Security tools
for AI agents

Hosted MCP for Claude Code. Recon, scan, and triage — without a local Kali install.

Get started Documentation

claude · aresmcp.com

You

Recon example.com — subdomains, live hosts, then critical/high nuclei.

Claude

Running Ares playbooks over MCP.

playbook_web_recon

completed

domain: "example.com"

→ 47 hosts · 12 live

nuclei_scan

running

target: "https://app.example.com" · profile: critical_high

→ job_8f3a… 62%

Message Claude…

Recon

Give Claude a real attack surface map

One playbook: subdomains → live hosts → tech hints. Structured results Claude can act on, not a raw shell dump.

01Hosted runners — nmap, nuclei, subfinder, httpx, ffuf
02Policy rails — private IPs and cloud metadata blocked
03Playbooks — multi-step recon in one tool call

playbook_web_recon · example.com

subdomains

live

https

interesting

app.example.com200

Next.js · Cloudflare

api.example.com200

Go · nginx

staging.example.com403

nginx

cdn.example.com200

Cloudflare

admin.example.com401

Okta

docs.example.com200

Mintlify

findings · job_8f3a

nuclei_scan

https://app.example.com · critical_high

2 high4 total

Sev	Finding	Host	Path
high	CVE-2024-XXXX	app.example.com	/api/v1/admin
high	Exposed .git	staging.example.com	/.git/config
medium	Missing CSP	www.example.com	/
info	Server header	cdn.example.com	nginx/1.24

Findings

Long scans agents can resume

Heavy tools return a job. Poll status, page findings, pull artifacts — the session doesn't block on a shell.

nuclei_scan → job_8f3a…

job_status → running 62%

get_findings → 2 high · 4 total

Connect

Marketplace install. Google auth.

Install the plugin, then authenticate yourself in /mcp — same OAuth flow as Exa. No API keys, no pre-baked tokens.

01
Install from marketplace
/plugin install ares@ares-mcp
02
Open /mcp → Authenticate
You start the login yourself.
03
Continue with Google
Claude stores and refreshes tokens.

Terminal

$ claude mcp add --transport http ares https://aresmcp.com/mcp \

--header "Authorization: Bearer eyJhbG…"

✓ Connected https://aresmcp.com/mcp

✓ Auth JWT Bearer

✓ Tools 16 ready

→ playbook_web_recon · nuclei_scan · port_scan · http_probe

ares · dashboard

Access token

Google · JWT · 30 days

Copy token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMT… · scope:mcp

User

you@company.com

Endpoint

aresmcp.com/mcp

Surface

Tools

Phase 0. Discoverable via list_capabilities.

Connect guide

Tool	Description
subdomain_enum	Passive-first subdomain discovery
http_probe	Live hosts, titles, tech hints
port_scan	TCP profiles: quick / standard / focused
dir_fuzz	Directory and file discovery (ffuf)
nuclei_scan	Template vulns, critical / high first
dns_lookup	A / AAAA / MX / NS / TXT / CNAME
whois_lookup	Registration data
fetch_url	Headers + body preview in sandbox
playbook_web_recon	Subs → probe → attack surface
playbook_vuln_triage	Light critical / high nuclei pass
get_findings	Paginated structured results
job_status	Progress, errors, completion

Ready when Claude is

Endpoint is live. Create a key and connect Claude Code.

Get started

/plugin install ares@ares-mcp

Endpoint: https://aresmcp.com/mcp
Health: https://aresmcp.com/health
Auth: Bearer · X-API-Key