Systems I built, operated, migrated, and repaired.

TypeScriptMCPMISPSTIXThreat Intel

misp-mcp

Lidless Labs

MCP server for a MISP threat-intel instance: search events and attributes, add and correlate IOCs, attach MITRE ATT&CK galaxy clusters, check warninglists, and export indicators as CSV/STIX/Suricata/Snort/RPZ, with destructive writes fail-closed behind confirm flags.

36 tools · v1.3.6

TypeScriptMCPTheHiveCortexSOAR

thehive-mcp

Lidless Labs

MCP server giving an AI client read-write control of TheHive 5 cases, alerts, tasks, observables, and Cortex analyzer runs over stdio, with delete/merge/promote and the raw Query DSL disabled unless explicit env flags are set.

47 tools · v1.2.3

TypeScriptMCPCortexAnalyzersZod

cortex-mcp

Lidless Labs

MCP server that submits observables to a Cortex instance, auto-detects the data type, fans analysis across applicable analyzers with taxonomy-verdict aggregation, reads job reports, extracts IOC artifacts, and runs responders behind a destructive-op gate.

31 tools · v1.3.3

TypeScriptMCPMITRE ATT&CKSTIXCLI

mitre-mcp

Lidless Labs

MCP server plus an attack CLI that loads official MITRE ATT&CK STIX bundles locally to look up techniques, tactics, groups, and software, map alerts to techniques, score detection coverage against data sources, and export ATT&CK Navigator layers.

39 tools · v2.0.4

TypeScriptMCPSuricataZeekIDS

suricata-mcp

Lidless Labs

MCP server that reads Suricata EVE JSON and Zeek TSV logs off disk to query, aggregate, and timeline alerts, flows, DNS, and TLS, cross-correlate the two sensors, and run local entropy-based DGA, beaconing, exfiltration, and lateral-movement analytics.

41 tools · v2.1.2

TypeScriptMCPZeekThreat HuntingZod

zeek-mcp

Lidless Labs

MCP server that searches Zeek connection, DNS, HTTP, and SSL logs plus Suricata eve.json, pivots one connection UID across every log type, and runs beaconing, Shannon-entropy DGA, and statistical anomaly detection, optionally writing cases to TheHive and MISP.

39 tools · v3.1.2

TypeScriptPythonMCPMaltegoOSINT

maltegoctrl Graph + OSINT

Lidless Labs

Hybrid TypeScript + Python operator control for Maltego Desktop. 13 graph and OSINT tools build .mtgx graphs from entities, links, and IOC expanders and run direct lookups, plus Python TRX transforms that pivot into MISP, TheHive, Cortex, and MITRE.

13 tools · v0.4.3

ongoing 2026.03

Lidless SOC MCP Suite

Lidless Labs

The Lidless Labs security operator line: seven packages that expose the open-source SOC through direct CLIs and MCP adapters, with typed inputs, local-first execution, and explicit write gates.

7 packages · 261 tools

TypeScriptCLIMCPWazuhTheHive

Lidless Labs · Network & Homelab

ongoing 2026.06

librenmsctrl

Lidless Labs

LibreNMS operator control: a read-only CLI plus a confirm-gated MCP adapter over the /api/v0 REST API to list devices, ports, port health, alerts, and events, with three safe writes (ack alert, unmute, set maintenance).

13 tools · CLI + MCP

TypeScriptCLIMCPLibreNMSSNMP

ongoing 2026.06

adguardctrl

Lidless Labs

AdGuard Home operator control (CLI + MCP) covering server status, stats, query log, filter and block lists, user rules, clients, DNS rewrites, SafeSearch and SafeBrowsing, DHCP, and TLS across multiple instances, with three-tier read/confirm/destructive gating.

50 tools · CLI + MCP

TypeScriptCLIMCPAdGuard HomeDNS

TypeScriptMCPCLIProxmox VEKVM/LXC

proxmox-mcp

Lidless Labs

MCP server for a Proxmox VE cluster that inventories VMs, LXC, nodes, and storage, reads RRD metrics, manages snapshots and backups, execs inside guests over SSH/pct, and provisions or destroys resources behind a four-tier write gate that fails closed before any HTTP call.

42 tools · 4-tier gate

TypeScriptCLIMCPImmichCLIP

immichctrl

Lidless Labs

Dual-surface control for a self-hosted Immich photo library: search assets, manage albums, tags, people, and memories, resolve byte and CLIP duplicates with checksum-safe keep strategies, and manage motion-photo stacks, with writes gated behind IMMICH_ALLOW_WRITES.

74 tools · 16 domains

TypeScriptCLIMCPn8nJSON Patch

n8nctrl Workflow Operations

Lidless Labs

40-tool operator control with a direct CLI, MCP adapter, and OpenClaw plugin for a running n8n instance: inspect, validate, diff, and audit workflows, executions, schedules, and webhooks, with gated writes that snapshot before mutation.

40 tools · v0.14.2

TypeScriptCLIMCPJellyfinVitest

jellyctrl Media Server Control

Lidless Labs

56-tool operator control with a direct CLI and MCP adapter for Jellyfin: query libraries, users, sessions, and history; control playback, playlists, and scheduled tasks; and gate destructive operations behind explicit confirmation.

56 tools · v0.4.3

Security & Threat Intel

completed 2026.04

Lazarus Group (APT38) Strategic Assessment

University of South Florida

Strategic threat assessment of the Lazarus Group ecosystem (APT38, BlueNoroff, Diamond Sleet, TraderTraitor) written for a higher-education CISO. ATT&CK-mapped tradecraft, 13-year campaign timeline, illustrative attack path, and a 5-area risk priority matrix for an R1 university environment.

Higher-Ed Strategic Assessment

Threat IntelMITRE ATT&CKICD 203OSINT

ReactFastAPIPythonTypeScriptTailwind

CyberBRIEF Threat Research

Lidless Labs

Source-to-brief threat research workspace with three research depths, BLUF reports, MITRE ATT&CK mapping, IOC extraction, and Chicago-style citations.

BLUF + ATT&CK Reports

React 18TypeScriptFastAPIPythonTanStack

Vervet (formerly Bro Hunter)

Lidless Labs

Self-hosted threat hunting for Zeek and Suricata logs. Deterministic detections roll into per-host risk scores with the evidence chain and MITRE ATT&CK mappings kept visible.

Evidence chains + ATT&CK

React 18TypeScriptZustandVite 7MITRE ATT&CK

Intel Workbench (ACH Analysis)

Lidless Labs

Browser-native Analysis of Competing Hypotheses workbench. Weighted ACH scoring, MITRE ATT&CK tagging (691 techniques vendored locally), Heuer & Pherson bias checklist, ICD 203 estimative-language ribbon. Offline-first SPA, single UI with light/dark mode, zero backend.

ACH + ATT&CK + ICD 203

10 MCP tools + Wazuh ingest

Hotwash (IR Runbook Builder)

Lidless Labs

Executable incident-response runbooks. Markdown and Mermaid become a visual graph, FastAPI tracks live run state, and 10 MCP tools let analysts and agents work from the same evidence and decisions.

React 18TypeScriptReact FlowZustandFastAPI

completed 2025.10

APT44 Cyber Intelligence Assessment

University of South Florida

Intelligence assessment of Russia's Sandworm (GRU Unit 74455). Tracks 2015 Ukraine grid, 2017 NotPetya ($10B+ damages), 2018 Olympic Destroyer, 2022 Viasat, 2023 Kyivstar (24M subscribers).

Sandworm Assessment

Threat IntelMITRE ATT&CKOSINT

completed 2025.10

Water Utility Security Research

University of South Florida

Researched security vulnerabilities in national critical infrastructure. 50,000+ water systems at risk, 70% violating basic cyber requirements. Volt Typhoon, APT44, CyberAv3ngers threat coverage.

Critical Infra Research

ResearchCybersecuritySCADA

Network Visualization

completed 2026.01

PortGrid Network Visualization

Florida state college

Modern web dashboard for visualizing network switch ports, replacing legacy Switchmap with real-time LibreNMS API integration and drag-and-drop device grouping.

Replaced Dead Switchmap

Next.jsReactTanStackTypeScriptLibreNMS API

completed 2025.08

Network Observability Framework

Florida state college

Integrated monitoring stack for L2/L3 topology mapping and infrastructure visibility. Transformed a dark network into fully observed infrastructure across switches, APs, servers, VMs, and firewalls.

Dark Network to Observed

NetdiscoLibreNMSSNMPPostgreSQL

Infrastructure & Migrations

completed 2026.01

Samba AD File Server

Florida state college

Ubuntu 24.04 Samba file server with AD integration, SMB3 hardening (mandatory signing, encryption desired), SNMP v2c monitoring, audit logging, and a one-liner Bash deploy.

SMB3 Hardened

UbuntuSambaActive DirectorySNMPXFS

ongoing 2025.11

Proxmox Homelab

Personal Infrastructure

Multi-hypervisor home stack across Proxmox VE and a Hyper-V satellite. Redundant AdGuard DNS with AdGuard Sync, Immich photo backup on NAS-mounted storage, a self-hosted SOC stack (Wazuh, TheHive, Cortex, MISP), and a content pipeline running n8n + Postiz for cross-network publishing.

Multi-hypervisor SOC · n8n + Postiz

Proxmox VEHyper-VAdGuardImmichWazuh

Developer Tools & AI