O que pode fazer: io.github.26zl/cybersec-toolkit
Servidor MCP · 26zl
O que io.github.26zl/cybersec-toolkit declara, pede e executa, segundo os marketplaces que lemos. Roda na sua máquina, em um contêiner iniciado a partir desta imagem: ghcr.io/26zl/cybersec-toolkit:1.3.0. Variáveis de ambiente que pede: 2, das quais segredos: 0. Conforme nossa passagem pelos marketplaces em 2026-10-12.
Isto não é uma auditoria de segurança. Mostramos o que os marketplaces publicam sobre este plugin: o que ele declara, o que pede e o que executa. Não executamos nem inspecionamos seu código, e a marca de verificado é uma afirmação do marketplace, não nossa.
Onde roda
- Roda na sua máquina, em um contêiner iniciado a partir desta imagem:
ghcr.io/26zl/cybersec-toolkit:1.3.0 - Instala-se na ferramenta de IA como pacote de plugins; o que ele inicia está listado abaixo.
O que declara
Nenhum dos marketplaces que lemos publica uma lista de ferramentas para ele.
Prompts e recursos: os marketplaces que lemos não os publicam.
O que pede
Variáveis de ambiente que pede: 2, das quais segredos: 0. Conforme declarado em: Official MCP Registry.
CYBERSEC_MCP_ALLOW_EXTERNALCYBERSEC_MCP_ALLOW_SCRIPTS
Variáveis de ambiente que pede: 2, das quais segredos: 0. Conforme declarado em: Community GitHub marketplaces.
CYBERSEC_MCP_ALLOW_EXTERNALobrigatóriaCYBERSEC_MCP_ALLOW_SCRIPTSobrigatória
Apenas nomes: não guardamos valores, exemplos ou descrições dessas variáveis. Os marketplaces que lemos não publicam escopos OAuth nem configurações de instalação.
O que executa além do MCP
Skills: 199 Conforme declarado em: Community GitHub marketplaces.
acquiring-disk-image-with-dd-and-dcflddadd-toolai-llm-security-reviewai-threat-testinganalyzing-active-directory-acl-abuseanalyzing-android-malware-with-apktoolanalyzing-api-gateway-access-logsanalyzing-apt-group-with-mitre-navigatoranalyzing-azure-activity-logs-for-threatsanalyzing-bootkit-and-rootkit-samplesanalyzing-browser-forensics-with-hindsightanalyzing-campaign-attribution-evidence
Mostrar mais 187
analyzing-certificate-transparency-for-phishinganalyzing-cloud-storage-access-patternsanalyzing-cobalt-strike-beacon-configurationanalyzing-cobaltstrike-malleable-c2-profilesanalyzing-command-and-control-communicationanalyzing-cyber-kill-chainanalyzing-disk-image-with-autopsyanalyzing-dns-logs-for-exfiltrationanalyzing-docker-container-forensicsanalyzing-email-headers-for-phishing-investigationanalyzing-ethereum-smart-contract-vulnerabilitiesanalyzing-golang-malware-with-ghidraanalyzing-heap-spray-exploitationanalyzing-indicators-of-compromiseanalyzing-ios-app-security-with-objectionanalyzing-kubernetes-audit-logsanalyzing-linux-audit-logs-for-intrusionanalyzing-linux-elf-malwareanalyzing-linux-kernel-rootkitsanalyzing-linux-system-artifactsanalyzing-lnk-file-and-jump-list-artifactsanalyzing-macro-malware-in-office-documentsanalyzing-malicious-pdf-with-peepdfanalyzing-malicious-url-with-urlscananalyzing-malware-behavior-with-cuckoo-sandboxanalyzing-malware-family-relationships-with-malpediaanalyzing-malware-persistence-with-autorunsanalyzing-malware-sandbox-evasion-techniquesanalyzing-memory-dumps-with-volatilityanalyzing-memory-forensics-with-lime-and-volatilityanalyzing-mft-for-deleted-file-recoveryanalyzing-network-covert-channels-in-malwareanalyzing-network-flow-data-with-netflowanalyzing-network-packets-with-scapyanalyzing-network-traffic-for-incidentsanalyzing-network-traffic-of-malwareanalyzing-network-traffic-with-wiresharkanalyzing-office365-audit-logs-for-compromiseanalyzing-outlook-pst-for-email-forensicsanalyzing-packed-malware-with-upx-unpackeranalyzing-pdf-malware-with-pdfidanalyzing-persistence-mechanisms-in-linuxanalyzing-powershell-empire-artifactsanalyzing-powershell-script-block-logginganalyzing-prefetch-files-for-execution-historyanalyzing-ransomware-encryption-mechanismsanalyzing-ransomware-leak-site-intelligenceanalyzing-ransomware-network-indicatorsanalyzing-ransomware-payment-walletsanalyzing-sbom-for-supply-chain-vulnerabilitiesanalyzing-security-logs-with-splunkanalyzing-slack-space-and-file-system-artifactsanalyzing-supply-chain-malware-artifactsanalyzing-threat-actor-ttps-with-mitre-attackanalyzing-threat-actor-ttps-with-mitre-navigatoranalyzing-threat-intelligence-feedsanalyzing-threat-landscape-with-mispanalyzing-tls-certificate-transparency-logsanalyzing-typosquatting-domains-with-dnstwistanalyzing-uefi-bootkit-persistenceanalyzing-usb-device-connection-historyanalyzing-web-server-logs-for-intrusionanalyzing-windows-amcache-artifactsanalyzing-windows-event-logs-in-splunkanalyzing-windows-lnk-files-for-artifactsanalyzing-windows-prefetch-with-pythonanalyzing-windows-registry-for-artifactsanalyzing-windows-shellbag-artifactsauditing-aws-s3-bucket-permissionsauditing-azure-active-directory-configurationauditing-cloud-with-cis-benchmarksauditing-gcp-iam-permissionsauditing-kubernetes-cluster-rbacauditing-terraform-infrastructure-for-securityauditing-tls-certificate-transparency-logsauthorization-gateautomating-ioc-enrichmentbb-methodologyblockchain-securitybounty-apibounty-mobilebounty-reconbounty-webbug-bountybuilding-adversary-infrastructure-tracking-systembuilding-attack-pattern-library-from-cti-reportsbuilding-automated-malware-submission-pipelinebuilding-c2-infrastructure-with-sliver-frameworkbuilding-cloud-siem-with-sentinelbuilding-detection-rule-with-splunk-splbuilding-detection-rules-with-sigmabuilding-devsecops-pipeline-with-gitlab-cibuilding-identity-federation-with-saml-azure-adbuilding-identity-governance-lifecycle-processbuilding-incident-response-dashboardbuilding-incident-response-playbookbuilding-incident-timeline-with-timesketchbuilding-ioc-defanging-and-sharing-pipelinebuilding-ioc-enrichment-pipeline-with-openctibuilding-malware-incident-communication-templatebuilding-patch-tuesday-response-processbuilding-phishing-reporting-button-workflowbuilding-ransomware-playbook-with-cisa-frameworkbuilding-red-team-c2-infrastructure-with-havocbuilding-role-mining-for-rbac-optimizationbuilding-soc-escalation-matrixbuilding-soc-metrics-and-kpi-trackingbuilding-soc-playbook-for-ransomwarebuilding-threat-actor-profile-from-osintbuilding-threat-feed-aggregation-with-mispbuilding-threat-hunt-hypothesis-frameworkbuilding-threat-intelligence-enrichment-in-splunkbuilding-threat-intelligence-feed-integrationbuilding-threat-intelligence-platformbuilding-vulnerability-aging-and-sla-trackingbuilding-vulnerability-dashboard-with-defectdojobuilding-vulnerability-exception-tracking-systembuilding-vulnerability-scanning-workflowbypassing-authentication-with-forced-browsingcodeqlcollecting-indicators-of-compromisecollecting-open-source-intelligencecollecting-threat-intelligence-with-mispcollecting-volatile-evidence-from-compromised-hostconducting-api-security-testingconducting-cloud-incident-responseconducting-cloud-penetration-testingconducting-domain-persistence-with-dcsyncconducting-external-reconnaissance-with-osintconducting-full-scope-red-team-engagementconducting-internal-network-penetration-testconducting-internal-reconnaissance-with-bloodhound-ceconducting-malware-incident-responseconducting-man-in-the-middle-attack-simulationconducting-memory-forensics-with-volatilityconducting-mobile-app-penetration-testconducting-network-penetration-testconducting-pass-the-ticket-attackconducting-phishing-incident-responseconducting-post-incident-lessons-learnedconducting-social-engineering-penetration-testconducting-social-engineering-pretext-callconducting-spearphishing-simulation-campaignconducting-wireless-network-penetration-testconfiguring-active-directory-tiered-modelconfiguring-aws-verified-access-for-ztnaconfiguring-certificate-authority-with-opensslconfiguring-host-based-intrusion-detectionconfiguring-hsm-for-key-storageconfiguring-identity-aware-proxy-with-google-iapconfiguring-ldap-security-hardeningconfiguring-microsegmentation-for-zero-trustconfiguring-multi-factor-authentication-with-duoconfiguring-network-segmentation-with-vlansconfiguring-oauth2-authorization-flowconfiguring-pfsense-firewall-rulesconfiguring-snort-ids-for-intrusion-detectionconfiguring-suricata-for-network-monitoringconfiguring-tls-1-3-for-secure-communicationsconfiguring-windows-defender-advanced-settingsconfiguring-windows-event-logging-for-detectionconfiguring-zscaler-private-access-for-ztnaconstant-time-analysiscontaining-active-breachcorrelating-security-events-in-qradarcorrelating-threat-campaignscredential-attackctf-cryptoctf-forensicsctf-pwnctf-revctf-stegoctf-webcve-poc-generatordeobfuscating-javascript-malwaredeobfuscating-powershell-obfuscated-malwaredeploying-active-directory-honeytokensdeploying-cloudflare-access-for-zero-trustdeploying-decoy-files-for-ransomware-detectiondeploying-edr-agent-with-crowdstrikedeploying-osquery-for-endpoint-monitoringdeploying-palo-alto-prisma-access-zero-trustdeploying-ransomware-canary-filesdeploying-software-defined-perimeterdeploying-tailscale-for-zero-trust-vpndetecting-ai-model-prompt-injection-attacksdetecting-anomalies-in-industrial-control-systems
O marketplace lista 873 partes; guardamos os primeiros 200 nomes.
Quem responde por ele
26zl
- Nenhum marketplace que lemos marca o plugin ou o editor como verificado.
- Licença: MIT AND Apache-2.0 AND CC-BY-SA-4.0.
- Última mudança que vimos: 2026-10-12.
- O repositório github.com/26zl/cybersec-toolkit pertence à conta com a qual o editor está listado em Official MCP Registry.
Como mudou
Ferramentas, configurações, hooks e composição não mudaram desde que começamos a acompanhá-lo.
Em contexto
- Mediana de segredos que um servidor MCP pede nos marketplaces que lemos: 0,0. Este pede: 0.
- Parcela de servidores MCP que rodam em um servidor remoto: 63%.
Onde está publicado e como os números mudaram
Comparar lado a lado com plugins parecidos
Dados de Official MCP Registry. Dados de Community GitHub marketplaces. Os números vêm das nossas próprias passagens regulares pelos marketplaces, última leitura em . Não publicamos dados de contato dos editores de plugins.