sec-ops-mcp

SecOps MCP Server (sec-ops-mcp)

SecOps MCP is an enterprise-grade Model Context Protocol server that arms LLMs and AI agents with direct diagnostic capabilities for defensive security posture assessments, privilege escalation surface auditing, and Post-Quantum Cryptography (PQC) readiness checks.

---

🛠️ Integrated Tooling Modules

Module	Scope	Key Diagnostic Capabilities
QuantumGuard	PQC & Modern Cryptography	Scans x509 cert chains for classical vs. PQC algorithms (FIPS 203/204), evaluates Shor's vulnerability risks on RSA/ECC, and probes TLS endpoints for hybrid key exchange support.
PrivScope	Linux Privilege Surface	Identifies dangerous SUID/SGID binaries (GTFOBins mapped), unauthorized cap_setuid/cap_dac_override capabilities, and writable scheduled task matrices.
WinScope	Windows Privilege Surface	Audits AlwaysInstallElevated registry bypasses, unquoted service paths running under SYSTEM, and misconfigured service binary DACLs.

---

🚀 Quickstart

Prerequisites

• Python 3.10+
• pip / venv

Installation

git clone [https://github.com/JoaquinHernandez/sec-ops-mcp.git](https://github.com/JoaquinHernandez/sec-ops-mcp.git)
cd sec-ops-mcp
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
pip install -r requirements.txt

---

⚙️ Client Integration

Add this MCP server definition to your client configuration:

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "secops-scanner": {
      "command": "/absolute/path/to/sec-ops-mcp/.venv/bin/python",
      "args": ["/absolute/path/to/sec-ops-mcp/server.py"]
    }
  }
}

Cursor / Local MCP Agents

{
  "mcpServers": {
    "secops-scanner": {
      "command": "python",
      "args": ["./server.py"],
      "cwd": "/absolute/path/to/sec-ops-mcp"
    }
  }
}

---

📋 Available MCP Tools

• scan_pqc_readiness(target_dir): Evaluates local certificate stores against NIST PQC migration guidelines.
• scan_tls_quantum_posture(hostname, port): Connects to TLS services to check for post-quantum hybrid key exchange suites.
• audit_linux_posture(deep_scan): Scans Linux hosts for SUID escalation vectors and capability leaks.
• audit_windows_posture(): Scans Windows registry and service tables for privilege escalation flaws.

---

🔒 Security & Defense-in-Depth Notes

This MCP server is built specifically for read-only posture assessment and hardening verification. It performs passive analysis and structured reporting, enabling autonomous defensive assistants to guide engineers through remediation workflows without generating offensive payloads.