Content
# Hospital Vulnerability Scanner MCP Server
[](https://pypi.org/project/hospital-vuln-mcp)
[](https://pypi.org/project/hospital-vuln-mcp)
[](https://github.com/12211725-star/hospital-vuln-mcp/blob/main/LICENSE)
English |
Hospital Vulnerability Scanner MCP Server, providing real security scanning capabilities for medical information systems. Supports 14 tools including port scanning, vulnerability detection, medical system identification, and compliance report generation.
## ✨ Features
- 🔍 **Real Vulnerability Scanning** — Supports quick/standard/deep three modes, automatically calling nmap/nuclei or Python fallback
- 🏥 **Medical System Identification** — Automatically identifies HIS/PACS/LIS/RIS/EMR and other medical information systems
- 🌐 **Network Discovery** — Network asset discovery and port scanning
- 📊 **Report Generation** — Supports PDF/HTML/JSON/CSV format reports
- 🔐 **Compliance Check** — Meets the requirements of equal protection 2.0
- ⚡ **Zero-Dependency Operation** — No need to install nmap/nuclei, Python native scanning can also be used
## 🚀 Quick Start
### 1. Installation
```bash
# Using uvx (recommended)
uvx hospital-vuln-mcp
# Or using pip
pip install hospital-vuln-mcp
```
### 2. Integrate into MCP Client
Add the following to the MCP client configuration file:
```json
{
"mcpServers": {
"hospital-vuln-mcp": {
"command": "uvx",
"args": ["hospital-vuln-mcp"],
"env": {
"HOSPITAL_VULN_MCP_LOG_LEVEL": "INFO"
}
}
}
}
```
### Docker Way
```json
{
"mcpServers": {
"hospital-vuln-mcp": {
"command": "docker",
"args": ["run", "--rm", "-i", "hospital-vuln-mcp"],
"env": {
"HOSPITAL_VULN_MCP_LOG_LEVEL": "INFO"
}
}
}
}
```
### Streamable HTTP Remote Deployment
```bash
hospital-vuln-mcp --transport http --host 0.0.0.0 --port 8000
```
### 3. Optional: Install Scanning Engine Enhancement
```bash
# Install nmap (port scanning enhancement)
# macOS
brew install nmap
# Ubuntu/Debian
sudo apt install nmap
# Windows
choco install nmap
# Install nuclei (vulnerability scanning enhancement)
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```
> 💡 **Tip**: Even without installation, it can be used, and it will automatically downgrade to Python native scanning.
## 📖 Usage
### Basic Scanning
In Claude / Cursor / other MCP clients:
```
Please help me scan the server at 192.168.1.100
```
AI will call the `start_scan` tool and return:
```json
{
"task_id": "abc123",
"status": "completed",
"open_ports": [
{"port": 22, "service": "SSH"},
{"port": 3306, "service": "MySQL"},
{"port": 8080, "service": "HTTP-Alt"}
],
"vulnerabilities": [
{"title": "MySQL Service Exposure", "severity": "medium"}
]
}
```
### Specify Scanning Type
```
Perform a deep scan on 10.0.0.50
```
```
Quick scan www.example.com
```
### Port Scanning
```
Scan ports 22, 80, 443, 3306 on 192.168.1.1
```
### Medical System Identification
```
Identify the medical system type running on 192.168.1.100
```
### Network Discovery
```
Discover active hosts in the 192.168.1.0/24 network segment
```
## 🎯 Prompt Word Guide
### Security Assessment Scenario
```
I need to perform a security assessment on a newly launched HIS system,
the target IP is 192.168.1.200, please help me perform a standard scan and generate a report.
```
### Regular Inspection Scenario
```
Please help me inspect the security status of medical systems in the 10.0.0.0/24 network segment.
```
### Compliance Check Scenario
```
I need to prepare a security scanning report for the compliance assessment,
please perform a deep scan on the target system and export a compliance report.
```
### Emergency Response Scenario
```
It is found that 192.168.1.50 may have security risks,
please perform a quick scan to help me troubleshoot the problem.
```
### Asset Inventory Scenario
```
Help me inventory all medical information systems in the hospital network,
identify system types and open ports.
```
## 🛠️ Tool List
### Scan Management
| Tool | Description | Parameters |
|------|-------------|-------------|
| `start_scan` | Start vulnerability scanning | `target`: IP/domain/URL, `scan_type`: quick/standard/deep |
| `get_scan_status` | Query scan status | `task_id`: task ID |
| `list_scans` | List scan history | `limit`: quantity, `status`: status filter |
| `cancel_scan` | Cancel scan | `task_id`: task ID |
### Vulnerability Management
| Tool | Description | Parameters |
|------|-------------|-------------|
| `list_vulnerabilities` | List vulnerabilities | `severity`: severity, `status`: status |
| `get_vulnerability` | Get vulnerability details | `vuln_id`: vulnerability ID |
| `update_vulnerability_status` | Update vulnerability status | `vuln_id`, `status`, `comment` |
### Network Tools
| Tool | Description | Parameters |
|------|-------------|-------------|
| `discover_network` | Network discovery | `cidr`: network segment |
| `scan_host_ports` | Port scanning | `host`: host, `ports`: port list (optional) |
| `identify_medical_systems` | Medical system identification | `target`: target, `ports`: port list (optional) |
### Report Tools
| Tool | Description | Parameters |
|------|-------------|-------------|
| `generate_report` | Generate report | `scan_id`, `report_type`, `format` |
| `list_reports` | List reports | `limit`: quantity |
### System Tools
| Tool | Description |
|------|-------------|
| `get_vuln_stats` | Vulnerability statistics and analysis |
| `get_system_status` | System status (including nmap/nuclei availability) |
## ⚙️ Scanning Engine
### Automatic Detection Mechanism
```
start_scan()
│
├── Detect nmap → If available, use for port scanning
│ └── If not available → Python socket multi-threaded scanning
│
├── Detect nuclei → If available, use for vulnerability scanning
│ └── If not available → Built-in rule detection of common vulnerabilities
│
└── Return results
```
### Built-in Vulnerability Detection Rules
Even without nuclei, it can detect the following common risks:
| Risk Type | Severity | Detection Conditions |
|-----------|----------|-----------------------|
| MySQL Service Exposure | Medium | 3306 port open |
| Redis Unauthorized Access | High | 6379 port open |
| MongoDB Unauthorized Access | High | 27017 port open |
| RDP Remote Desktop Exposure | High | 3389 port open |
| SMBv1 Protocol Risk | High | 445 port open |
| PHPInfo Information Disclosure | Medium | HTTP response contains phpinfo |
| Directory Traversal Risk | Medium | HTTP response contains "Index of" |
### Medical System Fingerprint Identification
Identifies through HTTP Banner and page features:
| System Type | Keywords |
|-------------|----------|
| HIS | Hospital Information System, outpatient, inpatient, registration, prescription |
| PACS | Image, DICOM, radiation, PACS |
| LIS | Inspection, laboratory, biochemical, immune |
| RIS | Radiation Information System, imaging diagnosis |
| EMR | Electronic medical record, medical record |
## 📖 Environment Variables
| Variable | Description | Default Value |
|----------|-------------|---------------|
| `HOSPITAL_VULN_MCP_LOG_LEVEL` | Log level | `INFO` |
| `HOSPITAL_VULN_MCP_SCAN_TIMEOUT` | Scan timeout (seconds) | `300` |
| `HOSPITAL_VULN_MCP_MAX_CONCURRENT_SCANS` | Maximum concurrent scans | `10` |
## 🔧 Development
```bash
git clone https://github.com/12211725-star/hospital-vuln-mcp.git
cd hospital-vuln-mcp
pip install -e ".[dev]"
# Run tests
pytest
# Run locally
python -m hospital_vuln_mcp
```
## 📋 Changelog
### v1.2.0 (2026-04-23)
- 🔧 **API Improvement**: `scan_host_ports` parameter `ports` changed from string to array
- 🔧 **API Improvement**: `identify_medical_systems` added optional `ports` parameter
- 🐛 Fixed AI assistant call parameter name mismatch causing verification error
### v1.1.9 (2026-04-22)
- 🐛 **Critical Fix**: nmap/nuclei path detection changed to delayed detection (detected during each scan)
### v1.1.8 (2026-04-22)
- 🐛 Fixed nmap/nuclei path detection, added multi-path search
### v1.1.7 (2026-04-22)
- 🔧 Aligned with MCP development specifications
- 📝 Added `.env.example` file
### v1.1.6 (2026-04-22)
- 🐛 Changed back to stdio protocol (consistent with official MCP)
### v1.1.5 (2026-04-21)
- 🐛 README added env field
- 🐛 mcp.json name consistent with PyPI package name
### v1.1.4 (2026-04-21)
- 🐛 Fixed README format
### v1.1.3 (2026-04-21)
- 🐛 Fixed README PyPI package name error
### v1.1.2 (2026-04-21)
- 🔧 GitHub repository name changed to `hospital-vuln-scanner-mcp`
### v1.1.1 (2026-04-21)
- 📝 Updated README, added usage and prompt word guide
- 📝 Added scanning engine description and built-in rule documentation
- 📝 Added medical system fingerprint identification description
### v1.1.0 (2026-04-21)
- ✨ Added real scanning capability (nmap/nuclei automatic detection)
- ✨ Added Python native port scanning fallback
- ✨ Added medical system fingerprint identification
- ✨ Added built-in vulnerability detection rules
- 🐛 Fixed scanning task always stuck in running
### v1.0.0 (2026-04-21)
- 🎉 Initial version
- ✨ 14 MCP tools
- ✨ Launched on MCP Plaza
## 📄 License
MIT License
## 🔗 Links
- **GitHub**: https://github.com/12211725-star/hospital-vuln-mcp
- **Issues**: https://github.com/12211725-star/hospital-vuln-mcp/issues
- **PyPI**: https://pypi.org/project/hospital-vuln-mcp/
- **MCP Plaza**: https://modelscope.cn/mcp/servers
