Security posture scanner and passive gateway for Model Context Protocol (MCP) servers — see what your AI agents can actually do.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"pramiti-mcp-gateway","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# pramiti-mcp-gateway **See what your AI agents can actually _do_.** An open-source security posture scanner for [Model Context Protocol (MCP)](https://modelcontextprotocol.io) servers. Point it at a server's tools and it tells you, in two minutes, which ones let an agent take dangerous actions — writes, irreversible operations, sensitive-data exfiltration, and arbitrary-execution power — with zero infrastructure and no changes to anything you run. MCP gives AI agents hands. This tells you what those hands can reach. ``` $ pramiti-mcp-gateway scan tools.json MCP Security Posture ============================================================ 9 tools scanned | read 3 write 6 unknown 0 severity: critical 4 high 1 medium 1 low 1 info 2 ------------------------------------------------------------ [CRIT] internal_db.export_patient_records Changes state; effects are hard to reverse; touches sensitive/regulated data; grants broad or unconstrained capability. signals: irreversible:export, sensitive:patient, sensitive:medical, overbroad:no-input-schema [CRIT] internal_db.run_sql Changes state; effects are hard to reverse; grants broad or unconstrained capability. signals: irreversible:execute, irreversible:run, overbroad:sql, overbroad:arbitrary [CRIT] payments.transfer_funds Changes state; effects are hard to reverse; touches sensitive/regulated data. [HIGH] github.delete_repository [MED ] github.create_pull_request [LOW ] payments.list_transactions [INFO] github.get_file_contents ------------------------------------------------------------ Top risk: CRITICAL. These tools let an agent take high-impact actions. Gate them before giving an agent write access. ``` ## Why this exists An MCP server can expose a `delete_repository`, a `transfer_funds`, or a `run_sql` tool right next to a harmless `search`. When you connect an AI agent to it, the agent can call any of them — and if the agent is prompt-injected, it _will_ be talk…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.