AI in Cybersecurity: A Beginner’s Guide to Claude Code, MCP & AI Agents-3

Quick Recap: Skills vs Commands vs Subagents vs Hooks vs MCP

• Skills give Claude reusable cybersecurity knowledge and methodology, such as detection engineering, malware analysis, or threat intelligence.
• Slash Commands are workflows that you manually trigger when you want Claude to perform a specific task.
• Subagents divide complex work into smaller specialized tasks that can be handled independently or in parallel.
• Hooks provide automatic, event-based controls, such as validating output, logging activity, or blocking dangerous commands.
• MCP connects Claude with external tools and data such as SIEM platforms, APIs, threat intelligence sources, files, and databases.
• The easiest way to remember the difference is:
• Skill = Expertise
  Command = Trigger
  Subagent = Worker
  Hook = Automatic Control
  MCP = External Connection

Together, these features turn Claude from a simple AI assistant into a more structured, controlled, and reusable cybersecurity workflow while still keeping the analyst in control.

Moving to Topic 3: MCP and External Security Tools

Now that we understand how Claude organizes expertise, workflows, agents, and automation, the next question is:

How does Claude actually connect to real cybersecurity tools, APIs, logs, databases, and external systems?

That brings us to MCP — Model Context Protocol.

MCP: Model Context Protocol

MCP was another concept that sounded much more complicated than it actually is.

MCP stands for Model Context Protocol.

The simplest way I understand it is:

MCP provides a standardized way for an AI application to connect with external tools and data.

The MCP specification describes exactly that kind of connection between LLM applications and external tools/data sources.

Think of the architecture like this:

Claude Code / Claude Desktop
                    │
                    │ MCP
                    ▼
               MCP Server
              /          \
             /            \
          Tools         Resources
            │               │
            ▼               ▼
        ACTIONS            DATA
            │               │
       Query API          Logs
       Run search         Configs
       Call service       Knowledge base
       Perform task       Files
            │               │
            └───────┬───────┘
                    ▼
            External Systems

That external system might be a file system, API, CLI, database, Git repository or security platform.

MCP Tools vs MCP Resources

This distinction is very important.

MCP Tools perform actions.

For example:

search_siem()
lookup_indicator()
query_asset()
create_case()

The MCP specification describes tools as executable functions that models can invoke to interact with external systems.

MCP Resources provide information.

For example:

SIEM logs
configuration files
knowledge-base articles
incident documentation
database schemas
threat intelligence reports

Resources are designed to provide contextual data to the application/model.

Get The Commoness’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

So the easiest way to remember it is:

MCP TOOL
Claude DOES something.

MCP RESOURCE
Claude READS something.

Real Cybersecurity MCP Example

Suppose we are investigating:

185.220.x.x

Without MCP:

Analyst copies IP
      ↓
opens threat intelligence site
      ↓
searches IP
      ↓
copies reputation
      ↓
returns to Claude
      ↓
pastes result

With an appropriately configured MCP integration:

Analyst
   ↓
"Investigate this IP"
   ↓
Claude
   ↓
MCP Tool
   ↓
Threat Intelligence API
   ↓
Reputation + metadata
   ↓
Claude correlates result
   ↓
Analyst reviews evidence

Now imagine connecting multiple security systems:

Claude
                       │
             Security MCP Gateway
                       │
      ┌────────────────┼─────────────────┐
      │                │                 │
      ▼                ▼                 ▼
     SIEM          Threat Intel       Ticketing
      │                │                 │
      ▼                ▼                 ▼
    Logs            IOC data          Incident

This is where AI starts becoming more than a chatbot.

It becomes an orchestration layer.

But again, the security boundary remains essential.

Reading an alert may be automatic.

Disabling the user’s account may require approval.

Plugins: Packaging the Workflow

Suppose you build:

Detection Skill
+
Incident Command
+
Security Hooks
+
Subagent
+
MCP configuration

You probably don’t want every analyst manually recreating all of that.

A useful way to think about plugins is as distributable packages for reusable workflow components.

For example, a company could conceptually create:

soc-investigation-plugin/

containing its reusable detection instructions, automation, agent definitions and integration configuration.

Now a workflow can be standardized and shared across a team rather than existing only on one analyst’s laptop.

That becomes especially useful for organizations trying to convert tribal knowledge into repeatable security processes.

Claude Configuration: User, Project and Local Settings

Another important part of the ecosystem is configuration scope.

Claude’s agent tooling recognizes distinct filesystem settings sources corresponding to user, project and local configuration. Current documentation maps these to paths such as ~/.claude/settings.json, .claude/settings.json and .claude/settings.local.json.

I think of them like this:

For cybersecurity projects this distinction matters because some settings should be shared through Git while machine-specific or sensitive local configuration should not.

Part 4 of this AI Security series is coming soon.
For more hands-on cybersecurity project walkthroughs, you can explore Follow me on Medium and GitHub, and LinkedIn for upcoming AI Security, Detection & Response, Threat Intelligence, and Security Automation updates.
Medium claude project:https://medium.com/@Commoness/building-a-basic-tool-using-claude-2cc3f782aa19
Github:https://github.com/RoshiniMlakshmana
Linkedin:https://www.linkedin.com/in/roshini-m-lakshmana-b51ab3243/