# Autonomous Cyber Red Team MCP (`ryanclinton/autonomous-cyber-red-team-mcp`) Actor Adversarial attack graph simulation with advanced mathematical modeling for AI agents via the Model Context Protocol. - **URL**: https://apify.com/ryanclinton/autonomous-cyber-red-team-mcp.md - **Developed by:** [ryan clinton](https://apify.com/ryanclinton) (community) - **Categories:** AI, Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing Pay per event + usage This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Autonomous Cyber Red Team MCP Server **Adversarial attack graph simulation with advanced mathematical modeling** for AI agents via the Model Context Protocol. This MCP server orchestrates **15 cybersecurity data sources** and applies **8 mathematical frameworks** -- POSG belief-space planning, AND-OR A* exploit chain synthesis, Hawkes process vulnerability forecasting, Colonel Blotto game-theoretic defense allocation, Exp3 adversary modeling, absorbing Markov chain lateral movement analysis, GPD extreme value tail risk, and replicator dynamics threat evolution -- to deliver quantitative cyber risk intelligence. ### What data can you access? | Data Point | Source | Coverage | |-----------|--------|----------| | CVE vulnerability data with CVSS scores | NVD CVE Search | All published CVEs | | Known exploited vulnerabilities | CISA KEV Catalog | Actively exploited CVEs | | Internet-wide host and service data | Censys Search | IPv4 scan data | | DNS records and configuration | DNS Lookup | Any domain | | SSL/TLS certificate data | SSL Certificate Search | Certificate transparency | | Domain registration data | WHOIS Lookup | All TLDs | | IP geolocation and ASN mapping | IP Geolocation | Global coverage | | Website technology identification | Tech Stack Detector | Any website | | Security tools and exploit code | GitHub Repo Search | All public repos | | Security Q&A discussions | StackExchange Search | Security communities | | Security news and discussions | Hacker News Search | Tech community | | US Treasury sanctions | OFAC Sanctions Search | SDN list | | Global sanctions and watchlists | OpenSanctions Search | 100+ programs | | Security website changes | Website Change Monitor | Tracked sites | | Cybersecurity economic data | FRED Economic Data | Market indicators | ### MCP Tools | Tool | Price | Description | |------|-------|-------------| | `simulate_attack_defense_posg` | $0.04 | Simulate attack-defense as a Partially Observable Stochastic Game via HSVI2 point-based value iteration on belief space with alpha-vector pruning. Returns optimal attack path, defense allocation, and game value. | | `synthesize_exploit_chains` | $0.04 | Synthesize multi-step exploit chains via AND-OR graph A* search with CVSS admissible heuristic. Finds optimal-cost attack paths from entry points to high-value targets. | | `predict_vulnerability_emergence` | $0.04 | Predict vulnerability emergence using Hawkes self-exciting point process with power-law kernel. Forecasts CVE clustering, burst probability, and 30/90-day vulnerability counts. | | `optimize_defender_allocation` | $0.04 | Optimize security resource allocation using Colonel Blotto game theory with asymmetric attacker-defender budgets. Finds Nash equilibrium defense strategy via fictitious play. | | `model_adaptive_adversary` | $0.04 | Model adversary learning via Exp3 multi-armed bandit with importance-weighted rewards. Predicts which attack techniques adapt fastest against defenses. | | `compute_lateral_movement_risk` | $0.04 | Compute lateral movement risk using absorbing Markov chain fundamental matrix N=(I-Q)^-1. Includes epidemic threshold analysis for supercritical compromise spread. | | `assess_zero_day_tail_risk` | $0.04 | Assess zero-day tail risk using Generalized Pareto Distribution extreme value theory. Computes VaR, CVaR, return periods, and portfolio cyber risk. | | `forecast_threat_landscape_evolution` | $0.04 | Forecast threat landscape evolution using replicator dynamics. Classifies techniques as EMERGING/GROWING/MATURE/DECLINING with evolutionary stable strategy identification. | ### Data Sources - **NVD CVE Search** -- National Vulnerability Database with CVSS severity scores, CWE classifications, and affected products - **CISA KEV Catalog** -- Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities with remediation deadlines - **Censys Search** -- Internet-wide scan data revealing exposed services, open ports, and certificate information - **DNS Lookup** -- DNS record enumeration including A, AAAA, MX, TXT, CNAME, and security records - **SSL Certificate Search** -- Certificate transparency logs for subdomain discovery and certificate chain validation - **WHOIS Lookup** -- Domain registration details, registrar information, and ownership data - **IP Geolocation** -- IP address to geographic location mapping with ASN and ISP identification - **Tech Stack Detector** -- Website technology identification for vulnerability matching - **GitHub Repo Search** -- Open-source exploit code, proof-of-concept repositories, and security tools - **StackExchange Search** -- Security community Q&A for technique discussions and vulnerability context - **Hacker News Search** -- Technology community discussions on vulnerabilities and security incidents - **OFAC Sanctions Search** -- Treasury SDN list for threat actor attribution - **OpenSanctions Search** -- Multi-jurisdiction watchlists for attribution and geopolitical context - **Website Change Monitor** -- Security advisory and policy page change detection - **FRED Economic Data** -- Cybersecurity spending and cyber insurance market data ### How the scoring works Each tool implements a distinct mathematical framework applied to the attack graph built from all 15 data sources. **POSG Belief-Space Planning** (Tool 1): HSVI2 point-based value iteration solves the attack-defense interaction as a Partially Observable Stochastic Game on the belief simplex. Alpha-vector pruning maintains tractability on this NEXPTIME-complete problem. **AND-OR A* Exploit Chains** (Tool 2): AND nodes require all prerequisites satisfied; OR nodes need any single one. The CVSS admissible heuristic h(n) = max CVSS on remaining path guarantees optimality. **Hawkes Vulnerability Forecasting** (Tool 3): Self-exciting intensity function with power-law kernel captures long-memory CVE clustering. Thinning simulation forecasts 30-day and 90-day vulnerability counts. **Colonel Blotto Game Theory** (Tool 4): Nash equilibrium via fictitious play on the marginal polytope for asymmetric attacker-defender budget allocation across security domains. **Exp3 Adversary Modeling** (Tool 5): Weight update w_i(t+1) = w_i(t) * exp(eta * r_hat / K) with importance-weighted rewards tracks adversary learning across attack techniques. **Absorbing Markov Lateral Movement** (Tool 6): Fundamental matrix N = (I-Q)^-1 gives expected steps to compromise. Epidemic threshold analysis determines if compromise spreads supercritically through the network. **GPD Zero-Day Tail Risk** (Tool 7): Generalized Pareto Distribution fitted to CVSS exceedances. Returns VaR(95%), VaR(99%), CVaR, and return periods for cyber portfolio risk. **Replicator Dynamics Evolution** (Tool 8): dx_i/dt = x_i(f_i - phi) identifies evolutionary stable strategies resistant to invasion, classifying threat techniques by lifecycle stage. ### How to connect this MCP server #### Claude Desktop Add to your `claude_desktop_config.json`: ```json { "mcpServers": { "autonomous-cyber-red-team": { "url": "https://autonomous-cyber-red-team-mcp.apify.actor/mcp" } } } ```` #### Programmatic (HTTP) ```bash curl -X POST https://autonomous-cyber-red-team-mcp.apify.actor/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_APIFY_TOKEN" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"synthesize_exploit_chains","arguments":{"query":"apache log4j corporate network"}},"id":1}' ``` This MCP server also works with **Cursor**, **Windsurf**, **Cline**, and any other MCP-compatible client. ### Use cases for cyber red team intelligence #### Penetration Testing Automation Use `synthesize_exploit_chains` to identify critical multi-step attack paths through infrastructure. The A\* search guarantees optimal-cost chains, prioritizing remediation efforts. #### Security Budget Optimization Apply `optimize_defender_allocation` to determine Nash equilibrium defense spending across security domains. Identifies dominated strategies and optimal budget distribution. #### Vulnerability Management Forecasting Predict vulnerability disclosure rates with `predict_vulnerability_emergence` to plan patch cycles. The Hawkes process identifies clustering patterns and burst probability for specific technologies. #### Cyber Insurance Pricing Quantify tail risk with `assess_zero_day_tail_risk` using GPD extreme value theory. VaR and CVaR metrics enable actuarial pricing of cyber insurance portfolios. #### Threat Intelligence Strategy Forecast which attack techniques will dominate with `forecast_threat_landscape_evolution`. Replicator dynamics identifies emerging threats before they become prevalent. #### Network Segmentation Validation Validate segmentation effectiveness with `compute_lateral_movement_risk`. The epidemic threshold analysis reveals whether compromise can spread supercritically through the network. ### How much does it cost? This MCP server uses **pay-per-event pricing** at **$0.04 per tool call** with no subscription fees. The **Apify Free plan** includes $5 of monthly platform credits -- enough for **125 tool calls** at no cost. Each tool call runs up to 15 actors in parallel for comprehensive data collection. **Example costs:** - Full POSG attack-defense simulation: $0.04 - Exploit chain synthesis for target network: $0.04 - Complete 8-tool assessment: $0.32 ### How it works 1. Your AI agent calls a tool via MCP (e.g., `synthesize_exploit_chains` with a target query) 2. The server dispatches parallel queries to up to 15 Apify actors (NVD, CISA KEV, Censys, DNS, SSL, WHOIS, etc.) 3. Results are combined into an attack graph with nodes (assets, vulnerabilities) and edges (attack paths) 4. The specified mathematical framework is applied to the attack graph 5. A structured JSON response is returned with quantitative results and graph summary All 15 data sources are queried in parallel. Response time is 60-180 seconds depending on result volume. ### FAQ **Q: Is this active or passive scanning?** A: Entirely passive. The server uses publicly available vulnerability databases, certificate transparency logs, DNS records, and community discussions. No packets are sent to target infrastructure. **Q: What format are results returned in?** A: All tools return structured JSON via the MCP protocol with mathematical outputs (game values, probability distributions, equilibria) alongside graph summaries. **Q: Can this replace a human red team?** A: No. This provides quantitative analysis to augment red team operations. Human judgment is essential for interpreting results and validating attack feasibility. **Q: Is it legal to use this data?** A: This tool accesses only publicly available data from government registries (NVD, CISA) and open databases. See [Apify's guide on web scraping legality](https://blog.apify.com/is-web-scraping-legal/). **Q: How accurate are the vulnerability predictions?** A: The Hawkes process model is calibrated on historical CVE data. Predictions are probabilistic forecasts, not certainties. Accuracy improves with more historical data (use higher maxResults). **Q: Can I run multiple tools on the same target?** A: Yes. Each tool provides a different analytical lens on the same attack surface. Running all 8 tools gives a comprehensive security assessment for $0.32 total. ### Related MCP servers | MCP Server | Focus | |-----------|-------| | [digital-infrastructure-exposure-mcp](https://apify.com/ryanclinton/digital-infrastructure-exposure-mcp) | Passive infrastructure reconnaissance and misconfiguration detection | | [counterparty-due-diligence-mcp](https://apify.com/ryanclinton/counterparty-due-diligence-mcp) | Third-party vendor risk screening | | [adversarial-corporate-opacity-mcp](https://apify.com/ryanclinton/adversarial-corporate-opacity-mcp) | Corporate structure opacity and shell company detection | ### Integrations This MCP server runs on the **Apify platform** and supports: - **Scheduling** -- Set up recurring threat landscape assessments via Apify Schedules - **Webhooks** -- Trigger alerts when vulnerability emergence predictions exceed thresholds - **API access** -- Call tools directly via the Apify API for SIEM/SOAR integration - **Dataset export** -- Export results as JSON for integration with security platforms # Actor input Schema ## Actor input object example ```json {} ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("ryanclinton/autonomous-cyber-red-team-mcp").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("ryanclinton/autonomous-cyber-red-team-mcp").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call ryanclinton/autonomous-cyber-red-team-mcp --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=ryanclinton/autonomous-cyber-red-team-mcp", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Autonomous Cyber Red Team MCP", "description": "Adversarial attack graph simulation with advanced mathematical modeling for AI agents via the Model Context Protocol.", "version": "1.0", "x-build-id": "WoNxgmYFfjHzui3uL" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/ryanclinton~autonomous-cyber-red-team-mcp/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-ryanclinton-autonomous-cyber-red-team-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/ryanclinton~autonomous-cyber-red-team-mcp/runs": { "post": { "operationId": "runs-sync-ryanclinton-autonomous-cyber-red-team-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/ryanclinton~autonomous-cyber-red-team-mcp/run-sync": { "post": { "operationId": "run-sync-ryanclinton-autonomous-cyber-red-team-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": {} }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```