man-in-the-middle-attack-simulationconducting-memory-forensics-with-volatilityconducting-mobile-app-penetration-testconducting-network-penetration-testconducting-pass-the-ticket-attackconducting-phishing-incident-responseconducting-post-incident-lessons-learnedconducting-social-engineering-penetration-testconducting-social-engineering-pretext-callconducting-spearphishing-simulation-campaignconducting-wireless-network-penetration-testconfiguring-active-directory-tiered-modelconfiguring-aws-verified-access-for-ztnaconfiguring-certificate-authority-with-opensslconfiguring-host-based-intrusion-detectionconfiguring-hsm-for-key-storageconfiguring-identity-aware-proxy-with-google-iapconfiguring-ldap-security-hardeningconfiguring-microsegmentation-for-zero-trustconfiguring-multi-factor-authentication-with-duoconfiguring-network-segmentation-with-vlansconfiguring-oauth2-authorization-flowconfiguring-pfsense-firewall-rulesconfiguring-snort-ids-for-intrusion-detectionconfiguring-suricata-for-network-monitoringconfiguring-tls-1-3-for-secure-communicationsconfiguring-windows-defender-advanced-settingsconfiguring-windows-event-logging-for-detectionconfiguring-zscaler-private-access-for-ztnaconstant-time-analysiscontaining-active-breachcorrelating-security-events-in-qradarcorrelating-threat-campaignscredential-attackctf-cryptoctf-forensicsctf-pwnctf-revctf-stegoctf-webcve-poc-generatordeobfuscating-javascript-malwaredeobfuscating-powershell-obfuscated-malwaredeploying-active-directory-honeytokensdeploying-cloudflare-access-for-zero-trustdeploying-decoy-files-for-ransomware-detectiondeploying-edr-agent-with-crowdstrikedeploying-osquery-for-endpoint-monitoringdeploying-palo-alto-prisma-access-zero-trustdeploying-ransomware-canary-filesdeploying-software-defined-perimeterdeploying-tailscale-for-zero-trust-vpndetecting-ai-model-prompt-injection-attacksdetecting-anomalies-in-industrial-control-systems
El marketplace indica 873 piezas; guardamos los primeros 200 nombres.
Quién responde por él
26zl
- Ningún marketplace que leemos lo marca a él o a su editor como verificado.
- Licencia: MIT AND Apache-2.0 AND CC-BY-SA-4.0.
- Último cambio que vimos: 2026-10-12.
- El repositorio github.com/26zl/cybersec-toolkit pertenece a la cuenta con la que figura el editor en Official MCP Registry.
Cómo ha cambiado
Sus herramientas, ajustes, hooks y composición no han cambiado desde que lo seguimos.
En contexto
- Mediana de secretos que pide un servidor MCP en los marketplaces que leemos: 0,0. Este pide: 0.
- Proporción de servidores MCP que se ejecutan en un servidor remoto: 63%.
Dónde está publicado y cómo han cambiado sus cifras
Compararlo lado a lado con plugins similares
Datos de Official MCP Registry. Datos de Community GitHub marketplaces. Las cifras proceden de nuestros propios recorridos periódicos por los marketplaces, leída por última vez el . No publicamos datos de contacto de los editores de plugins.