Sentinel — Cybersecurity Plugin for Claude Code

An offensive and defensive security toolkit for Claude Code. Sentinel helps you discover vulnerabilities in your own code and websites, run security checks, perform authorized recon and vulnerability scanning, enrich threat intelligence, and run blue-team / SOC operations — all behind an authorization gate.

⚠️ Authorized use only. The offensive components (recon, vulnerability scanning, pentest planning) are for systems you own or have written permission to test — engagements, CTFs, or in-scope bug bounties. Sentinel gates network-facing tools behind an authorized-scope allowlist, but the responsibility for staying in scope is yours. No destructive actions, denial-of-service, or mass/untargeted scanning.

Components

Skills (auto-invoked by task intent)

Skill	Purpose	Team	MCP
secure-code-review	OWASP Top 10 / CWE review of a diff or file	Blue	—
secrets-scan	Find hardcoded secrets/keys/tokens	Blue	—
dependency-audit	SCA — known-CVE / vulnerable dependencies	Blue	shodan (CVE, optional)
threat-model	STRIDE threat model for a design/feature	Blue	—
recon-osint	Passive OSINT / attack-surface mapping	Red	shodan
vuln-scan	Template-based vuln scanning	Red	nuclei (optional — see setup)
pentest-plan	PTES-lifecycle engagement plan	Red	—
threat-intel-lookup	IOC/CVE enrichment + ATT&CK mapping	Purple	misp, shodan
incident-response	PICERL SOC triage / IR	Blue	blue-team

Subagents (focused, isolated jobs)

recon-agent (shodan) · vuln-scanner (nuclei, optional) · code-auditor (local SAST/secrets/deps) · threat-intel-agent (misp) · blue-team-agent (blue-team) · remediation-fixer (local) · report-writer (local).

Commands

• /cyber-scope add|remove|list|clear <target> — manage the .cyber-scope authorization allowlist.
• /cyber-report [path] — compile findings into a remediation report.

Hooks

• PreToolUse (shodan / nuclei) — authorization gate: allows a call only if its target is in .cyber-scope, else asks.
• SessionStart — injects the authorized-use reminder and current scope.
• PostToolUse (Write/Edit) — scans changed files for hardcoded secrets.
• Stop — nudges you to run /cyber-report when .cyber-findings.md has entries.

MCP servers (.mcp.json)

Credentials are supplied through the plugin's config prompt (see Install) and read via ${user_config.*} — nothing is stored in this repo. Leave a value blank to disable that server.

Ready out of the box (starts automatically once you enter its key):

Server	Gets it from	Purpose	Config prompt
shodan	@burtthecoder/mcp-shodan (npx)	OSINT / recon / CVE lookup	Shodan API key

Optional — require setup (leave config blank to skip; the rest of the plugin still works):

Server	Gets it from	Purpose	Needs
misp	misp-mcp-server (uvx)	Threat intelligence	a MISP instance + uvx
blue-team	mcp-server-blueteam (SSH)	SOC / blue-team ops	a Linux SOC host reachable over SSH
nuclei	build from source (see below)	Active vulnerability scanning	Go 1.24.x toolchain to build the wrapper — ships in .mcp.json, activated by config

Optional server setup

MISP — at the config prompt set MISP instance URL to your real instance base URL (e.g. https://misp.yourorg.com) and MISP API key (MISP → My Profile → Auth Keys). Requires uvx (pip install uv). Leave blank to skip.

blue-team — mcp-server-blueteam is the blue-team-mcp project, which runs on a Linux SOC host (Ubuntu 20.04+/Debian 11+), not on Windows. On the host: clone the repo and run sudo bash setup.sh (installs /usr/local/bin/mcp-server-blueteam and a config at /opt/blue-team-mcp/config.env; optional enrichment: ABUSEIPDB_API_KEY, VIRUSTOTAL_API_KEY, Wazuh endpoints). From your machine: create a key (ssh-keygen -t ed25519 -f ~/.ssh/soc_key), add the public key to the host's ~/.ssh/authorized_keys, then set Blue-team SOC SSH target (user@host) and Blue-team SSH private key (path) at the config prompt.

nuclei — active vulnerability scanning. There is no working npm/uvx package (nuclei-mcp does not exist on npm), so nuclei runs from a locally built Go binary. The nuclei server now ships in .mcp.json (config-driven) and activates once you set its binary path — until then the vuln-scan skill and vuln-scanner agent stay available but have no engine. Build it once:

1. Install Go 1.24.x — not the latest. Go 1.26 fails to build a transitive dependency (bytedance/sonic → undefined: GoMapIterator). Get go1.24.4 from https://go.dev/dl/ and build with GOTOOLCHAIN=local so the toolchain won't auto-upgrade.
2. Clone the wrapper (addcontent/nuclei-mcp imports nuclei as a Go library, so no separate nuclei binary is needed — the engine is compiled in):

   git clone https://github.com/addcontent/nuclei-mcp
   cd nuclei-mcp
   

3. Build (the repo ships an incomplete go.sum, so tidy first; pure-Go — no C compiler):

   go mod tidy
   CGO_ENABLED=0 GOTOOLCHAIN=local go build -o nuclei-mcp.exe ./cmd/nuclei-mcp
   

4. Point the plugin at it — set nuclei MCP binary in the config prompt (/plugin configure sentinel@hareem-cyber-marketplace) to the built binary's full path, then /reload-plugins. The PreToolUse authorization gate covers it automatically. Authorized targets only.

Requirements

• Node.js — used by the hook scripts and the npx-based shodan server. (Required.)
• uvx (from uv) — only for the optional MISP server.
• ssh — only for the optional blue-team server (a Linux SOC host).
• Go 1.24.x toolchain — only to build the nuclei MCP binary (the wrapper compiles nuclei in as a library; no separate nuclei binary needed).
• Credentials are entered at the config prompt on enable (see below); nothing is hand-edited. Servers whose config you leave blank simply won't connect — the rest of the plugin still works.

Install

From GitHub (for anyone — adds this repo as a marketplace and installs from it):

/plugin marketplace add https://github.com/hareemirfan2004-dev/cyber_security_plugin.git
/plugin install sentinel@hareem-cyber-marketplace

From a local clone:

git clone https://github.com/hareemirfan2004-dev/cyber_security_plugin
/plugin marketplace add ./cyber_security_plugin
/plugin install sentinel@hareem-cyber-marketplace

When you enable the plugin, Claude Code prompts you for each value below. The two API keys are masked and stored in your OS keychain; the rest go to your settings. Leave any blank to skip that server.

Prompt	Example	Sensitive
Shodan API key	from https://account.shodan.io	🔒 keychain
MISP instance URL	https://misp.yourorg.com	no
MISP API key	from MISP → My Profile → Auth Keys	🔒 keychain
Blue-team SOC SSH target	soc-admin@10.0.5.20	no
Blue-team SSH private key	~/.ssh/soc_key	no (path only)
nuclei MCP binary	C:\Users\you\nuclei-mcp\nuclei-mcp.exe	no (path only)

To change a value later, re-run the plugin's config from /plugin (Sentinel → Configure).

Safety model

• .cyber-scope (in your project root) lists authorized targets — domains, IPs, or CIDRs. The PreToolUse gate allows a shodan/nuclei call only when its target matches (exact host, subdomain of a listed domain, or IP within a listed CIDR); otherwise it asks you to confirm. Manage it with /cyber-scope.
• No credentials are stored in the plugin — .mcp.json reads ${user_config.*}, and the sensitive keys live in your OS keychain, never in the repo or the conversation.
• Third-party MCP servers run with real access to your machine and network. Vet them before use.

Files

cyber_security_plugin/
├── .claude-plugin/plugin.json   # manifest
├── .mcp.json                    # MCP servers (shodan; nuclei + blue-team + misp optional)
├── LICENSE                      # CC BY-ND 4.0
├── commands/                    # /cyber-scope, /cyber-report
├── agents/                      # 7 subagents
├── skills/                      # 9 skills
└── hooks/                       # hooks.json + Node scripts

License

Licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0) — see LICENSE. You may install, use, and share this plugin in unmodified form, with attribution. Distributing modified or derivative versions is not permitted.