mukul975

150 mods in 6 plugins, 7 repositories, 37k stars between them.

cve-mcp

02

mukul975/cve-mcp-server

MCP server Claude CodeCodexCursor +2

MCP server "cve-mcp" as configured in mukul975/cve-mcp-server. Runs cve_mcp.server with python. Needs 4 environment variables to run.

not rated 1.6k +2 15d ago A tokens not measured original Apache-2.0

active-directory

08

mukul975/Threatswarm

Agent Claude Code

Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, domain controller, LDAP, GPO, AD, domain…

not rated 88 +1 5mo ago A 86 tokens original MIT

api-attacker

09

mukul975/Threatswarm

Agent Claude Code

API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT attacks, GraphQL introspection abuse, API enumeration, and OWASP API Top 10. Triggers on: API, REST, GraphQL, gRPC, WebSocket, BOLA, IDOR, mass assignment, API…

not rated 88 +1 5mo ago A 105 tokens original MIT

blue-team

10

mukul975/Threatswarm

Agent Claude Code

Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules, configures auditd, fail2ban, Sysmon, and provides CIS benchmark remediation guidance. Triggers on: harden, detection, Sigma rule, Sysmon, auditd, fail2ban, CIS benchmark, SIEM detection, blue team…

not rated 88 +1 5mo ago B 93 tokens original MIT

c2-operator

11

mukul975/Threatswarm

Agent Claude Code needs its repo

Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2, Metasploit multi-handler, msfvenom payload generation, implant configuration, HTTPS C2 traffic blending, and operator session management. Triggers on: C2, command and control, Sliver, Havoc…

not rated 88 +1 5mo ago A 94 tokens original MIT

cloud-attacker

12

mukul975/Threatswarm

Agent Claude Code needs its repo

Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S3 bucket abuse, metadata SSRF, Pacu framework, container escape to cloud, and cloud-native attack chains. Triggers on: AWS, Azure, GCP, cloud, IAM, S3, storage bucket, metadata endpoint, Pacu, cloud privesc…

not rated 88 +1 5mo ago C 86 tokens original MIT

compliance-scanner

13

mukul975/Threatswarm

Agent Claude Code needs its repo

Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP assessments, Docker CIS bench, Kubernetes CIS bench, and security configuration auditing. Triggers on: compliance, CIS benchmark, PCI-DSS, NIST, SOC2, GDPR, lynis…

not rated 88 +1 5mo ago A 88 tokens original MIT

container-attacker

14

mukul975/Threatswarm

Agent Claude Code

Container and Kubernetes security specialist. Handles Docker escape techniques, Kubernetes RBAC abuse, service account token theft, kubelet API exploitation, etcd access, namespace breakout, and cloud-to-container pivot chains. Triggers on: docker, container, Kubernetes, k8s, pod, kubelet, etcd, service account, RBAC…

not rated 88 +1 5mo ago C 80 tokens original MIT

crypto-attacker

15

mukul975/Threatswarm

Agent Claude Code

Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks, hash cracking mode selection, RSA weak key analysis, ECB mode detection, certificate inspection, and crypto protocol attacks. Triggers on: TLS, SSL, cipher, JWT, padding oracle, RSA, hash…

not rated 88 +1 5mo ago B 86 tokens original MIT

dfir

16

mukul975/Threatswarm

Agent Claude Code

Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log timeline reconstruction, IOC extraction, persistence hunting, and incident reporting. Triggers on: DFIR, incident response, forensics, Volatility, memory dump, timeline, IOC, triage…

not rated 88 +1 5mo ago A 78 tokens original MIT

evasion

17

mukul975/Threatswarm

Agent Claude Code

Antivirus and EDR evasion specialist for authorized red team engagements. Handles AMSI bypass, payload obfuscation, living-off-the-land techniques, sandbox detection, process injection concepts, and detection gap identification. Triggers on: AMSI bypass, AV evasion, EDR bypass, obfuscation, LOTL, living off the land…

not rated 88 +1 5mo ago A 85 tokens original MIT

exploit

18

mukul975/Threatswarm

Agent Claude Code needs its repo

Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit, obtaining shells, or executing proof-of-concept code. Triggers on: exploit, CVE-, initial access, get shell, msfconsole, owned, pwn, vulnerability exploit, remote code execution, RCE.

not rated 88 +1 5mo ago A 73 tokens original MIT

iot-attacker

19

mukul975/Threatswarm

Agent Claude Code needs its repo

IoT and embedded systems security specialist. Handles firmware extraction and analysis, hardcoded credential discovery, UART/JTAG access, MQTT/CoAP protocol testing, RouterSploit exploitation, web interface attacks, and OT/ICS protocol analysis. Triggers on: IoT, firmware, binwalk, UART, JTAG, router, embedded…

not rated 88 +1 5mo ago B 93 tokens original MIT

log-analyst

20

mukul975/Threatswarm

Agent Claude Code

Security log analysis specialist. Parses and correlates auth.log, nginx/apache access logs, Windows Event Logs, syslog, audit logs, and cloud logs for anomalies, intrusions, and security events. Generates timeline and Sigma rules from findings. Triggers on: log analysis, log parsing, auth.log, access log, SIEM, event…

not rated 88 +1 5mo ago A 89 tokens original MIT

malware-analyst

21

mukul975/Threatswarm

Agent Claude Code

Malware analysis specialist for static and dynamic analysis. Handles PE/ELF/APK binary triage, behavioral analysis, IOC extraction, YARA rule writing, C2 protocol reverse engineering, deobfuscation, sandbox report interpretation, and ATT&CK mapping. Triggers on: malware, sample, IOC, YARA, sandbox, deobfuscate…

not rated 88 +1 5mo ago A 99 tokens original MIT

mobile-attacker

22

mukul975/Threatswarm

Agent Claude Code

Mobile application security specialist for Android and iOS. Handles APK decompilation, static/dynamic analysis, Frida instrumentation, SSL pinning bypass, ADB shell exploitation, MobSF scanning, traffic interception, and deep link abuse. Triggers on: Android, iOS, APK, IPA, Frida, ADB, MobSF, apktool, jadx, SSL…

not rated 88 +1 5mo ago A 92 tokens original MIT

network-ops

23

mukul975/Threatswarm

Agent Claude Code

Network penetration testing specialist for ARP attacks, MitM, packet capture, SNMP enumeration, SMB relay, Responder credential capture, and network-level attacks. Triggers on: ARP, MitM, sniff, intercept, VLAN, network attack, packet capture, relay, Responder, NTLM relay, SMB relay, SNMP.

not rated 88 +1 5mo ago B 73 tokens original MIT

osint

24

mukul975/Threatswarm

Agent Claude Code

Open source intelligence specialist for passive reconnaissance. Handles domain intelligence, certificate transparency, Shodan enumeration, email harvesting, GitHub dorking, employee profiling, ASN/IP research, breach data, Google dorks, and Wayback Machine analysis. Triggers on: OSINT, passive recon, theHarvester…

not rated 88 +1 5mo ago A 97 tokens original MIT

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: