SecureAnnex MCP Server

---

SecureAnnex MCP 服务

用于分析浏览器扩展安全性的模型上下文协议（MCP）服务。此服务提供用于查询、分析和评估浏览器扩展安全性的工具，包括漏洞检测、签名检查、代码审查等。

快速设置

无需手动设置 Python 环境。此 MCP 服务专为配合 Claude Desktop 使用而设计，Claude Desktop 会使用 uv 包管理器和随附的 pyproject.toml 文件自动处理所有依赖项。

开始使用：

1. 下载或克隆此仓库
2. 确保项目目录中包含 pyproject.toml 文件
3. 按照下文所示配置 Claude Desktop
4. 可选：如果 Claude 找不到 uv 命令，请改用绝对路径。你可以在终端中运行 which uv 来查找绝对路径。

Claude Desktop 配置

编辑 ~/Library/Application Support/Claude/claude_desktop_config.json：

{
  "mcpServers": {
    "secureannex": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/secure-annex-mcp",
        "run",
        "secure_annex_mcp"
      ],
      "env": {
        "SECUREANNEX_API_KEY": "your_api_key_here"
      }
    }
  }
}

注意：将 /path/to/secure-annex-mcp 替换为 SecureAnnex MCP 服务目录的绝对路径。

项目结构

secure-annex-mcp/
├── pyproject.toml         # Package configuration
├── README.md              # Project documentation
└── secure_annex_mcp/      # Main package
    ├── __init__.py        # Package initialization
    ├── __main__.py        # Entry point when run as a module
    └── server.py          # MCP server implementation

可用工具

扩展搜索与信息

• search_extensions：根据各种条件搜索浏览器扩展

  • 参数：name、extension_id、owner、featured、active、page、page_size

• get_extension_details：获取特定扩展的详细信息

  • 参数：extension_id（必填）

• get_extension_versions：获取特定扩展的版本历史

  • 参数：extension_id（必填）、version

安全分析

• get_extension_vulnerabilities：获取特定扩展的安全漏洞

  • 参数：extension_id（必填）、version

• get_extension_signatures：获取特定扩展的安全签名

  • 参数：extension_id（必填）、version、rule

• get_extension_urls：获取特定扩展使用的网络 URL

  • 参数：extension_id（必填）、version、domain

• get_extension_manifest_risks：获取特定扩展的清单权限风险

  • 参数：extension_id（必填）、version、risk_type

• get_extension_analysis：获取特定扩展的 AI 安全分析

  • 参数：extension_id（必填）

• get_extension_code_review：获取特定扩展的代码安全审查

  • 参数：extension_id（必填）、version

用户反馈

• get_extension_reviews：获取特定扩展的用户评价
  • 参数：extension_id（必填）、rating

更新

• get_recent_updates：获取最近更新的扩展
  • 参数：无

使用示例

以下是一些使用 Claude 调用这些工具的实用示例：

搜索扩展

# Get all extensions developed by specific developer
I need to find all extensions by [email protected]

# Claude would use:
{
  "name": "search_extensions",
  "arguments": {
    "owner": "[email protected]"
  }
}

安全分析

# Get all security signatures for an extension
Show me all security signatures for the AdBlock extension

# Claude would use:
{
  "name": "get_extension_signatures",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

# Extract all network domains from an extension
Extract all domains embedded in the AdBlock extension

# Claude would use:
{
  "name": "get_extension_urls",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

# Analyze manifest permissions
Show me a table of all permissions requested by AdBlock with explanations

# Claude would use:
{
  "name": "get_extension_manifest_risks",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

与其他 MCP 集成

# Leveraging VirusTotal MCP for domain reputation
Can you extract all domains from the AdBlock extension and check their reputation on VirusTotal?

# Claude would use both SecureAnnex and VirusTotal MCPs:
# 1. First, get domains from SecureAnnex
{
  "name": "get_extension_urls",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

# 2. Then for each domain, check VirusTotal
{
  "name": "domain_report",  // VirusTotal MCP tool
  "arguments": {
    "domain": "example.com"  // For each domain found
  }
}

# 3. Claude would compile results into a table:
| Domain | Reputation | Detection Ratio | Categories |
|--------|------------|-----------------|------------|
| domain1.com | Clean | 0/85 | Advertising |
| domain2.com | Suspicious | 3/85 | Marketing |

综合分析

# Request a complete security review of an extension
Perform a full security audit of the AdBlock extension

# Claude would combine multiple tools:
{
  "name": "get_extension_details",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

{
  "name": "get_extension_vulnerabilities",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

{
  "name": "get_extension_analysis",
  "arguments": {
    "extension_id": "gighmmpiobklfepjocnamgkkbiglidom"
  }
}

API 密钥

SecureAnnex MCP 服务需要 API 密钥才能通过身份验证访问 SecureAnnex API。请从 SecureAnnex 服务获取 API 密钥，并按照上文所示将其添加到 Claude Desktop 配置中。

故障排除

如果遇到任何问题：

1. 确保已在环境变量中正确设置 API 密钥
2. 确认 Claude Desktop 配置中的路径正确