Secure Annex MCP

🚀 SecureAnnex MCP Server

A Model Controller Protocol (MCP) server for analyzing the security of browser extensions. This server is released under the MIT license and demonstrates how to run in the Claude Desktop environment by configuring the pyproject.toml file.

🚀 Quick Start

1. Download or Clone the Repository: Obtain the project from GitHub or other code hosting platforms.
2. Configure Claude Desktop:
   • Open the config.json file.
   • Add the following content to the "mcp.servers" section:

"SecureAnnex": {
  "command": "poetry run secure-annex-server",
  "env": {
    "SECURE_ANNEX_API_KEY": "your_api_key_here"
  }
}

3. Start the Service:
   • Open a terminal and navigate to the project root directory.
   • Run poetry install to install dependencies.
   • Start the server: poetry run secure-annex-server start.

📁 Project Structure

.
├── pyproject.toml         # Project dependencies and script configuration
├── src/
│   ├── __init__.py       # Empty file for package recognition
│   └── server.py         # Main server logic
└── README.md             # Project documentation

✨ Features

Core Features

1. Extension Information Query:

   • Retrieve detailed information about a specified extension_id.
   • The returned results include basic extension information, developer information, and version history.

2. Security Vulnerability Detection:

   • Scan a specified extension for known vulnerabilities.
   • The returned results include vulnerability IDs, severity levels, and remediation suggestions.

3. Behavior Analysis:

   • Analyze the behavior patterns of an extension.
   • Generate reports to assess its potential risks.

Advanced Features

1. Historical Data Analysis:

   • Query the historical usage records of an extension.
   • Provide user distribution and time trend charts.

2. Integrated API Calls:

   • Support interaction with other MCPs (e.g., VirusTotal).
   • Return combined analysis results for further processing.

💻 Usage Examples

Basic Query

{
  "name": "get_extension_info",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

Response:

{
  "id": "gighmmpiobklfepjocnamgkkbiglidom",
  "name": "uBlock Origin",
  "developer": "Maximer",
  "version": "1.20.7",
  "description": "A lightweight, open-source ad blocker.",
  "permissions": ["activeTab", "scripting"],
  "last_update": "2023-10-05"
}

Comprehensive Analysis

{
  "name": "analyze_extension",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

Response:

## Basic Information
- ID: gighmmpiobklfepjocnamgkkbiglidom
- Name: uBlock Origin
- Developer: Maximer
- Version: 1.20.7

## Security Vulnerabilities
- Detected 0 high-risk vulnerabilities.

## Behavior Analysis
- Requested permissions: activeTab, scripting
- Extension functions: Ad blocking, script injection
- Risk level: Low risk

## Recommendations
1. Regularly update the extension to get the latest security patches.
2. Monitor ad-blocking rules to ensure there are no false positives.

📚 Documentation

API List

1. get_extension_info:

   • Retrieve basic information about a specified extension.

2. check_vulnerabilities:

   • Check a specified extension for known vulnerabilities.

3. analyze_behavior:

   • Analyze the behavior patterns of an extension.

4. query_statistics:

   • Query historical usage statistics of an extension.

Request Format

{
  "name": "API Name",
  "arguments": {
    "Parameter Name": "Parameter Value"
  }
}

Response Format

{
  "status": "success",
  "data": {},
  "message": ""
}

⚙️ Configuration Guide

1. Get an API Key:

   • Visit the SecureAnnex Console.
   • After logging in, go to "Developer Settings" to obtain an API key.

2. Configure Environment Variables:

export SECURE_ANNEX_API_KEY="your_api_key_here"

3. Start the Server:
   • Use Poetry to manage dependencies.
   • Execute poetry run secure-annex-server start to start the service.

🎯 Project Goals

1. Provide standardized extension analysis interfaces.
2. Support integration with other security tools (e.g., VirusTotal).
3. Establish an open security research ecosystem.

🤝 Contribution Guide

1. Submit Issues:

   • Submit bugs or feature requests on GitHub Issues.

2. Participate in Development:

   • Fork the repository and create a feature branch.
   • Submit a Pull Request for code review and merging.

📄 License

This project is open-source under the MIT license. You are welcome to use and modify it freely.