Claude MarketplacesSubmit
getlarkwright avatar

SecOps Field Notes

getlarkwright/secops-field-notes-mcp

CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.

tools
10
transport
STDIO
last updated
Nov 7, 2026
View on GitHub

Tools

10 tools

Public tool metadata for what this MCP can expose to an agent.

cvss_scoreCVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it

CVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it

No parameter schema in public metadata yet.

extract_iocsEvery IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out

Every IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out

No parameter schema in public metadata yet.

defang_texthxxp[://], [.], [at] and back

hxxp[://], [.], [at] and back

No parameter schema in public metadata yet.

analyze_email_headersThe Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for

The Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for

No parameter schema in public metadata yet.

identify_hashbcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies

bcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies

No parameter schema in public metadata yet.

decode_jwtHeader, payload, times as dates; flags alg:none, expiry, tokens that never expire

Header, payload, times as dates; flags alg:none, expiry, tokens that never expire

No parameter schema in public metadata yet.

convert_timestampEpoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form

Epoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form

No parameter schema in public metadata yet.

decode_layersChain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer

Chain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer

No parameter schema in public metadata yet.

lookup_kevIs this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action

Is this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action

No parameter schema in public metadata yet.

latest_field_noteWhat got exploited this week

What got exploited this week

No parameter schema in public metadata yet.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

secops-field-notes-mcp

The things a security analyst does by hand a dozen times a shift, as tools your coding agent can call: score a CVE, pull the indicators out of a report and defang them for the ticket, read a phishing email's headers properly, work out what kind of hash that is, decode a JWT, turn a timestamp into something a human can read, peel a base64-of-hex payload, and check whether a CVE is on CISA's exploited-in-the-wild list.

Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.

Install

Pin the version.

Claude Code

claude mcp add secops-field-notes -- npx -y github:getlarkwright/secops-field-notes-mcp#v0.1.1

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "npx",
      "args": ["-y", "github:getlarkwright/secops-field-notes-mcp#v0.1.1"]
    }
  }
}

Docker

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/getlarkwright/secops-field-notes-mcp:0.1.1"]
    }
  }
}

View the full README on GitHub

Details

Repository
github.com/getlarkwright/secops-field-notes-mcp
Website
secopsfieldnotes.com
Category
Communication & Messaging
Package
ghcr.io/getlarkwright/secops-field-notes-mcp:0.1.1
Transport
STDIO
Registry
MCP registry, active

More from getlarkwright

Related Communication & Messaging MCP servers

View all
1holiday-forever avatarHoliday Photo Plus 2holiday-forever/holiday-photo-plus-2Holiday photo MCP server: list and fetch personal holiday photos inline in Claude chat.0stars
2inkwell-finance avatarDagon Inferenceinkwell-finance/dagon-mcpUncensored LLM inference: list models, chat, create keys, buy credits with Solana USDC.0stars
3favcrm avatarFavCRMfavcrm/mcpAgentic CRM for service businesses — bookings, customers, WhatsApp, loyalty, invoicing.0stars
4ali1041 avatarLeadloadzali1041/leadloadz-mcp-serverB2B lead search and email verification MCP server0stars
5arcxs-protocol avatarMcp Serverarcxs-protocol/arcxs-mcp-serverThe DNS/SMTP for AI agents: cross-protocol discovery, messaging and transactions. No middleman fees.0stars
6br0ski777 avatarDiff Checker APIbr0ski777/diff-checker-x402Compare two texts line-by-line — additions, deletions, unchanged. x402 micropayment.0stars