Cybrium MCP Server

MCP (Model Context Protocol) server that gives AI coding assistants real-time security scanning superpowers.

Works with Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible AI tool.

What You Get

Tool	Binary	What it does
scan	cyscan	SAST + secrets + IaC scan — 1,815 rules, 75+ languages, 296 secret patterns
supply_chain_scan	cyscan	Dependency CVE + typosquat + license compliance
repo_health	cyscan	14 security hygiene checks (score 0-100)
detect_frameworks	cyscan	Identify 35 frameworks across 9 languages
fix	cyscan	Apply automatic security fixes (with dry-run)
web_scan	cyweb	Web vulnerability scanner (headers, CVE paths, configs)
network_discover	cyprobe	Network device discovery (ARP, OUI, services)

Prerequisites

Install the Cybrium CLI tools:

brew tap cybrium-ai/cli
brew install cyscan cyweb cyprobe

Verify installation:

cyscan --version    # should show 0.8.1+
cyweb --version     # should show 0.3.0+

---

Setup: Claude Code (CLI)

Option 1: One-line command (recommended)

claude mcp add cybrium -- npx -y @cybrium-ai/mcp-server

Option 2: Manual settings.json

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

Option 3: Global install

npm install -g @cybrium-ai/mcp-server

Then add to ~/.claude/settings.json:

{
  "mcpServers": {
    "cybrium": {
      "command": "cybrium-mcp"
    }
  }
}

Verify

Restart Claude Code and run:

/mcp

You should see cybrium listed with 7 tools.

---

Setup: Claude Desktop (macOS)

1. Open Claude Desktop
2. Go to Settings (gear icon) > Developer > Edit Config
3. Add the following to claude_desktop_config.json:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

4. Restart Claude Desktop
5. You should see the hammer icon in the chat input — click it to see Cybrium tools

The config file is located at:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

---

Setup: Cursor

1. Open Cursor Settings (Cmd+,)
2. Search for "MCP" in settings
3. Click Add MCP Server
4. Enter:
   • Name: cybrium
   • Command: npx
   • Args: -y @cybrium-ai/mcp-server
5. Restart Cursor

---

Setup: Windsurf

Add to your Windsurf MCP configuration:

{
  "mcpServers": {
    "cybrium": {
      "command": "npx",
      "args": ["-y", "@cybrium-ai/mcp-server"]
    }
  }
}

---

Usage Examples

Once configured, just ask your AI assistant naturally:

Security Scanning

• "Scan this project for security vulnerabilities"
• "Are there any hardcoded secrets in this codebase?"
• "Check this file for SQL injection issues"

Supply Chain

• "Check for vulnerable dependencies"
• "Are any of our npm packages typosquatted?"
• "Do we have any AGPL-licensed dependencies?"

Repository Health

• "How healthy is this repo's security posture?"
• "What's our security score?"

Frameworks

• "What frameworks does this codebase use?"
• "Detect all the technologies in this project"

Web Scanning

• "Scan https://staging.example.com for vulnerabilities"
• "Check our API endpoint for security headers"

Autofix

• "Fix the security issues you found"
• "Apply security fixes in dry-run mode first"

Network Discovery

• "Discover devices on my local network"
• "What services are running on the network?"

---

Troubleshooting

"cybrium-mcp: command not found"

Install globally: npm install -g @cybrium-ai/mcp-server

"cyscan: command not found"

Install via Homebrew:

brew tap cybrium-ai/cli && brew install cyscan

Tools not showing up

1. Check /mcp in Claude Code shows cybrium
2. Verify npx @cybrium-ai/mcp-server runs without errors
3. Restart your AI tool after adding the config

Permission issues on macOS

chmod +x $(which cyscan)
chmod +x $(which cyweb)

---

How It Works

Your AI Assistant (Claude/Cursor/Windsurf)
    |
    | MCP Protocol (stdio)
    v
Cybrium MCP Server (Node.js)
    |
    |--- cyscan scan .            → SAST + secrets + IaC findings
    |--- cyscan supply .          → dependency CVEs + licenses
    |--- cyscan health .          → repo health score
    |--- cyscan frameworks .      → framework detection
    |--- cyscan fix .             → autofix patches
    |--- cyweb scan <url>         → web vulnerability scan
    |--- cyprobe discover         → network device discovery
    v
JSON results returned to AI for analysis + remediation

The MCP server spawns CLI processes and parses their JSON output. No API keys, no cloud calls, no data leaves your machine.

License

Apache 2.0