wgpsec/context1337

Perfil de wgpsec

Última actividad de origen registrada: 21 de abril de 2026 a las 13:43

Catálogo de SkillsMP actualizado: 26 de octubre de 2026 a las 11:37

skills recopiladas: 2

Estrellas en GitHub: 38
Forks en GitHub: 3

README del repositorio

Archivo de origen del README: README.md

Leer el README original

Mostrar README completo

[中文文档](README.zh-CN.md) | English ![context1337 — Pentest knowledge base for AI agents](docs/images/banner.jpg) # context1337 — AboutSecurity MCP Server Standalone MCP resource service that turns [AboutSecurity](https://github.com/wgpsec/AboutSecurity) from a file repo into a consumable API. Like context7, but for security. ## Demo **Search security resources** ![search](docs/images/demo-search-en.png) **Vulnerability intelligence** ![vuln](docs/images/demo-vuln-en.png) **AD domain attack skill detail** ![skill](docs/images/demo-skill-en.png) ## Quick Start ### Docker (recommended) ```bash # Default: clones AboutSecurity from GitHub automatically make docker # Use local AboutSecurity repo (skip git clone, faster rebuild) make docker-local # or specify path: make docker-local ABOUTSECURITY_LOCAL=../AboutSecurity # Pin to a specific branch/tag make docker-ref ABOUTSECURITY_REF=dev ``` ```bash docker run -p 1337:1337 -e ABOUTSECURITY_API_KEY=your-key context1337:latest # Optional: enable /admin and persist managed keys + custom resources docker run -p 1337:1337 \ -e ABOUTSECURITY_API_KEY=your-key \ -e ABOUTSECURITY_ADMIN_KEY=your-admin-key \ -v context1337-runtime:/app/data/runtime \ context1337:latest ``` ### Local Development (recommended for first-time users) Requires Go 1.25+ (gotip), a C compiler for CGo sqlite (`mattn/go-sqlite3`), and Python 3. `make build` / `make test` enable FTS5 and JSON. ```bash git clone https://github.com/wgpsec/context1337.git cd context1337 # One command does everything: # 1. Clones AboutSecurity repo (if not already present) # 2. Installs Python dependencies (jieba, pyyaml) # 3. Builds FTS5 search index (builtin.db) # 4. Compiles Go binary # 5. Symlinks data directories # 6. Starts the server make run # Build & run (requires data/ populated with builtin.db or AboutSecurity content) make build ./absec serve --port 1337 --data-dir ./data # default: --tool-mode lite ``` The server will be available at `http://localhost:1337`. --- ## MCP Client Configuration ### Claude Code (CLI) ```bash # Add as user-level MCP server (available in all projects) claude mcp add aboutsecurity --transport http --scope user http://localhost:1337/mcp # Or project-level only (run from within your project directory) claude mcp add aboutsecurity --transport http http://localhost:1337/mcp ``` If you set `ABOUTSECURITY_API_KEY` on the server, add the auth header: ```bash claude mcp add aboutsecurity --transport http --header "Authorization: Bearer your-api-key" --scope user http://localhost:1337/mcp ``` After adding, restart Claude Code and run `/mcp` to verify the connection shows `connected`. ### Claude Desktop Edit your Claude Desktop config file (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS): ```json { "mcpServers": { "aboutsecurity": { "url": "http://localhost:1337/mcp", "headers": { "Authorization": "Bearer your-api-key" } } } } ``` ### Cursor ```json { "mcpServers": { "aboutsecurity": { "serverUrl": "http://localhost:1337/mcp" } } } ``` ## Usage Examples Once connected, just ask your AI assistant naturally: **Search across all types** - "Search for SQL injection resources" → `search_security(query="SQL injection")` finds skills and payloads - "What XSS payloads are available?" → `search_security(query="XSS", type="payload")` - "Show me all exploit skills" → `search_security(type="skill", category="exploit")` **Get detailed knowledge** - "Explain the SQL injection skill in detail" → search first, then call `get_security_detail(id="absec://builtin/skill/sql-injection-methodology", depth="full")` - "How does nmap scanning work?" → `get_security_detail(id="absec://builtin/skill/nmap-scan")` returns methodology **Read data files** - "Show the top 100 passwords dictionary" → search first, then call `read_security_file(id="absec://builtin/dict/auth%2Fpassword%2Fpassword-top100.txt")` - "Get XSS event handler payloads" → `read_security_file(id="absec://builtin/payload/xss%2Fjs-event.txt")` **Search vulnerabilities** - "Find critical Apache vulnerabilities" → `search_security(query="Apache", type="vuln", severity="CRITICAL")` - "List all middleware vulnerabilities" → `search_security(type="vuln", category="middleware")` - "Get the Log4j RCE vulnerability details" → search first, then call `get_security_detail(id="absec://builtin/vuln/CVE-2021-44228", depth="full")` Search results include a stable `id` such as `absec://builtin/skill/sql-injection-methodology`. Prefer passing that `id` into detail or file tools because it preserves the exact source and resource. Legacy inputs such as `name`/`type` and `path`/`type` still work, but `id` avoids ambiguity when the same resource appears in multiple sources. Example: `absec://builtin/vuln/CVE-2021-44228` and `absec://nuclei/vuln/CVE-2021-44228` can both exist. `get_security_detail(name="CVE-2021-44228", type="vuln")` cannot choose a source, while the stable ID selects the exact resource. The AI will automatically call the right MCP tools to find relevant security knowledge. ### Finding real resource IDs The IDs in the examples above resolve against the bundled corpus as of this release. Resource names still come from the upstream corpus (AboutSecurity, nuclei-templates), so they can be renamed or removed between releases — don't hand-write an ID you have not seen in a search response. Every `search_security` result already carries the canonical ID: ```json { "status": "matched", "items": [ { "id": "absec://builtin/dict/auth%2Fpassword%2Fpassword-top100.txt", "type": "dict", "name": "auth/password/password-top100.txt" } ] } ``` The format is `absec://{source}/{type}/{name}`. `builtin` is the AboutSecurity corpus; `team`, `nuclei` and `custom` can appear as additional sources. `{name}` is URL-encoded, so `%2F` is a literal `/` inside the name — copy it encoded. In practice, search first and pass `items[i].id` to `get_security_detail` or `read_security_file`. If a hand-written ID returns `resource id "..." not found`, go back to the search results instead of guessing another spelling. Driving the REST API directly? `GET /api/resources?q=...&type=...` returns the internal numeric row `id` (used by the toggle and admin endpoints), not the stable ID. Build the stable ID from `source`, `type` and the URL-encoded `name`: ```bash curl -s 'http://localhost:1337/api/resources?q=top100&type=dict' \ | jq -r '.items[] | "absec://\(.source)/\(.type)/\(.name | @uri)"' ``` ## Available MCP Tools Default mode is **lite** (3 tools). Use `--tool-mode full` for 12 per-type tools. If the AI model fails to invoke tools proactively, switch to full mode — the 12 fine-grained, domain-specific tools improve trigger rates. ### Lite mode (default, 3 tools) | Tool | Description | |------|-------------| | `search_security` | Search or list every resource type (skill, dict, payload, vuln). Results include stable `id` fields. Pass type=skill, type=dict, type=payload or type=vuln to narrow: vulnerabilities dominate the corpus (665 of 1219 enabled rows here), so a cross-type search is vuln-weighted. Vuln supports severity and product filters. | | `get_security_detail` | Get full detail for a skill or vulnerability by stable `id` (preferred) or legacy `name` + `type` | | `read_security_file` | Read dictionary or payload file content by stable `id` (preferred) or legacy `path` + `type`, with line-level pagination | ### Full mode (12 tools) | Tool | Description | |------|-------------| | `search_skill` | Search penetration testing skills by keyword; results include stable `id` fields | | `search_dicts` | Search password dictionaries by keyword; results include stable `id` fields | | `search_payload` | Search attack payloads by keyword; results include stable `id` fields | | `search_vuln` | Search vulnerability database by keyword with severity and product filters; results include stable `id` fields | | `list_skills` | Browse all skills; results include stable `id` fields | | `list_dicts` | Browse all dictionaries; results include stable `id` fields | | `list_payloads` | Browse all payloads; results include stable `id` fields | | `list_vulns` | List vulnerabilities with pagination (default 50), category/severity/product filters; results include stable `id` fields | | `get_skill` | Get skill detail by stable `id` (preferred) or legacy name, with depth + references | | `get_dict` | Read dictionary file by stable `id` (preferred) or legacy path, with line pagination | | `get_payload` | Read payload file by stable `id` (preferred) or legacy path, with line pagination | | `get_vuln` | Get vulnerability detail by stable `id` (preferred) or legacy name, brief or full depth with PoC | ## Makefile Targets | Target | Description | |--------|-------------| | `make run` | Build + index + start server (first run auto-clones data) | | `make build` | Compile Go binary only | | `make index` | Build FTS5 search index only | | `make test` | Run unit tests | | `make test-integration` | Run integration tests | | `make docker` | Build Docker image (clones AboutSecurity from GitHub) | | `make docker-local` | Build Docker image using local AboutSecurity repo | | `make docker-ref` | Build Docker image pinned to a specific branch/tag | | `make clean` | Remove binary, databases, and symlinks | | `make clean-benchmark` | Remove benchmark logs | ## REST API | Endpoint | Description | |----------|-------------| | `GET /health` | Liveness probe. Unauthenticated; no source counts | | `GET /admin` | Admin console (independent `ABOUTSECURITY_ADMIN_KEY`; disabled when unset) | | `GET /api/health` | Authenticated health + enabled resource counts for granted sources | | `GET /api/stats` | Resource statistics (granted sources only). Default: enabled resources by type/source. `?group=category` buckets by type/category instead (empty category kept) and echoes `"group":"category"`; `?enabled=true\|false\|all` overrides the default enabled-only filter | | `GET /api/usage` | MCP usage and search-query aggregates (write keys only; disabled when auth is off) | | `GET /api/resources` | List resources with pagination and filters (granted sources; includes disabled) | | `POST /api/resources` | Create custom resource (write + `custom`; source forced to "custom") | | `PUT /api/resources/{id}` | Update custom resource (write + `custom`; 403 otherwise) | | `DELETE /api/resources/{id}` | Delete custom resource (write + `custom`; 403 otherwise) | | `PUT /api/resources/{id}/toggle` | Toggle enabled/disabled (write; granted sources only) | | `PUT /api/resources/batch-toggle` | Batch toggle by type/category/source filter (write; granted sources only) | ### Resource Management Resources have an `enabled` field (default: `1`). Disabled resources are excluded from MCP tool queries (search, list, get) but remain visible to `GET /api/resources`. List/search/get require `read`; create/update/delete/toggle require `write`. **Toggle single resource:** ```bash curl -X PUT http://localhost:1337/api/resources/42/toggle \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{"enabled": false}' ``` **Batch toggle (by category/source):** ```bash curl -X PUT http://localhost:1337/api/resources/batch-toggle \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{"enabled": false, "filter": {"type": "skill", "category": "web"}}' ``` **Create custom resource:** ```bash curl -X POST http://localhost:1337/api/resources \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{"type": "skill", "name": "my-technique", "category": "web", "description": "...", "body": "..."}' ``` Custom resources use `source=custom` (server-enforced) and can be edited or deleted. Built-in resources cannot be modified or deleted (403). ## Environment Variables | Variable | Default | Description | |----------|---------|-------------| | `ABOUTSECURITY_PORT` | `1337` | HTTP listen port | | `ABOUTSECURITY_DATA_DIR` | `./data` | Data directory root | | `ABOUTSECURITY_API_KEY` | (empty=no auth) | Bootstrap admin Bearer key: all sources (`builtin`/`nuclei`, `team`, `custom`) and write access. Empty disables auth and `GET /api/usage` | | `ABOUTSECURITY_API_KEYS_FILE` | `{dataDir}/runtime/api-keys.json` | Extra API keys with source/access RBAC. Missing file means no extra keys. Admin console creates and writes this file. Mount a persistent runtime volume; do not bake into the image or team zip | | `ABOUTSECURITY_ADMIN_KEY` | (unset) | Independent super-admin key for `/admin` only. Must not equal any MCP/REST key. Empty disables the console | | `ABOUTSECURITY_TOOL_MODE` | `lite` | Tool registration mode: `lite` (3 tools) or `full` (12 tools) | | `NUCLEI_TEMPLATES_DIR` | Native: empty; official image: bundled snapshot | Path to nuclei-templates repo root, enables secondary data source | | `NUCLEI_MIN_SEVERITY` | `high` | Minimum severity for nuclei vulnerability import: `critical`/`high`/`medium`/`low` | ## API Key RBAC Keys have two axes: **sources** (`builtin`, `team`, `custom`) and **access** (`read` and/or `write`, independently). Granting `builtin` also includes `nuclei`. `ABOUTSECURITY_API_KEY` remains a backward-compatible admin key. Extra keys come from `ABOUTSECURITY_API_KEYS_FILE`: ```json [ {"id": "public-mcp", "key": "replace-me", "sources": ["builtin"], "access": ["read"]}, {"id": "pojun-agent", "key": "replace-me", "sources": ["builtin", "team"], "access": ["read"]}, {"id": "ops", "key": "replace-me", "sources": ["builtin", "team", "custom"], "access": ["read", "write"]} ] ``` Unscoped search/list/MCP results are silently limited to granted sources. An explicit unauthorized `source=` filter returns 403. Fetching a hidden source by id returns the same not-found error as a missing resource. `read` is required for MCP/REST queries; `write` is required for custom CRUD, toggle, and `GET /api/usage`. They can be granted together or separately. Toggle only affects granted sources. `/health` stays unauthenticated and does not include source counts. A legacy string `"access": "write"` still means read+write. ## Admin Console Open `/admin` and sign in with `ABOUTSECURITY_ADMIN_KEY`. This key is independent of MCP/REST keys: it cannot call `/mcp` or `/api/*`, and MCP/REST keys cannot open the console. Empty admin key leaves `/admin` as 404. The console manages MCP/REST keys: create, change `sources`/`access`, rotate, and delete. Plaintext is shown only once on create/rotate. The env bootstrap key is read-only. Managed keys persist to `ABOUTSECURITY_API_KEYS_FILE` or `data/runtime/api-keys.json` and take effect immediately. Resource search/toggle and usage remain available as extra views. ## Data Sources ### Primary: AboutSecurity On startup, context1337 automatically loads skill, dict, payload, and vuln data from the [AboutSecurity](https://github.com/wgpsec/AboutSecurity) repo and builds an FTS5 full-text search index. This is the only required data source. ### Secondary: nuclei-templates Optionally ingest vulnerability intelligence from [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) to supplement AboutSecurity's coverage. Context1337 imports the HTTP `cves`, `cnvd`, `vulnerabilities`, `misconfiguration`, and `default-logins` template categories. Detection/exposure, takeover, and non-HTTP protocol templates are intentionally excluded. Native binary runs only activate it when `--nuclei-dir` or `NUCLEI_TEMPLATES_DIR` is set. The official Docker image bundles the latest supported HTTP template categories available at release build time and enables them with minimum severity `high`. Native binary runs remain opt-in. The resolved upstream commit is recorded in the image label `org.opencontainers.image.nuclei-templates.revision`; the running container never pulls or updates templates from the network. ```bash # Enable supported nuclei HTTP vulnerability data (critical + high by default) ./absec serve --nuclei-dir /path/to/nuclei-templates # Import only critical severity ./absec serve --nuclei-dir /path/to/nuclei-templates --nuclei-min-severity critical # Widen to include medium severity ./absec serve --nuclei-dir /path/to/nuclei-templates --nuclei-min-severity medium # Via environment variables NUCLEI_TEMPLATES_DIR=/path/to/nuclei-templates ./absec serve ``` | Flag | Description | Default | |------|-------------|---------| | `--nuclei-dir` | Path to nuclei-templates repo root. Leave unset to disable. | (empty = disabled) | | `--nuclei-min-severity` | Minimum severity to import: `critical` \| `high` \| `medium` \| `low` | `high` | > **Sync behavior:** on startup, context1337 checks the nuclei configuration automatically. First-time `--nuclei-dir`, directory changes, and severity changes rebuild only `source=nuclei` resources. The runtime DB stays in place, so `custom` resources are preserved. Starting again with the same config reuses the existing nuclei index. > > If `--nuclei-dir` is no longer set, startup removes `source=nuclei` resources, effectively disabling the secondary data source. --- ## Private team overlay Mount a private corpus at `data/team` with the same layout as AboutSecurity (`Vuln/`, `Dic/`, `Payload/`, `skills/`). Context1337 indexes it as `source=team` and searches it together with `builtin`. Do not bake private files into the image or `builtin.db`. On startup, context1337 hashes the team directory and rebuilds only `source=team` when the snapshot changes. `runtime.db` stays in place, so `custom` resources are preserved. Unchanged restarts reuse the existing team rows and IDs. After replacing files in the volume, restart the process — do not delete `runtime.db`. --- ## Architecture ``` Build time: AboutSecurity/ → Python+jieba → builtin.db (FTS5 index) Startup: cp builtin.db → runtime.db when missing/version-changed sync team/ when the directory snapshot changes → INSERT (source=team) [optional] sync supported nuclei HTTP categories → INSERT (source=nuclei) Runtime: MCP Streamable HTTP + REST API, pure Go tokenizer for new content ``` ## WgpSec Agentic Ecosystem context1337 is the service layer of the **WgpSec Agentic Ecosystem** — bridging structured security knowledge and autonomous AI agents. ``` ┌───────────────────── WgpSec Agentic Ecosystem ─────────────────────┐ │ │ │ Knowledge ➜ Service ➜ Execution ➜ Evaluation │ │ │ │ AboutSecurity ──▶ context1337 ──▶ tchkiller ──▶ benchmark-platform │ │ (this repo) (Pentest Agent) (CTF Range) │ │ ▲ │ │ PoJun (通用求解引擎) │ │ │ └─────────────────────────────────────────────────────────────────────┘ ``` | Project | Role | |---------|------| | [AboutSecurity](https://github.com/wgpsec/AboutSecurity) | Structured pentest knowledge base (Skills, Dic, Payload, Vuln) | | [context1337](https://github.com/wgpsec/context1337) | MCP Server — turns AboutSecurity into a searchable API for AI agents | | [tchkiller](https://github.com/wgpsec/tchkiller) | Autonomous pentest agent with multi-round decision-making and team collaboration | | [benchmark-platform](https://github.com/wgpsec/benchmark-platform) | HunXiang CTF challenge platform for evaluating agent offensive capabilities | | [benchmark-challenges](https://github.com/wgpsec/benchmark-challenges) | Challenge data repository — packed & distributed via GitHub Releases | | PoJun | General-purpose AI problem-solving engine (private) |

Cargando el README del repositorio…

Skills en este repositorio

Analistas de seguridad de la información

1 categorías ocupacionales · 100% clasificado

skill

ocupación

descripción

actualizado

test-ref

Analistas de seguridad de la información

Skill with references

Idioma del texto original: Sin determinar

2026-04-21

sql-injection

Analistas de seguridad de la información

SQL Injection attack and defense techniques

Idioma del texto original: inglés

2026-04-19

Mostrando 2 de 2 skills recopiladas.

Instalar con un asistente de IA

Copia este prompt en el asistente de IA que estés usando.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/wgpsec/context1337.