container_shell_network_analysis.yaml

# SPDX-FileCopyrightText: GitHub, Inc.
# SPDX-License-Identifier: MIT

seclab-taskflow-agent:
  filetype: toolbox
  version: "1.0"

server_params:
  kind: stdio
  command: python
  args: ["-m", "seclab_taskflows.mcp_servers.container_shell"]
  env:
    CONTAINER_IMAGE: "seclab-shell-network-analysis:latest"
    CONTAINER_WORKSPACE: "{{ env('CONTAINER_WORKSPACE', required=False) }}"
    CONTAINER_TIMEOUT: "{{ env('CONTAINER_TIMEOUT', '30') }}"
    CONTAINER_PERSIST: "{{ env('CONTAINER_PERSIST', required=False) }}"
    CONTAINER_PERSIST_KEY: "{{ env('CONTAINER_PERSIST_KEY', required=False) }}"
    LOG_DIR: "{{ env('LOG_DIR') }}"

confirm:
  - shell_exec

server_prompt: |
  ## Container Shell (network analysis)
  You have access to an isolated Docker container for network analysis and recon.
  Files (e.g. pcap captures) are available at /workspace.

  Available tools:
  - nmap         — network discovery and port scanning
  - tcpdump      — packet capture and inspection
  - tshark       — Wireshark CLI for pcap analysis
  - netcat (nc)  — TCP/UDP connections and simple servers
  - dig / nslookup — DNS lookups
  - curl / wget  — HTTP inspection
  - jq           — JSON parsing and transformation
  - httpie (http) — human-friendly HTTP client