SecOps Field Notes

io.github.labaccessnow

CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.labaccessnow-secops-field-notes-mcp": {4      "command": "docker",5      "args": [6        "run",7        "-i",8        "--rm",9        "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"10      ]11    }12  }13}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

docker run -i --rm ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.labaccessnow-secops-field-notes-mcp -- docker run -i --rm ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.labaccessnow-secops-field-notes-mcp": {4      "command": "docker",5      "args": [6        "run",7        "-i",8        "--rm",9        "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"10      ]11    }12  }13}

claude_desktop_config.json

Local · ociPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.1.0
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install SecOps Field Notes?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does SecOps Field Notes need an API key?

No required environment variable is listed on this record.

What transport does SecOps Field Notes use?

SecOps Field Notes runs locally over stdio.

When was SecOps Field Notes last checked?

Last checked 2026-10-28. CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.

From the publisher

Documentation

secops-field-notes-mcp

The things a security analyst does by hand a dozen times a shift, as tools your coding agent can call: score a CVE, pull the indicators out of a report and defang them for the ticket, read a phishing email's headers properly, work out what kind of hash that is, decode a JWT, turn a timestamp into something a human can read, peel a base64-of-hex payload, and check whether a CVE is on CISA's exploited-in-the-wild list.

Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.

Install

Pin the version.

Claude Code

claude mcp add secops-field-notes -- npx -y github:labaccessnow/secops-field-notes-mcp#v0.1.0

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "npx",
      "args": ["-y", "github:labaccessnow/secops-field-notes-mcp#v0.1.0"]
    }
  }
}

Docker

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"]
    }
  }
}

Node 18 or newer for the npx route. Also in the official MCP registry as io.github.labaccessnow/secops-field-notes-mcp.

Tools

Tool	What it answers	Network
`cvss_score`	CVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it	none
`extract_iocs`	Every IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out	none
`defang_text`	hxxp[://], [.], [at] and back	none
`analyze_email_headers`	The Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for	none
`identify_hash`	bcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies	none
`decode_jwt`	Header, payload, times as dates; flags alg:none, expiry, tokens that never expire	none
`convert_timestamp`	Epoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form	none
`decode_layers`	Chain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer	none
`lookup_kev`	Is this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action	CISA feed, cached 1h
`latest_field_note`	What got exploited this week	RSS

analyze_email_headers

Paste the raw source. It unfolds the headers, reads the Received lines in chronological order (they are stored newest-first), computes the delay at each hop, finds the first public IP in the chain, reads the authentication verdicts, and then says what a triage analyst would say:

From        "IT Helpdesk" <[email protected]>
Reply-To    [email protected]
Auth        SPF pass · DKIM pass · DMARC fail
Origin IP   192.0.2.44

Received chain (origin first, 3 hops):
   1. [10.0.0.5] [192.0.2.44] → relay.example-news.com  2026-09-05 13:59:50Z
   2. relay.example-news.com [198.51.100.9] → mx3.corp.example  2026-09-05 14:00:15Z  +25s
   3. mx3.corp.example [203.0.113.30] → inbox.corp.example  2026-09-05 14:00:20Z  +5s

Warnings:
  ! From domain (corp.example) ≠ Return-Path domain (mailer.example-news.com) …
  ! Reply-To goes to a different domain (evil-mail.example) than From (corp.example) — classic BEC pattern.
  ! DMARC verdict: fail.

cvss_score

The arithmetic is the FIRST specification's, including the Roundup function done in integer arithmetic so floating-point noise never pushes a 4.0 to a 4.1. Log4Shell's vector scores 10.0; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8. Both are in the test suite.

What it does not do

No account, no signup, no key. No telemetry.
Nothing is read from your disk; every input is text you pass in.
No verification of JWT signatures — it decodes, and says so on every result.
One network call in the package: lookup_kev fetches CISA's public catalog (about 1.7 MB) and keeps it for an hour. Everything else never opens a socket.
It does not query VirusTotal, AbuseIPDB or any enrichment service. Those need keys and accounts; this server is for the work you do before and after them.

Licence

MIT. Written by James Son — network, security, and automation engineer. The logic is the same as the free Field Kit desktop app's security tools, so the two stay in step. Corrections welcome.

SecOps Field Notes

io.github.labaccessnow

CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.

Communication Productivity

Add to Cursor Add to VS Code Run on PlugMCP

GitHub Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.labaccessnow-secops-field-notes-mcp": {4      "command": "docker",5      "args": [6        "run",7        "-i",8        "--rm",9        "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"10      ]11    }12  }13}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

docker run -i --rm ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.labaccessnow-secops-field-notes-mcp -- docker run -i --rm ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.labaccessnow-secops-field-notes-mcp": {4      "command": "docker",5      "args": [6        "run",7        "-i",8        "--rm",9        "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"10      ]11    }12  }13}

claude_desktop_config.json

Local · ociPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.1.0
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install SecOps Field Notes?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does SecOps Field Notes need an API key?

No required environment variable is listed on this record.

What transport does SecOps Field Notes use?

SecOps Field Notes runs locally over stdio.

When was SecOps Field Notes last checked?

Last checked 2026-10-28. CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.

From the publisher

Documentation

secops-field-notes-mcp

Free, MIT, no account, no telemetry. Everything except the KEV lookup runs entirely on your machine.

Install

Pin the version.

Claude Code

claude mcp add secops-field-notes -- npx -y github:labaccessnow/secops-field-notes-mcp#v0.1.0

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "npx",
      "args": ["-y", "github:labaccessnow/secops-field-notes-mcp#v0.1.0"]
    }
  }
}

Docker

{
  "mcpServers": {
    "secops-field-notes": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/labaccessnow/secops-field-notes-mcp:0.1.0"]
    }
  }
}

Node 18 or newer for the npx route. Also in the official MCP registry as io.github.labaccessnow/secops-field-notes-mcp.

Tools

Tool	What it answers	Network
`cvss_score`	CVSS 3.1 base score from a vector or the eight metrics, exactly as FIRST computes it	none
`extract_iocs`	Every IP, domain, URL, email, CVE id and hash in a blob of text — refanged on the way in, defanged on the way out	none
`defang_text`	hxxp[://], [.], [at] and back	none
`analyze_email_headers`	The Received chain in order with hop delays, the origin IP, SPF/DKIM/DMARC, and the mismatches phishing triage looks for	none
`identify_hash`	bcrypt, Argon2, yescrypt, Unix crypt, LM:NT, MD5/NTLM, SHA-1/224/256/384/512 — by shape, with what that implies	none
`decode_jwt`	Header, payload, times as dates; flags alg:none, expiry, tokens that never expire	none
`convert_timestamp`	Epoch s/ms/µs, Windows FILETIME, ISO 8601, RFC 2822 — into every form	none
`decode_layers`	Chain base64 / hex / URL / HTML-entity / ROT13 decoding and see each layer	none
`lookup_kev`	Is this CVE exploited in the wild — CISA KEV date added, due date, ransomware use, required action	CISA feed, cached 1h
`latest_field_note`	What got exploited this week	RSS

analyze_email_headers

From        "IT Helpdesk" <[email protected]>
Reply-To    [email protected]
Auth        SPF pass · DKIM pass · DMARC fail
Origin IP   192.0.2.44

Received chain (origin first, 3 hops):
   1. [10.0.0.5] [192.0.2.44] → relay.example-news.com  2026-09-05 13:59:50Z
   2. relay.example-news.com [198.51.100.9] → mx3.corp.example  2026-09-05 14:00:15Z  +25s
   3. mx3.corp.example [203.0.113.30] → inbox.corp.example  2026-09-05 14:00:20Z  +5s

Warnings:
  ! From domain (corp.example) ≠ Return-Path domain (mailer.example-news.com) …
  ! Reply-To goes to a different domain (evil-mail.example) than From (corp.example) — classic BEC pattern.
  ! DMARC verdict: fail.

cvss_score

What it does not do

No account, no signup, no key. No telemetry.
Nothing is read from your disk; every input is text you pass in.
No verification of JWT signatures — it decodes, and says so on every result.
One network call in the package: lookup_kev fetches CISA's public catalog (about 1.7 MB) and keeps it for an hour. Everything else never opens a socket.
It does not query VirusTotal, AbuseIPDB or any enrichment service. Those need keys and accounts; this server is for the work you do before and after them.

Licence

MIT. Written by James Son — network, security, and automation engineer. The logic is the same as the free Field Kit desktop app's security tools, so the two stay in step. Corrections welcome.