cybersec-toolkit is a security toolkit that can be driven by AI agents and operates under rules set by the user. Its core goal is to install 670+ security tools on Linux or Termux with a single command, and through an authorization-gated MCP (Model Context Protocol) server, enable MCP clients such as Claude Code, Codex, Gemini CLI, and OpenCode to discover, recommend, and execute these tools.
In terms of main capabilities, the toolkit covers standard tools across 18 modules and provides 872 Agent Skills for methodology support in CTF, penetration testing, bug bounty, DFIR, and blue team work. The MCP server runs by default in a disposable Kata Containers virtual machine with an independent kernel, does not access the host filesystem except for optional workspace mounts, has no Docker socket, runs as a non-root user with all capabilities dropped, has memory, CPU, and process limits, and the virtual machine is destroyed after the client disconnects. On startup failure, it defaults to shutting down rather than falling back to the host; host execution can be explicitly selected with --local.
In terms of usage, first run the installation script on a supported Linux distribution or Termux, then connect the AI client. Tracked configurations (such as Claude Code's .mcp.json, etc.) start the server through scripts/mcp-launch.sh, with external targets and script execution disabled by default. Kata requires KVM; on macOS, Windows, or virtual machines without nested virtualization, host mode should be used. After restarting the client, 15 tools will appear, after which specific tasks can be requested, such as "triage this binary" or "map the attack surface of my lab at 10.10.0.0/24".
The installer supports multiple distributions and automatically installs runtime and build tools. Docker is used for some configurations (such as C2 frameworks, MobSF, BeEF, BloodHound, etc.) as well as profiles such as blueteam, redteam, blockchain, and mobile. Configuring GitHub authentication is recommended to avoid API rate limiting. The installer runs as root, butdrops privileges to the invoking user for some build steps. Dual-use tools (such as C2 and phishing frameworks) are disabled by default and require --include-c2 to enable.
In terms of security and limitations, the default secure configuration rejects network targets that resolve to non-private or non-loopback addresses and disables run_script. Unified execution gating includes registry allowlisting, no shell use, argument sanitization, per-tool blocked flags, target and network policies, rate limiting, output caps, and timeouts. Tool output is sent to the model provider; by default only local audit logs are redacted, and environment variables can be set to redact credential-shaped strings. Audit logs are JSON lines readable only by the owner, with a hash chain, and can be verified with make audit-verify. The virtual machine is not a network boundary; allowed tools run with the permissions of the server user. The installer modifies the system (such as adding the Metasploit repository, NodeSource repository, etc.), and remove.sh cannot fully undo this. Authorized use only; relevant security policies must be followed.
