lserein/mcp-irt

This page was translated automatically. Technical details may differ from the original. View the original

22 stars 2 forks Quality 58 Trend 10

An automated security emergency response tool supporting remote hosts in security checks, threat investigation, and response handling, integrating threat intelligence analysis and AI-driven security incident analysis capabilities.

Overview

An automated security emergency response tool supporting security checks, threat investigations, and response handling for both local and remote hosts, integrating threat intelligence analysis and AI-driven security incident analysis capabilities. - : Supports direct scanning of local systems or remote connection to target hosts - : Supports Linux and Windows operating systems - : Supports SSH (Linux) and WinRM (Windows) - : Automatically executes multiple security check scripts - : Automatically identifies suspicious processes, network connections, scheduled tasks, etc. - : Supports process termination, IP blocking, and other response actions - : Automatically generates detailed Markdown-format emergency response reports - : - : Integrated VirusTotal and AbuseIPDB, automatically queries threat reputation from external connected IPs - : Automatically analyzes suspicious files, supports three modes: - hash_only: Queries only file hashes (fast) - file_upload: Uploads files for sandbox analysis (accurate) - auto: Smart mode, first checks hashes, automatically uploads files if not found - Supported platforms: VirusTotal, Weibu Online ThreatBook - Intelligent filtering: Automatically excludes internal IPs, public DNS, broadcast addresses, and other addresses that do not require querying - : Supports OpenAI GPT-4, Anthropic Claude, Qwen, intelligent analysis of threat patterns - : Anomaly detection and threat identification based on behavioral patterns - : Can be used as MCP Server integrated with Claude Desktop - Python 3.7+ - Operating systems: Windows / Linux / macOS : - paramiko>=3.4.0 - SSH connection library - pywinrm>=0.4.3 - Windows Remote Management - requests>=2.31.0 - HTTP request library - requests-ntlm>=1.2.0 - NTLM authentication - python-dateutil>=2.8.2 - date processing - openai>=1.0.0 - OpenAI API (optional) - anthropic>=0.18.

Overview (machine translated)

Main Features

Core Features

Local + Remote Mode: Supports direct scanning of local systems or remote connection to the target host
Cross-platform support: Supports Linux and Windows operating systems
Remote Connection: Supports SSH (Linux) and WinRM (Windows)
Automated Checks: Automatically execute multiple security inspection scripts
Intelligent Analysis: Automatically identifies suspicious processes, network connections, scheduled tasks, and more
Response Handling: Supports process termination, IP blocking, and other response actions
Report Generation: Automatically generate detailed Markdown-format emergency response reports

Advanced Features

Threat Intelligence Integration:
IP Intelligence Query: Integrates VirusTotal and AbuseIPDB to automatically query the threat reputation of external connected IPs
File Threat Analysis: Automatically analyzes suspicious files, supporting three modes:
hash_only: Query file hash only (fast)
file_upload: Upload file for sandbox analysis (accurate)
auto: Smart mode, first checks hashes, automatically uploads files if not found (recommended)
Supported platforms: VirusTotal, Weibu Online ThreatBook
Intelligent filtering: Automatically excludes addresses that do not require querying, such as internal IPs, public DNS, and broadcast addresses
AI-Driven Analysis: Supports OpenAI GPT-4, Anthropic Claude, Qwen, and intelligent threat analysis patterns
Behavior Analysis: Anomaly detection and threat identification based on behavioral patterns
MCP Protocol Support: Can be used as an integration between MCP Server and Claude Desktop

Project Structure

Installation and deployment

Environmental Requirements

Python 3.7+
Operating systems: Windows / Linux / macOS

Installing dependencies

Dependencies Package Description:

paramiko>=3.4.0 - SSH connection library
pywinrm>=0.4.3 - Windows Remote Management
requests>=2.31.0 - HTTP request library
requests-ntlm>=1.2.0 - NTLM certification
python-dateutil>=2.8.2 - Date processing
openai>=1.0.0 - OpenAI API (optional)
anthropic>=0.18.0 - Anthropic API (optional)

Configure the target host

Linux Hosting:

Windows Host:

Basic usage

Get started quickly

Connecting to Linux Host:

Connecting to Windows Host:

This page was translated automatically. Technical details may differ from the original.

Install

This server does not publish a one-line install command.

Open the repository installation guide New to MCP? Start with the mcpskill.org guide →

Configuration

{
  "mcpServers": {
    "mcp-irt": {
      "command": "python",
      "args": ["C:/path/to/mcp-irt/mcp_server.py"]
    }
  }
}