PrismSec 🔷

Secure, modular MCP server for pentesting tools.

Wraps 7 industry-standard security tools (nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap) into 13 registered MCP tools — ready to use with Claude, Cursor, Copilot, and any MCP-compatible AI agent.

---

Features

Feature	Description
Zero shell=True	All subprocess calls use asyncio.create_subprocess_exec — no shell injection
Input validation	Target, URL, port, severity — all validated before execution
Injection detection	Blocks shell metacharacters (;, $(), backticks, |)
Timeout enforcement	Every tool has configurable timeout — auto-kills hung processes
Structured output	Parsed XML/JSON/text → clean JSON for AI agents
Modular architecture	One file per tool — easy to add, maintain, and test
MCP SDK v2	Built on the latest Model Context Protocol SDK

---

Installation

From source

git clone https://github.com/azmisyahrul/prismsec.git
cd prismsec
pip install -e .

Prerequisites

Install the security tools you need:

# Ubuntu/Debian
apt install nmap nikto sqlmap

# Go-based tools
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/OJ/gobuster/v3@latest

---

Tools (13 registered)

Nmap — Port Scanning

MCP Tool	Description
nmap_port_scan	Port scan with quick/full/service/stealth/aggressive modes
nmap_service_detect	Service/version detection on open ports
nmap_full_scan	Scan all 65535 TCP ports

Nuclei — Vulnerability Scanning

MCP Tool	Description
nuclei_vuln_scan	Full vulnerability scan with all templates
nuclei_severity_scan	Scan filtered by severity (critical, high, etc.)
nuclei_template_scan	Targeted scan with specific template

Gobuster — Directory/DNS Brute

MCP Tool	Description
gobuster_directory	Directory brute-force with configurable extensions
gobuster_dns	DNS subdomain brute-force

Other Tools

MCP Tool	Description
subfinder_enumerate	Passive subdomain enumeration (crt.sh, VirusTotal, etc.)
httpx_probe	Web probing — alive detection, titles, tech fingerprinting
nikto_web_scan	Web server vulnerability scanning
sqlmap_injection_test	SQL injection detection and testing

Meta

MCP Tool	Description
check_tools	Check which security tools are installed

---

Usage

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "prismsec": {
      "command": "python3",
      "args": ["/path/to/prismsec/server.py"],
      "env": {}
    }
  }
}

Claude Code

claude mcp add prismsec python3 /path/to/prismsec/server.py

Cursor / Windsurf / Cline

Add to .cursor/mcp.json or equivalent:

{
  "mcpServers": {
    "prismsec": {
      "command": "python3",
      "args": ["/path/to/prismsec/server.py"]
    }
  }
}

SSE Transport (Remote)

# Server side
python3 server.py --transport sse --host 0.0.0.0 --port 8000

# Client config
{
  "mcpServers": {
    "prismsec": {
      "url": "http://localhost:8000/sse"
    }
  }
}

---

Project Structure

prismsec/
├── server.py              # MCP server entry point (13 tools)
├── pyproject.toml         # Project config + dependencies
├── tools/                 # Tool wrappers (one file per tool)
│   ├── base.py           # ToolWrapper ABC + async runner
│   ├── nmap.py           # Nmap — XML parsing, scan modes
│   ├── nuclei.py         # Nuclei — JSON output parsing
│   ├── gobuster.py       # Gobuster — text output parsing
│   ├── subfinder.py      # Subfinder — subdomain enum
│   ├── httpx.py          # Httpx — web probing
│   ├── nikto.py          # Nikto — web vuln scan
│   └── sqlmap.py         # Sqlmap — SQL injection testing
├── parsers/               # Output parsers
│   ├── xml_parser.py     # nmap XML → structured JSON
│   ├── json_parser.py    # JSON/JSONL parsing
│   └── text_parser.py    # Gobuster, nikto, sqlmap text
└── utils/                 # Shared utilities
    ├── runner.py          # AsyncRunner with timeout
    ├── validator.py       # Input validation + injection detection
    ├── rate_limiter.py    # Token bucket rate limiter
    └── logging.py         # Structured logging

---

Configuration

Environment Variable	Default	Description
LOG_LEVEL	INFO	Logging level (DEBUG, INFO, WARNING, ERROR)

---

Security Considerations

⚠️ Authorized testing only. Use against systems you own or have written permission to test.

• Tool outputs may contain sensitive information (IPs, open ports, vulnerabilities)
• The server binds to 127.0.0.1 by default — never expose to untrusted networks
• Each tool has configurable timeouts to prevent resource exhaustion

---

License

MIT

---

Built with the Model Context Protocol standard for broad client compatibility.