Nuclei MCP server

The Nuclei MCP server provides a robust implementation for Nuclei vulnerability scanner, offering features like result caching, concurrent scanning operations, and flexible template filtering capabilities. It serves as an interface to Nuclei's powerful scanning functionality through the Model Context Protocol.

Installation

To run the Nuclei MCP server, you'll need to have Go installed on your system. You can then run the server directly using the Go command:

# From the nuclei directory
go run nuclei_mcp.go

Configuration

The server can be configured using environment variables:

• CACHE_EXPIRY: Sets the duration for cache expiry (default: 1h)
• LOG_LEVEL: Sets the logging level (default: info)

Example of setting configuration variables:

# Set cache expiry to 30 minutes
export CACHE_EXPIRY=30m

# Set logging level to debug
export LOG_LEVEL=debug

# Then run the server
go run nuclei_mcp.go

Available Tools

The Nuclei MCP server provides several tools for vulnerability scanning:

• nuclei_scan: Performs a full Nuclei scan with template filtering
• basic_scan: Performs a simple scan without template IDs
• vulnerability_resource: Queries scan results as resources
• advanced_scan: Performs a comprehensive scan with extensive configuration options
• template_sources_scan: Performs scans using custom template sources

Using the MCP Inspector

The MCP Inspector is useful for debugging and testing your MCP server:

# Install the MCP Inspector (if not already installed)
npm install -g @modelcontextprotocol/inspector

# Run the inspector with the Nuclei MCP server
npx @modelcontextprotocol/inspector go run ./nuclei_mcp.go

After running these commands, you can access the MCP Inspector UI at http://localhost:5173 where you can:

• View available tools and their schemas
• Execute tool calls and view results
• Inspect resources provided by the server
• Monitor server notifications

Example Usage

Basic Scan

To perform a basic vulnerability scan against a target:

{
  "target": "example.com",
  "severity": ["critical", "high"]
}

Advanced Scan

For a more comprehensive scan with extensive configuration:

{
  "target": "example.com",
  "templates": ["cves", "exposures"],
  "severity": ["critical", "high", "medium"],
  "protocols": ["http", "https"],
  "rate_limit": 150,
  "concurrency": 25,
  "timeout": 5
}

Querying Results

To query scan results as resources:

{
  "target": "example.com",
  "severity": ["critical", "high"]
}

Features

Caching

The server caches scan results with configurable expiry to improve performance. This means repeated scans against the same target with the same parameters will return faster results.

Thread-safety

The server supports concurrent scanning operations, making it suitable for environments where multiple scan requests might occur simultaneously.

Template Filtering

You can filter scanning templates by:

• Severity levels (critical, high, medium, low, info)
• Protocols (http, https, dns, etc.)
• Specific template IDs

How to add this MCP server to Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > MCP and click "Add new global MCP server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "cursor-rules-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "cursor-rules-mcp"
            ]
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explictly ask the agent to use the tool by mentioning the tool name and describing what the function does.