Enables GitHub Copilot to orchestrate security research workflows, discovering and executing containerized security tools from the MCP Security Hub.
Provides access to Trivy for vulnerability scanning of containers, filesystems, and repositories, integrated into AI-driven security pipelines.
Provides access to VirusTotal for analyzing files and URLs against a vast threat intelligence database, integrated into AI-driven security pipelines.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SecPipe Analyze firmware.bin for vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🚧 SecPipe AI is under active development. Expect breaking changes and new features!
SecPipe AI is an open-source MCP server that enables AI agents (GitHub Copilot, Claude, etc.) to orchestrate security research workflows through the Model Context Protocol (MCP).
SecPipe connects your AI assistant to MCP tool hubs — collections of containerized security tools that the agent can discover, chain, and execute autonomously. Instead of manually running security tools, describe what you want and let your AI assistant handle it.
SecPipe acts as a meta-MCP server — a single MCP endpoint that gives your AI agent access to tools from multiple MCP hub servers. Each hub server is a containerized security tool (Binwalk, YARA, Radare2, Nmap, etc.) that the agent can discover at runtime.
🔍 Discovery: The agent lists available hub servers and discovers their tools
🤖 AI-Native: Hub tools provide agent context — usage tips, workflow guidance, and domain knowledge
🔗 Composable: Chain tools from different hubs into automated pipelines
📦 Extensible: Add your own MCP servers to the hub registry
Scenario: Analyze a firmware image to find security vulnerabilities — fully automated by an AI agent.
User: "Search for vulnerabilities in firmware.bin"
Agent → Binwalk: Extract filesystem from firmware image
Agent → YARA: Scan extracted files for vulnerability patterns
Agent → Radare2: Trace dangerous function calls in prioritized binaries
Agent → Report: 8 vulnerabilities found (2 critical, 4 high, 2 medium)Scenario: Fuzz a Rust crate to discover vulnerabilities using AI-assisted harness generation and parallel fuzzing.
User: "Fuzz the blurhash crate for vulnerabilities"
Agent → Rust Analyzer: Identify fuzzable functions and attack surface
Agent → Harness Gen: Generate and validate fuzzing harnesses
Agent → Cargo Fuzzer: Run parallel coverage-guided fuzzing sessions
Agent → Crash Analysis: Deduplicate and triage discovered crashesRelated MCP server: Hercules MCP
If you find SecPipe useful, please star the repo to support development! 🚀
Feature | Description |
🤖 AI-Native | Built for MCP — works with GitHub Copilot, Claude, and any MCP-compatible agent |
🔌 Hub System | Connect to MCP tool hubs — each hub brings dozens of containerized security tools |
🔍 Tool Discovery | Agents discover available tools at runtime with built-in usage guidance |
🔗 Pipelines | Chain tools from different hubs into automated multi-step workflows |
🔄 Persistent Sessions | Long-running tools (Radare2, fuzzers) with stateful container sessions |
🏠 Local First | All execution happens on your machine — no cloud required |
🔒 Sandboxed | Every tool runs in an isolated container via Docker or Podman |
┌─────────────────────────────────────────────────────────────────┐
│ AI Agent (Copilot/Claude) │
└───────────────────────────┬─────────────────────────────────────┘
│ MCP Protocol (stdio)
▼
┌─────────────────────────────────────────────────────────────────┐
│ SecPipe MCP Server │
│ │
│ Projects Hub Discovery Hub Execution │
│ ┌──────────────┐ ┌──────────────────┐ ┌───────────────────┐ │
│ │init_project │ │list_hub_servers │ │execute_hub_tool │ │
│ │set_assets │ │discover_hub_tools│ │start_hub_server │ │
│ │list_results │ │get_tool_schema │ │stop_hub_server │ │
│ └──────────────┘ └──────────────────┘ └───────────────────┘ │
└───────────────────────────┬─────────────────────────────────────┘
│ Docker/Podman
▼
┌─────────────────────────────────────────────────────────────────┐
│ MCP Hub Servers │
│ │
│ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ │
│ │ Binwalk │ │ YARA │ │ Radare2 │ │ Nmap │ │
│ │ 6 tools │ │ 5 tools │ │ 32 tools │ │ 8 tools │ │
│ └───────────┘ └───────────┘ └───────────┘ └───────────┘ │
│ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ │
│ │ Nuclei │ │ SQLMap │ │ Trivy │ │ ... │ │
│ │ 7 tools │ │ 8 tools │ │ 7 tools │ │ 36 hubs │ │
│ └───────────┘ └───────────┘ └───────────┘ └───────────┘ │
└─────────────────────────────────────────────────────────────────┘SecPipe ships with built-in support for the MCP Security Hub — a collection of 36 production-ready, Dockerized MCP servers covering offensive security:
Category | Servers | Examples |
🔍 Reconnaissance | 8 | Nmap, Masscan, Shodan, WhatWeb |
🌐 Web Security | 6 | Nuclei, SQLMap, ffuf, Nikto |
🔬 Binary Analysis | 6 | Radare2, Binwalk, YARA, Capa, Ghidra |
⛓️ Blockchain | 3 | Medusa, Solazy, DAML Viewer |
☁️ Cloud Security | 3 | Trivy, Prowler, RoadRecon |
💻 Code Security | 1 | Semgrep |
🔑 Secrets Detection | 1 | Gitleaks |
💥 Exploitation | 1 | SearchSploit |
🎯 Fuzzing | 2 | Boofuzz, Dharma |
🕵️ OSINT | 2 | Maigret, DNSTwist |
🛡️ Threat Intel | 2 | VirusTotal, AlienVault OTX |
🏰 Active Directory | 1 | BloodHound |
185+ individual tools accessible through a single MCP connection.
The hub is open source and can be extended with your own MCP servers. See the mcp-security-hub repository for details.
Python 3.12+
uv package manager
Docker (Install Docker) or Podman
# Clone the repository
git clone https://github.com/FuzzingLabs/secpipe_ai.git
cd secpipe_ai
# Install dependencies
uv sync# Clone the MCP Security Hub
git clone https://github.com/FuzzingLabs/mcp-security-hub.git ~/.secpipe/hubs/mcp-security-hub
# Build the Docker images for the hub tools
./scripts/build-hub-images.shOr use the terminal UI (uv run secpipe ui) to link hubs interactively.
# For GitHub Copilot
uv run secpipe mcp install copilot
# For Claude Code (CLI)
uv run secpipe mcp install claude-code
# For Claude Desktop (standalone app)
uv run secpipe mcp install claude-desktop
# Verify installation
uv run secpipe mcp statusRestart your editor and your AI agent will have access to SecPipe tools!
Once installed, just talk to your AI agent:
"What security tools are available?"
"Scan this firmware image for vulnerabilities"
"Analyze this binary with radare2"
"Run nuclei against https://example.com"The agent will use SecPipe to discover the right hub tools, chain them into a pipeline, and return results — all without you touching a terminal.
See the Usage Guide for detailed setup and advanced workflows.
secpipe_ai/
├── secpipe-mcp/ # MCP server — the core of SecPipe
├── secpipe-cli/ # Command-line interface & terminal UI
├── secpipe-common/ # Shared abstractions (containers, storage)
├── secpipe-runner/ # Container execution engine (Docker/Podman)
├── secpipe-tests/ # Integration tests
├── mcp-security-hub/ # Default hub: 36 offensive security MCP servers
└── scripts/ # Hub image build scriptsWe welcome contributions from the community!
🐛 Report bugs via GitHub Issues
💡 Suggest features or improvements
🔧 Submit pull requests
🔌 Add new MCP servers to the Security Hub
See CONTRIBUTING.md for guidelines.
BSL 1.1 - See LICENSE for details.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
MCP Hub: AI service discovery, per-user OAuth, and multi-service workflow orchestration
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/FuzzingLabs/secpipe'
If you have feedback or need assistance with the MCP directory API, please join our Discord server