secops-field-notes-mcp
The things a security analyst does by hand a dozen times a shift, as tools your coding agent can call: score a CVE, pull the indicators out of a report and defang them for the ticket, read a phishing email's headers properly, work out what kind of hash that is, decode a JWT, turn a timestamp into something a human can read, peel a base64-of-hex payload, and check whether a CVE is on CISA's exploited-in-the-wild list.
Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.
Install
Pin the version.
Claude Code
claude mcp add secops-field-notes -- npx -y github:labaccessnow/secops-field-notes-mcp#v0.1.0
Claude Desktop, Cursor, or any client with a JSON config
{
"mcpServers": {
"secops-field-notes": {
"command": "npx",
"args": ["-y", "github:labaccessnow/secops-field-notes-mcp#v0.1.0"]
}
}
}
Docker
{
"mcpServers": {
"secops-field-notes": {
"command": "docker",
"args": ["run", "-i", "--rm", "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"]
}
}
}
Node 18 or newer for the npx route. Also in the official MCP registry as
io.github.labaccessnow/secops-field-notes-mcp.
Tools
analyze_email_headers
Paste the raw source. It unfolds the headers, reads the Received lines in chronological order
(they are stored newest-first), computes the delay at each hop, finds the first public IP in the
chain, reads the authentication verdicts, and then says what a triage analyst would say:
From "IT Helpdesk" <[email protected]>
Reply-To [email protected]
Auth SPF pass · DKIM pass · DMARC fail
Origin IP 192.0.2.44
Received chain (origin first, 3 hops):
1. [10.0.0.5] [192.0.2.44] → relay.example-news.com 2026-09-05 13:59:50Z
2. relay.example-news.com [198.51.100.9] → mx3.corp.example 2026-09-05 14:00:15Z +25s
3. mx3.corp.example [203.0.113.30] → inbox.corp.example 2026-09-05 14:00:20Z +5s
Warnings:
! From domain (corp.example) ≠ Return-Path domain (mailer.example-news.com) …
! Reply-To goes to a different domain (evil-mail.example) than From (corp.example) — classic BEC pattern.
! DMARC verdict: fail.
cvss_score
The arithmetic is the FIRST specification's, including the Roundup function done in integer
arithmetic so floating-point noise never pushes a 4.0 to a 4.1. Log4Shell's vector scores 10.0;
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8. Both are in the test suite.
What it does not do
- No account, no signup, no key. No telemetry.
- Nothing is read from your disk; every input is text you pass in.
- No verification of JWT signatures — it decodes, and says so on every result.
- One network call in the package:
lookup_kevfetches CISA's public catalog (about 1.7 MB) and keeps it for an hour. Everything else never opens a socket. - It does not query VirusTotal, AbuseIPDB or any enrichment service. Those need keys and accounts; this server is for the work you do before and after them.
Licence
MIT. Written by James Son — network, security, and automation engineer. The logic is the same as the free Field Kit desktop app's security tools, so the two stay in step. Corrections welcome.