Cybersim Pro
Built for purple team exercises and SOC readiness drills, this server gives Claude hands-on cybersecurity simulation tools. You get 12 tools covering the full incident lifecycle: create scenarios tuned to specific APT profiles and CVEs, simulate multi-phase attacks with pseudo command chains, analyze network telemetry, investigate incidents, run forensics, and generate board-level reports. It tracks everything in an append-only audit log with optional HMAC chain sealing for compliance, supports RBAC with approval tokens for destructive ops, and can sync findings back to GRC platforms. The replay_telemetry tool overlays real PCAP or SIEM data onto simulations. Ships with Docker support and an optional HTTP bridge if you want to expose it as a REST API behind authentication.
- tools
- 12
- transport
- STDIO
- last updated
- Sep 30, 2025
Tools
12 toolsPublic tool metadata for what this MCP can expose to an agent.
create_scenarioGenerate a tailored scenario with adaptive adversary content.
Generate a tailored scenario with adaptive adversary content.
No parameter schema in public metadata yet.
simulate_attackSimulate a multi-phase attack and inspect the command-chain drill-down.
Simulate a multi-phase attack and inspect the command-chain drill-down.
No parameter schema in public metadata yet.
analyze_networkAnalyse network segments and receive detection artefacts plus coverage insights.
Analyse network segments and receive detection artefacts plus coverage insights.
No parameter schema in public metadata yet.
investigate_incidentRun a timeline-driven investigation with evidence, root cause, containment, and remediation details.
Run a timeline-driven investigation with evidence, root cause, containment, and remediation details.
No parameter schema in public metadata yet.
forensics_analysisProduce digital forensic artefacts for memory, disk, network, logs, or registry sources.
Produce digital forensic artefacts for memory, disk, network, logs, or registry sources.
No parameter schema in public metadata yet.
generate_reportGenerate executive, incident, vulnerability, or compliance reports with optional facilitation mode.
Generate executive, incident, vulnerability, or compliance reports with optional facilitation mode.
No parameter schema in public metadata yet.
stop_simulationKill a single simulation or all active runs with audit logging.
Kill a single simulation or all active runs with audit logging.
No parameter schema in public metadata yet.
replay_telemetryOverlay raw telemetry (PCAP/EDR/SIEM exports) against a live simulation to validate coverage.
Overlay raw telemetry (PCAP/EDR/SIEM exports) against a live simulation to validate coverage.
No parameter schema in public metadata yet.
list_metricsSummarise readiness metrics across all exercises.
Summarise readiness metrics across all exercises.
No parameter schema in public metadata yet.
export_controlsExport the consolidated compensating-control feed (detections, automations, gap closures).
Export the consolidated compensating-control feed (detections, automations, gap closures).
No parameter schema in public metadata yet.
sync_risk_registerGenerate REST payloads for governance platforms such as ServiceNow GRC, Archer, or OneTrust.
Generate REST payloads for governance platforms such as ServiceNow GRC, Archer, or OneTrust.
No parameter schema in public metadata yet.
generate_validation_reportProduce an auditor-facing summary with hashed proof of recent CyberSim activity.
Produce an auditor-facing summary with hashed proof of recent CyberSim activity.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
CyberSim Pro MCP Server
CyberSim Pro is a professional-grade Model Context Protocol (MCP) server purpose-built for cybersecurity training, purple-team collaboration, and executive readiness. It equips AI assistants and automation pipelines with structured tools to generate scenarios, simulate adversaries, analyse telemetry, investigate incidents, perform forensics, and publish board-ready reports—all while recording an immutable audit trail.
Details
- Repository
- github.com/kayembahamid/cybersim-pro
- Website
- kayembahamid.github.io
- Category
- Monitoring & Observability
- Package
docker.io/hamcodes/cybersim-pro-mcp:v1.0.1- Transport
- STDIO
- Registry
- MCP registry, active
Related Monitoring & Observability MCP servers
View all
Facebook Pages Mcplanternrow/facebook-pages-mcpFacebook Pages organic analytics, post management, and insights via Meta Graph API v25.0.0stars
AgentWatchnicofains1/agentwatchMulti-agent observability: cascade failure detection, heartbeats, and forensic replay0stars
PostHog MCP Serverposthog/posthogOfficial PostHog MCP Server for product analytics, feature flags, experiments, and more.35Kstars
BrowserToolsagentdeskai/browser-tools-mcpMonitor browser logs directly from Cursor and other MCP compatible IDEs.7.2Kstars
Google Ads + Meta Ads + SEO/GEO MCPirinabuht12-oss/google-ads-meta-ads-mcpGoogle Ads, Meta Ads, Google Analytics (GA4) & Search Console MCP server by Ryze AI7Kstars
SSH — policy-gated remote accesstufantunc/ssh-mcpPolicy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.875stars