Security Audit

Inputs

Workflow

1. Bootstrap

• •persona_load("devops") — nmap, openssl, curl, ssh tools
• •check_known_issues("nmap", ""), check_known_issues("openssl", "")

2. Port Scanning

• •nmap_quick_scan(target="{target}") — open ports
• •nmap_service_scan(target="{target}") — service/version detection
• •If full_scan: nmap_scan(target="{target}")
• •nmap_vuln_scan(target="{target}") — vulnerability scripts
• •nmap_script(target="{target}") — default scripts

3. TLS/SSL Checks (if check_certs)

• •openssl_s_client(host="{target}") — TLS connection
• •openssl_s_client_cert(host="{target}") — certificate details
• •openssl_x509_info(host="{target}") — X.509 info
• •openssl_x509_verify(host="{target}") — chain verification
• •openssl_ciphers(host="{target}") — cipher suites

4. HTTP Security Headers

• •curl_headers(url="https://{target}")
• •curl_timing(url="https://{target}")
• •Check for: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection

5. SSH Host Keys

• •ssh_keyscan(host="{target}")

6. Report

• •Open ports count and list
• •Vulnerability scan output
• •TLS: version, cert valid, expiry, weak ciphers
• •Missing security headers
• •SSH host key fingerprint
• •Log: memory_session_log("Security audit on {target}", "ports={n}, full_scan={bool}")

7. Failure Learning

• •No route to host → learn_tool_fix("nmap_quick_scan", "no route to host", "Target unreachable", "Run vpn_connect() or verify hostname")
• •Connection refused → learn_tool_fix("openssl_s_client", "connection refused", "TLS port not open", "Verify port 443")

Key MCP Tools

• •persona_load, nmap_quick_scan, nmap_service_scan, nmap_scan, nmap_vuln_scan, nmap_script
• •openssl_s_client, openssl_s_client_cert, openssl_x509_info, openssl_x509_verify, openssl_ciphers
• •curl_headers, curl_timing, ssh_keyscan
• •check_known_issues, learn_tool_fix, memory_session_log

Validates

• •cert_check