SecOps Field Notes
getlarkwright/secops-field-notes-mcp
CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.
- tools
- 10
- transport
- STDIO
- last updated
- Nov 7, 2026
Tools
10 toolsPublic tool metadata for what this MCP can expose to an agent.
cvss_scoreCVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it
CVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it
No parameter schema in public metadata yet.
extract_iocsEvery IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out
Every IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out
No parameter schema in public metadata yet.
defang_texthxxp[://], [.], [at] and back
hxxp[://], [.], [at] and back
No parameter schema in public metadata yet.
analyze_email_headersThe Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for
The Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for
No parameter schema in public metadata yet.
identify_hashbcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies
bcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies
No parameter schema in public metadata yet.
decode_jwtHeader, payload, times as dates; flags alg:none, expiry, tokens that never expire
Header, payload, times as dates; flags alg:none, expiry, tokens that never expire
No parameter schema in public metadata yet.
convert_timestampEpoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form
Epoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form
No parameter schema in public metadata yet.
decode_layersChain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer
Chain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer
No parameter schema in public metadata yet.
lookup_kevIs this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action
Is this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action
No parameter schema in public metadata yet.
latest_field_noteWhat got exploited this week
What got exploited this week
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageReadme
secops-field-notes-mcp
The things a security analyst does by hand a dozen times a shift, as tools your coding agent can call: score a CVE, pull the indicators out of a report and defang them for the ticket, read a phishing email's headers properly, work out what kind of hash that is, decode a JWT, turn a timestamp into something a human can read, peel a base64-of-hex payload, and check whether a CVE is on CISA's exploited-in-the-wild list.
Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.
Install
Pin the version.
Claude Code
claude mcp add secops-field-notes -- npx -y github:getlarkwright/secops-field-notes-mcp#v0.1.1
Claude Desktop, Cursor, or any client with a JSON config
{
"mcpServers": {
"secops-field-notes": {
"command": "npx",
"args": ["-y", "github:getlarkwright/secops-field-notes-mcp#v0.1.1"]
}
}
}
Docker
{
"mcpServers": {
"secops-field-notes": {
"command": "docker",
"args": ["run", "-i", "--rm", "ghcr.io/getlarkwright/secops-field-notes-mcp:0.1.1"]
}
}
}
Details
- Repository
- github.com/getlarkwright/secops-field-notes-mcp
- Website
- secopsfieldnotes.com
- Category
- Communication & Messaging
- Package
ghcr.io/getlarkwright/secops-field-notes-mcp:0.1.1- Transport
- STDIO
- Registry
- MCP registry, active
