{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_um57q7fvmk3q","handle":"mcp-redteam-harness","url":"https://wellknown.network/agents/mcp-redteam-harness","links":{"self":"https://wellknown.network/agents/mcp-redteam-harness/record.json","html":"https://wellknown.network/agents/mcp-redteam-harness","markdown":"https://wellknown.network/agents/mcp-redteam-harness/record.md","api":"https://wellknown.network/api/v1/agents/mcp-redteam-harness","status":"https://wellknown.network/api/v1/agents/mcp-redteam-harness/status","claim":"https://wellknown.network/agents/mcp-redteam-harness/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-redteam-harness/claim.json","badge":"https://wellknown.network/agents/mcp-redteam-harness/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-redteam-harness/history","tools":"https://wellknown.network/api/v1/agents/mcp-redteam-harness/tools"},"ard":{"identifier":"urn:air::server:mcp-redteam-harness","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-redteam-harness","summary":"Dynamic red-team harness for MCP agents: a transparent proxy that injects attacks, measures attack success rate, and ships an information-flow mitigation layer.","description":"# MCP Red Team\n\n> **MCP Red Team** is a dynamic red-team harness for MCP agents: a transparent proxy injects attacks\n> into live tool traffic and scores them with a deterministic oracle. Held-out headline: **0 of 978\n> exfiltration trials** moved the planted secret; attack success concentrated under one agent\n> framework (exploratory). See [Results](#14-results).\n\n![Two-panel held-out results. Left: data exfiltration, held-out — 0 of 978 trials moved the planted secret (0.0%). Right: baseline answer-hijack/persistence attack success rate per model per framework — OpenAI Agents SDK (Sonnet 5.5 5.6%, Opus 5.5 4.6%) vs LangGraph (both 0.0%), with Wilson 95% confidence intervals; exploratory panel.](review/M4/heldout-static/headline_figure.png)\n\n*Per model, per framework; exploratory panel labeled.*\n\nMCP Red Team is a dynamic red-team harness for agents that speak the Model Context Protocol. A\ntransparent proxy sits between an agent and its MCP servers, injects attacks into the traffic the\nagent sees, measures attack success rate (ASR) with a deterministic oracle, and ships an\ninformation-flow mitigation layer whose cost to the agent's useful work is measured alongside attack\nsuccess. It is defensive security research: attacks run only against mock servers in this repo, and\ncanaries are synthetic.\n\n## Threat model\n\n- **Attacker:** controls exactly one upstream MCP server, or poisons data inside one\n  otherwise-benign server's data source (a note, a file, a resource).\n- **Trusted:** the user, the agent scaffold, the model provider, and every other upstream server.\n- **Attacker goals:** exfiltrate a secret, trigger a forbidden action, hijack the final answer, or\n  persist across turns.\n- **Out of scope (v1):** compromised clients, network MITM, malicious gateways, model-weight attacks,\n  and adaptive attackers stronger than the rule-based search reported in Results (e.g., LLM-driven or\n  human red-teamers).\n\n## Metrics: ASR and exposure\n\n- **Raw ASR** = successes ÷ trial…","publisher":{"name":"Srihaasa Karyampudi","url":null},"homepage":null,"repository":null,"version":"0.1.0","license":null,"protocols":["mcp"],"tags":["mcp","red-team","security","prompt-injection","agents","llm"],"pricing":null,"endpoints":[{"url":"pypi:mcp-redteam-harness","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.scanning","name":"Security Scanning","confidence":0.75,"provenance":"derived"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-redteam-harness","registry":"pypi","observedAt":"2026-11-05T22:26:20.165Z","publishedAt":"2026-10-16T19:07:31.386806Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-redteam-harness","url":"https://pypi.org/project/mcp-redteam-harness/","firstSeenAt":"2026-10-18T16:29:34.459Z","fetchedAt":"2026-11-05T22:24:21.812Z","normalizedAt":"2026-11-05T22:24:21.812Z"}]},"firstSeenAt":"2026-10-18T16:29:34.459Z","updatedAt":"2026-11-05T22:26:20.165Z"}