CyberSim Pro MCP Server

CyberSim Pro is a professional-grade Model Context Protocol (MCP) server purpose-built for cybersecurity training, purple-team collaboration, and executive readiness. It equips AI assistants and automation pipelines with structured tools to generate scenarios, simulate adversaries, analyse telemetry, investigate incidents, perform forensics, and publish board-ready reports—all while recording an immutable audit trail.

Table of Contents

• Feature Highlights
• Quick Start
  • Run with Node.js
  • Run with Docker
  • HTTP Bridge (REST API)
• MCP Client Integration
  • Claude Desktop
  • Cline VS Code Extension
• Tool Reference & Walkthroughs
  • 1. create_scenario
  • 2. simulate_attack
  • 3. analyze_network
  • 4. investigate_incident
  • 5. forensics_analysis
  • 6. generate_report
  • 7. stop_simulation
  • 8. replay_telemetry
  • 9. list_metrics
  • 10. export_controls
  • 11. sync_risk_register
  • 12. generate_validation_report
• Advanced Capabilities
  • Adaptive Adversary Profiles & Plugins
  • Command-Chain Drill-Down
  • Detection Engineering Packs
  • Executive & Governance Suite
  • Audit Logging & Kill Switch
  • Role-Based Access & Approvals
  • Risk & Compliance Sync
• Operational Playbooks
• Contributing & Community Sharing
• Support Resources
• License

Feature Highlights

• Adaptive adversary scenarios tied to real-world APT/FIN actor playbooks, sector-aware CVEs, and plugin-provided intel.
• Command-chain drill-down: pseudo CLI steps (guardrailed) for every attack phase to map outputs to analyst tooling.
• Detection engineering bundles: Sigma, Splunk, and KQL artefacts, MITRE ATT&CK heatmaps, gap analysis, and SOAR integration hooks.
• Incident response suite: deep investigations, forensic artefacts, purple-team scorecards, facilitation kits, executive dashboards, maturity roadmaps, and procurement briefs.
• Operational guardrails: append-only audit logs, approval-gated RBAC, stop_simulation kill switch, role-based prompt templates, and formal policy & ethics guide.
• Telemetry replay & metrics: overlay real PCAP/EDR/SIEM events on simulations, auto-capture readiness metrics, and expose historical trends.
• Risk & control automation: export compensating controls, sync with GRC platforms, and produce auditor-ready validation digests.

Quick Start

Run with Node.js

# Clone the repository (or copy into your workspace)
cd cybersim-pro-mcp

# Install dependencies
npm install

# Build TypeScript sources
npm run build

# Start the MCP server over stdio
node build/index.js

Run with Docker

# Build the image (from the repo root)
docker build -t cybersim-pro-mcp .

# Launch in stdio mode (for Claude, Cline, etc.)
docker run --rm -i cybersim-pro-mcp

HTTP Bridge (REST API)

Expose tools to REST clients or GPT Actions.

npm run serve:http  # defaults to http://localhost:8787

Secure with environment variables:

• CYBERSIM_API_KEY – require Authorization: Bearer <key> header
• CYBERSIM_IP_ALLOW – comma-separated list (`127.0.0.1,::1,local,203.0

... View full README on GitHub