开源MCP工具

Requirements

• Node.js >= 24
• npm >= 10 (recommended)
• Optional: Ollama for local model serving

Install

Global install (recommended)

npm install -g @opensec/secbot

Quick Start

1. Configure environment variables

Create a .env file in your working directory:

```env

Optional local backend (Ollama)

Optional: explore iterations, context debug SSE, adaptive replan, NVD rate limits

3. Start backend only (optional)

secbot-server

4. Start MCP server mode (optional)

secbot-mcp

Set SECBOT_MCP_ALLOW_SENSITIVE=true only when you intentionally want MCP clients to see sensitive tools.

5. Attach to an existing backend (optional)

```bash

NVD_API_KEY=your-nvd-key

```

CLI subcommands

secbot skills list
secbot skills view <name>
secbot skills create <name> --description "..." --trigger recon --tag web

REST endpoints

GET  /api/skills
GET  /api/skills/:name
POST /api/skills

Created skills are scaffolded under skills/custom/<slug>/SKILL.md and can also be reached through the internal list_skills, get_skill, and create_skill tools.

Why This Package

• End-to-end TypeScript architecture (NestJS + Ink + SQLite).
• secbot binary that starts terminal UI with local spawned backend by default.
• secbot-server binary for backend-only API scenarios.
• secbot-mcp binary that exposes Secbot tools as a stdio MCP server.
• Shared skills management across REST, TUI slash commands, CLI subcommands, and internal tools.
• Multi-agent orchestration with planning, tool execution, MCP bridging, and summarization.
• Built-in security tool modules for web, network, OSINT, defense, and reporting workflows.

Package Binaries

MCP Integration

Secbot supports MCP in both directions.