Back to MCP Trust Indexm8ven
74
/ 100
14 days ago
glama

CyberSim Pro MCP Server

Enables cybersecurity training, purple-team collaboration, and executive readiness through tools for scenario generation, attack simulation, telemetry analysis, incident investigation, forensics, and reporting with an immutable audit trail.

→ kayembahamid/cybersim-pro· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 6 credentials: CYBERSIM_API_KEY, CYBERSIM_APPROVAL_TOKEN, CYBERSIM_AUDIT_HMAC_KEY, CYBERSIM_AUDIT_SEAL_KEY, CYBERSIM_AUDIT_VALIDATION_HMAC_KEY, CYBERSIM_SCIM_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@0.5.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretCYBERSIM_API_KEY— require Authorization: Bearer <key> header
🔐 secretCYBERSIM_APPROVAL_TOKEN— shared secret required for restricted tools (simulate_attack, stop_simulation, replay_telemetry)
configCYBERSIM_AUDIT_CHAIN_ID— Enable hash-chained logging by setting CYBERSIM_AUDIT_HMAC_KEY (optionally supply for multi-tenant tracking).
🔐 secretCYBERSIM_AUDIT_HMAC_KEY— Enable hash-chained logging by setting (optionally supply CYBERSIM_AUDIT_CHAIN_ID for multi-tenant tracking).
configCYBERSIM_AUDIT_HMAC_KEY_ENCODING
configCYBERSIM_AUDIT_HMAC_KEY_ID
configCYBERSIM_AUDIT_LOG_DIR— Every tool invocation is appended to logs/audit.log (configurable via ) and chained with SHA-256 hashes plus optional HMAC signatures (CYBERSIM_AUDIT_HMAC_KEY, CYBERSIM_AUDIT_CHAIN_ID).
🔐 secretCYBERSIM_AUDIT_SEAL_KEY— Use (or reuse the HMAC key) to sign exported seals; set _ENCODING=base64 when providing base64 secrets.
configCYBERSIM_AUDIT_SEAL_KEY_ENCODING
configCYBERSIM_AUDIT_SEAL_KEY_ID
🔐 secretCYBERSIM_AUDIT_VALIDATION_HMAC_KEY
configCYBERSIM_AUDIT_VALIDATION_HMAC_KEY_ENCODING
configCYBERSIM_IP_ALLOW— comma-separated list (127.0.0.1,::1,local,203.0.113.10)
configCYBERSIM_RBAC_CONFIG— optional path to a JSON role policy (see [Role-Based Access & Approvals](#role-based-access--approvals))
🔐 secretCYBERSIM_SCIM_TOKEN— SCIM v2 endpoints (/api/scim/v2/Users, /api/scim/v2/Groups) require identity.scim.bearerToken or ; weekly audit seal workflow captures provisioning evidence.
configPORT
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kayembahamid-cybersim-pro-znh5di)](https://m8ven.ai/mcp/kayembahamid-cybersim-pro-znh5di)
commit: 1a86105aa9100a06c365b2b569106d808b792a87
code hash: ce2cc6f5230cb67c376e9a28b2df0ca22aaa6fa309611e44955321de5207f7fb
verified: 7/17/2026, 8:35:37 AM
view raw JSON →