Atomic MCP tools for AppSec and AI Security engineers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-security-toolkit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-security-toolkit [](https://github.com/x0base/mcp-security-toolkit/actions/workflows/ci.yml) [](https://pypi.org/project/mcp-security-toolkit/) [](https://pypi.org/project/mcp-security-toolkit/) [](LICENSE) > Built by [Redmai](https://redmai.io). For continuous autonomous API / agent > security scanning, use Redmai. **Source / schema / prompt audit primitives for agent builders.** Plug into Claude Code / Cursor / Claude Desktop. Audit MCP servers, agent tool schemas, system prompts, JWTs, and HTTP-response diffs — locally, in the coding agent you already use. Atomic, auditable, no orchestration. ## Why this exists Most security-flavored MCP servers wrap an existing CLI (Burp, Shodan, CyberChef) or audit MCP configurations and tool descriptions. The primitives a developer reaches for when *their own* code ships an LLM feature — source-level audit of an MCP server, schema-level audit of an agent tool, static review of a system prompt — are thinly covered. `mcp-security-toolkit` ships those primitives, plus the everyday pentest atoms an agent reaches for during AppSec work, so you can run one server instead of five. --- ## Headline tools ### `mcp_server_audit` Heuristic AST audit of an MCP server's Python source. Enumerates `@tool`-decorated and imperatively-registered tools, then runs 13 detectors: | Detector | Category | Sev | |---|---|---| | Shell execution | `shell-exec` | high | | Filesystem write/delete | `fs-write` / `fs-destructive` | med–high | | Network egress | `network-egress` | medium | | Code injection | `code-injection` | high | | Over-broad params | `over-broad-param` | medium | | Ambiguous/missing docstring | `ambiguous-description` | low–med | | Se…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.