CyberMind-FR
0e0749ed08
New packages: - secubox-threat-analyst: AI-powered threat analysis with CrowdSec integration - luci-app-threat-analyst: LuCI dashboard for threat intelligence - secubox-dns-guard: DNS security monitoring and blocking - secubox-mcp-server: Model Context Protocol server for AI assistant integration Enhancements: - dns-provider: Add DynDNS support (dyndns, get, update, domains commands) - gandi.sh: Full DynDNS with WAN IP detection and record updates - luci-app-dnsguard: Upgrade to v1.1.0 with improved dashboard Infrastructure: - BIND9 DNS setup for secubox.in with CAA records - Wildcard SSL certificates via DNS-01 challenge - HAProxy config fixes for secubox.in subdomains - Mail server setup with Roundcube webmail Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
29 lines
965 B
Plaintext
29 lines
965 B
Plaintext
config mcp-server 'main'
|
|
option enabled '1'
|
|
|
|
# Security: allowed tools (whitelist)
|
|
# Only tools listed here can be invoked via MCP
|
|
list allowed_tool 'crowdsec.alerts'
|
|
list allowed_tool 'crowdsec.decisions'
|
|
list allowed_tool 'waf.logs'
|
|
list allowed_tool 'dns.queries'
|
|
list allowed_tool 'network.flows'
|
|
list allowed_tool 'system.metrics'
|
|
list allowed_tool 'wireguard.status'
|
|
list allowed_tool 'uci.get'
|
|
# Note: uci.set disabled by default for safety
|
|
# list allowed_tool 'uci.set'
|
|
|
|
# AI-powered tools (require LocalAI running)
|
|
list allowed_tool 'ai.analyze_threats'
|
|
list allowed_tool 'ai.cve_lookup'
|
|
list allowed_tool 'ai.suggest_waf_rules'
|
|
list allowed_tool 'ai.explain_ban'
|
|
list allowed_tool 'ai.security_posture'
|
|
|
|
# Data classification for sovereignty compliance
|
|
# local_only: Data never leaves device (default)
|
|
# sanitized: IPs scrubbed before external use
|
|
# cloud_direct: Generic data, safe for cloud AI
|
|
option classification 'local_only'
|