Skip to content

feat: integrate CyberSleuth MCP as native Recon skill tooling#1292

Open
Mar8x wants to merge 1 commit into
danielmiessler:mainfrom
Mar8x:feat/cybersleuth-recon-integration
Open

feat: integrate CyberSleuth MCP as native Recon skill tooling#1292
Mar8x wants to merge 1 commit into
danielmiessler:mainfrom
Mar8x:feat/cybersleuth-recon-integration

Conversation

@Mar8x
Copy link
Copy Markdown

@Mar8x Mar8x commented May 19, 2026

Summary

  • Replaces the "Future Tool Integration" placeholder in `Recon/SKILL.md` with actual CyberSleuth MCP wiring — Shodan, VirusTotal, URLScan, BuiltWith, WHOIS, DNS, certificate transparency, favicon hashing, and AS intelligence as native MCP tools
  • Adds `Recon/Workflows/CyberSleutRecon.md`: 10-phase MCP-native recon workflow, preferred over shell-based DomainRecon when CyberSleuth is active
  • No existing workflows modified — purely additive

Why

The Recon skill's SKILL.md already listed Shodan, VirusTotal, Censys, and SecurityTrails under "Future Tool Integration (when API key added)". CyberSleuth implements exactly those capabilities as a ready-to-install MCP server.

Test plan

  • Install CyberSleuth MCP (see SKILL.md setup instructions)
  • Trigger Recon skill on a domain — confirm CyberSleutRecon.md is selected when MCP is active
  • Verify all 10 phases complete and report generates cleanly
  • Confirm fallback to DomainRecon.md when CyberSleuth is not active

CyberSleuth repo: https://github.com/Mar8x/cybersleuth

🤖 Generated with Claude Code

Replace the 'Future Tool Integration' placeholder in Recon/SKILL.md with
actual CyberSleuth MCP wiring. CyberSleuth provides Shodan, VirusTotal,
URLScan, BuiltWith, WHOIS, DNS, certificate transparency, favicon hashing,
and AS intelligence as native MCP tools — filling the exact gaps already
identified in the skill.

- Update Recon/SKILL.md: replace Future Tool Integration section with
  CyberSleuth MCP tool table, installation instructions, and mcpServers
  config snippet; add CyberSleutRecon.md to the workflow list
- Add Recon/Workflows/CyberSleutRecon.md: 10-phase MCP-native recon
  workflow covering WHOIS, DNS, CT logs, AS intelligence, VirusTotal,
  URLScan, Shodan, BuiltWith, M365 discovery, and synthesis; preferred
  over shell-based DomainRecon when CyberSleuth is active

CyberSleuth repo: https://github.com/Mar8x/cybersleuth
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant