Irtoolshed MCP Server

🚀 Security Response Toolkit MCP Server

The Security Response Toolkit MCP Server offers a comprehensive Model Context Protocol (MCP) server for security professionals, featuring event response and network analysis tools. It enables AI agents like Claude to perform various network queries and analyses to assist in security investigations.

🚀 Quick Start

The Security Response Toolkit MCP Server provides a series of network and security tools accessible via the Model Context Protocol. It is designed as a general-purpose service for cybersecurity incident responders, allowing them to perform basic lookup operations, including:

✓ ASN Lookup ✓ DNS Record Lookup (A, AAAA, MX, etc.) ✓ WHOIS Record Retrieval ✓ IP Geolocation Service

✨ Features

1. ASN Lookup

• Function: Query the Autonomous System Number (ASN) and related details for a given IP.
• Input: A valid IPv4 or IPv6 address.
• Output: A JSON response containing the ASN, organization name, registrar, and geographical location.

2. DNS Record Lookup

• Function: Look up DNS records (A, AAAA, MX, etc.) for a specified domain name.
• Input: A valid domain name.
• Output: Detailed information about all relevant DNS record types, such as A, AAAA, MX, etc.

3. WHOIS Record Retrieval

• Function: Retrieve the WHOIS registration information for a specified domain name.
• Input: A valid domain name.
• Output: A JSON response containing details such as the registrar, registrant, creation date, expiration date, etc.

4. IP Geolocation Service

• Function: Obtain geographical location information based on an IP address.
• Input: A valid IPv4 or IPv6 address.
• Output: A JSON response containing details such as the country, city, postal code, latitude, longitude, and time zone.

🔧 Technical Details

Error Handling

Each tool follows a consistent error handling pattern:

Generic Error Response Format:

{
    "status": "error",
    "error": "Detailed error message",
    "query": "Original query value"
}

Tool-Specific Error Examples:

• ASN Lookup:

{
    "ip_addr": "<Queried IP>",
    "status": "error",
    "error": "Invalid IP address format"
}

• DNS Lookup:

{
    "domain": "<Queried domain>",
    "record_type": "<Requested type>",
    "status": "error",
    "error": "DNS resolution failed"
}

• WHOIS Lookup:

{
    "domain": "<Queried domain>",
    "status": "error",
    "error": "WHOIS server unavailable"
}

• Geolocation:

{
    "ip_addr": "<Queried IP>",
    "status": "error",
    "error": "MaxMind database not found or license key invalid"
}

Project Structure

The project follows a standard Python package structure:

irtoolshed_mcp_server/     # Main package directory
├── __init__.py           # Package initialization
├── asnlookup.py         # ASN lookup functionality
├── dnslookup.py         # DNS lookup functionality
├── geolookup.py         # Geolocation functionality
├── mcp_server.py        # Main MCP server implementation
└── whoislookup.py       # WHOIS lookup functionality

tests/                    # Test directory
├── test_asnlookup.py    # ASN lookup tests
├── test_dnslookup.py    # DNS lookup tests
├── test_geolookup.py    # Geolocation tests
└── test_whoislookup.py  # WHOIS lookup tests

📦 Installation

Setting up the Development Environment

1. Clone this repository:

git clone <repository-url>
cd ir-toolshed-mcp-server

2. Create a virtual environment and install dependencies:

uv venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
uv pip install -e ".[dev]"

Running Tests

To run the test suite:

uv run pytest

This will:

• Run all tests in the tests/ directory.
• Display test coverage information.
• Show detailed output for any failures.

Note: Some tests require additional configuration:

• Geolocation tests require the MaxMind GeoLite2 database and a license key.
• WHOIS tests may fail if the WHOIS service is unavailable.

Code Quality

The project uses various tools to maintain code quality:

• Format code using Black:

uv run black .

• Sort imports using isort:

uv run isort .

• Run type checking using mypy:

uv run mypy .

• Run linting using ruff:

uv run ruff .

📚 Documentation

Future Plans

Completed: ✓ ASN Lookup ✓ DNS Record Lookup (A, AAAA, MX, etc.)