CyberMCP - Cybersecurity API Testing with MCP

What is CyberMCP?

CyberMCP is a Model Context Protocol (MCP) server that enables AI agents to perform comprehensive security testing on backend APIs. It provides 14 specialized security tools and 10 resources for identifying vulnerabilities like authentication bypass, injection attacks, data leakage, and security misconfigurations.

How to use CyberMCP?

Clone the repository, run npm install, npm run build, then start the server with npm start (stdio mode) or set TRANSPORT=http PORT=3000 npm start for HTTP mode. Provide natural‑language commands such as basic_auth or auth_bypass_check to the AI agent, which will execute the corresponding security tests on target endpoints.

Key features of CyberMCP

• Authentication testing (JWT analysis, bypass detection, OAuth2 flows)
• Injection testing (SQL injection, XSS vulnerability detection)
• Data protection checks (sensitive data exposure, path traversal)
• Rate limiting and DoS vulnerability assessment
• OWASP security header validation
• Comprehensive security checklists and testing guides

Use cases of CyberMCP

• Test a protected API endpoint for authentication bypass vulnerabilities
• Scan an application for SQL injection and cross‑site scripting flaws
• Validate security headers and rate‑limiting configurations
• Audit sensitive data exposure and path traversal risks
• Automate security testing during CI/CD pipelines via AI agents

FAQ from CyberMCP

What are the runtime requirements for CyberMCP?

Node.js 18+ and TypeScript 5.4+ are required.

What transport modes does CyberMCP support?

It supports stdio (default) and HTTP (set TRANSPORT=http and optionally PORT).

Which IDEs and clients can integrate with CyberMCP?

It works with Claude Desktop, Cursor IDE, Windsurf (Codeium), and VS Code + Cline.

What types of security tools are included?

Fourteen tools covering authentication (basic_auth, token_auth, OAuth2, JWT, bypass check), injection (SQL, XSS), data protection (sensitive data, path traversal), and infrastructure (rate limiting, security headers).