| name | defense-security |
| description | Linux defensive security with 31 modules and 250+ actions. Firewall management, system hardening, compliance auditing (CIS/HIPAA/SOC2), malware scanning, incident response, container security, network defense, zero trust architecture, and forensics. Dry-run by default with confirmation gates. Use when hardening Linux systems, auditing compliance (CIS/HIPAA/SOC2), scanning for malware, or doing incident response.
|
| version | 1.0.0 |
| author | agentbox-claude |
| mcp_server | true |
| protocol | stdio |
| entry_point | npx defense-mcp-server |
| dependencies | ["node >= 22"] |
| env_vars | ["DEFENSE_MCP_DRY_RUN","DEFENSE_MCP_REQUIRE_CONFIRMATION","DEFENSE_MCP_ALLOWED_DIRS","DEFENSE_MCP_AUTO_INSTALL","DEFENSE_MCP_LOG_LEVEL","DEFENSE_MCP_SESSION_TIMEOUT"] |
Defense Security MCP Skill
Comprehensive Linux defensive security toolkit exposing 31 modules and 250+ actions through MCP. All destructive operations default to dry-run mode with mandatory confirmation gates. Sudo authentication uses GUI dialog (zenity/kdialog), never passing credentials through AI context.
When to Use This Skill
- Firewall Management: Configure iptables/nftables rules, port management, traffic filtering
- System Hardening: Apply CIS benchmarks, disable unnecessary services, configure secure defaults
- Compliance Auditing: Run CIS, HIPAA, SOC2, PCI-DSS compliance checks with remediation guidance
- Malware Scanning: Scan filesystems with ClamAV, YARA rules, rootkit detection
- Incident Response: Collect forensic artifacts, analyze logs, quarantine threats, generate timelines
- Container Security: Audit Docker/Podman configs, scan images, check runtime isolation
- Network Defense: Monitor connections, detect anomalies, configure IDS/IPS rules
- Zero Trust: Implement least-privilege policies, verify network segmentation, audit access controls
- Forensics: Disk imaging, memory analysis, file integrity verification, chain of custody
When Not To Use
- For Windows or macOS systems -- this skill is Linux only
- For offensive security, penetration testing, or exploit development -- defensive only
- For cloud-native security without a local Linux host -- use cloud provider security tools (AWS GuardDuty, GCP SCC)
- For application-layer security scanning (SAST/DAST) -- use dedicated tools like Semgrep or OWASP ZAP
- For network packet capture analysis -- use Wireshark or tcpdump directly
Architecture
┌─────────────────────────────────┐
│ Claude Code / Skill Invocation │
└──────────────┬──────────────────┘
│ MCP Protocol (stdio)
▼
┌─────────────────────────────────┐
│ Defense MCP Server (Node.js) │
│ 31 modules, 250+ actions │
│ Dry-run + confirmation gates │
└──────────────┬──────────────────┘
│ Subprocess / API
▼
┌─────────────────────────────────┐
│ Linux Security Subsystems │
│ iptables, auditd, ClamAV, │
│ systemd, AppArmor/SELinux, │
│ Docker, journalctl, etc. │
└─────────────────────────────────┘
│
▼
┌─────────────────────────────────┐
│ Sudo Authentication │
│ (zenity/kdialog GUI dialog) │
│ Never through AI context │
└─────────────────────────────────┘
Modules Overview
