# Defense MCP server

Agent View of the PolicyLayer registry record for Defense: identity, probed posture, risk grade, and all 31 tools classified. HTML page: https://policylayer.com/tools/defense

## Facts

- Server id: `defense-mcp-server`
- Install: `npx -y defense-mcp-server`
- Homepage: git+https://github.com/bottobot/defense-mcp-server.git
- Registry record: grade F, identity unverified
- Lifecycle: active
- Rate-limited: no
- Tools: 31 (31 with introspected schema)
- Tool categories present: Destructive, Execute, Read, Write
- Context-window cost: 11976 tokens per request — https://policylayer.com/token-cost/defense
- Tags: defense, admin, automation
- Record last modified: 2026-08-05T00:55:59.944Z

## Tools (31)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `app_harden` | Execute | High | https://policylayer.com/tools/defense/app-harden.md |
| `container_isolation` | Execute | High | https://policylayer.com/tools/defense/container-isolation.md |
| `crypto` | Execute | High | https://policylayer.com/tools/defense/crypto.md |
| `ebpf` | Execute | High | https://policylayer.com/tools/defense/ebpf.md |
| `firewall` | Execute | High | https://policylayer.com/tools/defense/firewall.md |
| `harden_kernel` | Execute | High | https://policylayer.com/tools/defense/harden-kernel.md |
| `honeypot_manage` | Execute | High | https://policylayer.com/tools/defense/honeypot-manage.md |
| `incident_response` | Execute | High | https://policylayer.com/tools/defense/incident-response.md |
| `malware` | Execute | High | https://policylayer.com/tools/defense/malware.md |
| `sudo_session` | Execute | High | https://policylayer.com/tools/defense/sudo-session.md |
| `vuln_manage` | Execute | High | https://policylayer.com/tools/defense/vuln-manage.md |
| `waf_manage` | Execute | High | https://policylayer.com/tools/defense/waf-manage.md |
| `wireless_security` | Execute | High | https://policylayer.com/tools/defense/wireless-security.md |
| `zero_trust` | Execute | High | https://policylayer.com/tools/defense/zero-trust.md |
| `api_security` | Read | Low | https://policylayer.com/tools/defense/api-security.md |
| `cloud_security` | Read | Low | https://policylayer.com/tools/defense/cloud-security.md |
| `dns_security` | Read | Low | https://policylayer.com/tools/defense/dns-security.md |
| `secrets` | Read | Low | https://policylayer.com/tools/defense/secrets.md |
| `access_control` | Write | Medium | https://policylayer.com/tools/defense/access-control.md |
| `backup` | Write | Medium | https://policylayer.com/tools/defense/backup.md |
| `compliance` | Write | Medium | https://policylayer.com/tools/defense/compliance.md |
| `container_docker` | Write | Medium | https://policylayer.com/tools/defense/container-docker.md |
| `defense_mgmt` | Write | Medium | https://policylayer.com/tools/defense/defense-mgmt.md |
| `harden_host` | Write | Medium | https://policylayer.com/tools/defense/harden-host.md |
| `integrity` | Write | Medium | https://policylayer.com/tools/defense/integrity.md |
| `log_management` | Write | Medium | https://policylayer.com/tools/defense/log-management.md |
| `network_defense` | Write | Medium | https://policylayer.com/tools/defense/network-defense.md |
| `patch` | Write | Medium | https://policylayer.com/tools/defense/patch.md |
| `process_security` | Write | Medium | https://policylayer.com/tools/defense/process-security.md |
| `supply_chain` | Write | Medium | https://policylayer.com/tools/defense/supply-chain.md |
| `threat_intel` | Write | Medium | https://policylayer.com/tools/defense/threat-intel.md |

## Tool descriptions

- `app_harden` — App hardening: audit running apps, recommendations, firewall rules, systemd sandboxing
- `container_isolation` — Container isolation: AppArmor, SELinux, namespaces, seccomp, rootless setup
- `crypto` — Crypto: TLS/SSL audit, GPG, LUKS, file hashing, certificate lifecycle
- `ebpf` — eBPF/Falco: list eBPF programs, Falco status, deploy rules, read events
- `firewall` — Firewall: iptables, UFW, nftables, persistence, policy audit
- `harden_kernel` — Kernel hardening: sysctl, kernel security, bootloader, memory protections
- `honeypot_manage` — Deception: canary tokens, honeyport listeners, trigger detection, canary management
- `incident_response` — Incident response: volatile data, IOC scan, timeline, forensics (memory/disk/network/evidence/custody)
- `malware` — Malware: ClamAV scan/update, YARA rules, suspicious files, webshells, quarantine
- `sudo_session` — Sudo: elevate privileges, check/drop/extend session, preflight tool checks
- `vuln_manage` — Vulnerabilities: nmap scan, nikto web scan, tracking, risk prioritization, remediation plans
- `waf_manage` — WAF: ModSecurity audit, rule management, rate limiting, OWASP CRS, blocked request analysis
- `wireless_security` — Wireless: Bluetooth audit, WiFi assessment, rogue AP detection, disable unused interfaces
- `zero_trust` — Zero-trust: WireGuard VPN, peer management, mTLS certificates, microsegmentation
- `api_security` — API security: local API discovery, auth audit, rate limiting, TLS verify, CORS check
- `cloud_security` — Cloud: environment detection, metadata audit, IAM credentials, storage audit, IMDS security
- `dns_security` — DNS: resolver audit, DNSSEC check, tunneling detection, domain blocklists, query log audit
- `secrets` — Secrets: filesystem scan, env variable audit, SSH key sprawl, git history leak detection
- `access_control` — Access control: SSH, PAM, sudo, user audit, password policy, shell restriction
- `backup` — Backup: config files, system state snapshots, restore, verify integrity, list backups
- `compliance` — Compliance: Lynis, OpenSCAP, CIS benchmarks, framework checks, policy, cron/tmp hardening
- `container_docker` — Docker security: audit, CIS bench, seccomp, daemon config, image scan
- `defense_mgmt` — Defense: tool checks, workflows, change history, posture, scheduled audits, remediation, reports
- `harden_host` — Host hardening: services, permissions, systemd, cron, umask, banners, USB control
- `integrity` — Integrity: AIDE, rootkit scanning, file hashing, drift baselines
- `log_management` — Logging: auditd, journalctl, fail2ban, syslog, log rotation, SIEM integration
- `network_defense` — Network: connections, traffic capture, port scan detection, IPv6 audit, self-scan, segmentation
- `patch` — Patches: pending updates, unattended upgrades, package integrity, kernel audit, CVE lookup
- `process_security` — Processes: audit running, capabilities, namespaces, anomaly detection, cgroup limits
- `supply_chain` — Supply chain: SBOM generation, cosign artifact signing, SLSA provenance verification
- `threat_intel` — Threat intel: IP/hash/domain reputation, feed management, blocklist application

## Related servers

- UnClick (1662 tools) — https://policylayer.com/tools/io-github-malamutemayhem-unclick-mcp-server.md
- Delx Mcp A2a (1076 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-a2a.md
- Delx Protocol — Agent Recovery & Continuity (1076 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-protocol.md
- Nodebench (824 tools) — https://policylayer.com/tools/io-github-homenshum-nodebench.md
- MCP Framework Personal (790 tools) — https://policylayer.com/tools/inggerman-mcps.md
- Delx MCP Server (740 tools) — https://policylayer.com/tools/io-github-davidmosiah-delx-mcp-server.md
- Binance MCP Server (734 tools) — https://policylayer.com/tools/nirholas-binance-mcp.md
- Eda Agent (726 tools) — https://policylayer.com/tools/eda-agent.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=defense · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/defense