Offensive Security Toolkit

🚀 Future Work with MCP and AI

This project explores the integration of MCP (Model Context Protocol) and AI to revolutionize cybersecurity operations. By leveraging advanced AI models like Claude, we aim to automate and enhance various security tasks, from red - team operations to threat hunting.

✨ Features

1. Autonomous Red - Team Agents Build LLM - driven agents that can autonomously conduct reconnaissance, payload generation, penetration, and reporting, all orchestrated through the MCP tool.

2. AI - Driven SOC Analysts Integrate Wazuh + Suricata + Zeek logs and use MCP to enable Claude to analyze events, detect lateral movement, and recommend real - time countermeasures.

3. Malicious Software Development Studio (LLM + MCP) Use Claude + MCP to automate the generation of shellcode, obfuscated code, sandbox evasion strategies, and EDR bypass methods, with the help of tools like Capstone, Donut, and Sliver.

4. Threat Hunting Automation Develop proactive AI workflows to analyze logs, correlate indicators, and conduct threat hunting based on threat intelligence feeds from MCP Resources and Tools.

5. MCP - Based Purple Team Simulator Combine MCP with ATT&CK simulation, where Claude controls the techniques of both red and blue teams (Atomic Red Team, Caldera, Sigma/YARA rule generation).

6. CI/CD + DevSecOps Integration Use MCP to review code pushed to GitHub, scan for secrets, trigger security tools (Trufflehog, Gitleaks), and send security alerts or PR suggestions.

7. Automatic Incident Report Generator Claude consumes logs and tool outputs through MCP to generate complete incident reports (including charts and mitigation measures) in Markdown or PDF format.

8. Cybersecurity Mentor / Training Mode Claude explains the functionality of each tool, simulates attacks, and evaluates user responses in a secure laboratory environment, enabled by MCP simulation tools.

📦 Installation

Install MCP CLI and SDK (Python)

pip install modelcontextprotocol

Documentation:
🔗 https://modelcontextprotocol.io/quickstart/server
GitHub:
🔗 https://github.com/jlowin/fastmcp

Configure Claude Desktop (Mac, Linux, Windows)

1. Install Claude for Desktop
   🔗 https://www.anthropic.com/index/claude - desktop

2. Edit the configuration file:

macOS/Linux

nano ~/Library/Application\ Support/Claude/claude_desktop_config.json

Windows

notepad %AppData%\Claude\claude_desktop_config.json

3. Add your MCP server:

{
  "mcpServers": {
    "my - wazuh - agent": {
      "command": "/full/path/to/python",
      "args": [
        "mcp_wazuh_server.py"
      ]
    }
  }
}

4. Restart Claude Desktop — you will see the Connector Icon (⚡) for prompts and the Tool Icon (🛠) for tool invocation.

Local Testing (Inspector)

Run your server and enable debugging:

npx @modelcontextprotocol/inspector python mcp_wazuh_server.py

This opens a local UI where you can test @mcp.tool() and @mcp.prompt() before connecting to Claude.