Jcyber

# Jcyber

[](https://github.com/undeemed/Jcyber/actions/workflows/ci.yml)
[](LICENSE)
[](https://www.python.org/downloads/)

**MCP toolkit for agent-driven pentesting.** The agent harness (Claude Code,
or any MCP-capable LLM) is the reasoning loop. Jcyber provides scope-gated
scanning tools, an evidence graph, a finding lifecycle, and long-term memory
through an MCP server.

## How it works

```
Agent Harness (Claude Code / any MCP client)
    |
    | MCP protocol (stdio)
    v
Jcyber MCP Server ---- scope gate (pre-hook, every call)
    |          |            |             |
    v          v            v             v
HexStrike  Memgraph    TencentDB      Caido
(:8888)    (:7687)     (memory)       (:8889)
    |                                    |
    +----------> Target <----------------+
```

The agent decides what to scan, when to create hypotheses, and when to
promote findings. Jcyber enforces safety in code: the scope gate runs
before every tool call, exploit tools require operator confirmation, and all
evidence is normalized into the engagement graph.

## The systems

| Component | Role |
|-----------|------|
| HexStrike | Hands - 150+ security scanning tools via REST |
| Memgraph | Session brain - engagement graph (evidence, hypotheses, findings) |
| TencentDB | Long-term memory - cross-engagement recall and learning |
| Caido | Traffic substrate - proxy, request logging, passive plugins |

## MCP tools (52 total)

- **42 HexStrike scanning tools** - `nmap_scan`, `nuclei_scan`, `sqlmap_scan`, `ffuf_scan`, `httpx_probe`, etc. Each scope-gated.
- **Graph tools** - `create_hypothesis`, `promote_finding`, `score_finding`, `retire_hypothesis`
- **Engagement tools** - `intake_target`, `get_state`, `render_findings_report`, `get_decision_trace`
- **Memory tools** - `