Skip to main content
Glama
Sign In

ATK Security Checks

by com.atkvn
OverviewDiscussionsAdmin

Server Details

PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
ChatGPT
–
Claude
–

TDQS

A4/5.0

Scored across 5 tools

Disambiguation4/5

Most tools have clearly distinct purposes: PHP RCE exposure, PQ TLS negotiation, TLS certificate validation, and two Wazuh-specific tools. The two Wazuh tools could be initially confused (auditing rule files vs. testing log lines), but their descriptions clearly separate static load-order analysis from live logtest execution.

Naming Consistency4/5

All tools use predictable snake_case with a verb-first pattern: audit_wazuh_rules, check_php2shell, check_post_quantum_tls, check_tls_certificate, test_wazuh_rule. The repeated check_ prefix and occasional audit_/test_ verbs are minor deviations but remain readable and consistent.

Tool Count5/5

Five tools is well-scoped for a focused security-check server. Each tool covers a distinct check and none appears redundant or frivolous.

Completeness4/5

The surface covers the stated checks well: Wazuh rule auditing, Wazuh rule testing, PHP2Shell exposure, TLS certificate validation, and post-quantum TLS probing. It is intentionally narrow, so broader security-check gaps exist, but within its apparent purpose there are no obvious dead ends.

Available Tools

5 tools
audit_wazuh_rulesAudit Wazuh custom rulesA
Read-onlyIdempotent
Inspect

Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.

Inputs: files (required), api_key, wazuh_version.

check_php2shellCheck PHP2Shell (CVE-2026-109618/109619)A
Read-onlyIdempotent
Inspect

Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: php -v, php -i or php-fpm -i, cat /etc/os-release, dpkg -l 'php*' or rpm -qa 'php*'. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.

Inputs: evidence (required).

check_post_quantum_tlsCheck post-quantum TLSA
Read-onlyIdempotent
Inspect

Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.

Inputs: hostname (required).

check_tls_certificateCheck TLS certificateA
Read-onlyIdempotent
Inspect

Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.

Inputs: hostname (required).

test_wazuh_ruleTest Wazuh rule on a real managerA
Read-onlyIdempotent
Inspect

Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).

Inputs: logs (required), rules, decoders, log_format.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • SOC MCP Server

      nks1097
      A
      license
      Not graded
      quality
      D
      maintenance
      Automated SOC orchestration server integrating Wazuh, TheHive, Cortex, and MISP for AI-driven incident response and SOAR playbooks.
      Apache 2.0

    • wazuh-daily-triage

      dururustem68
      A
      license
      B
      quality
      B
      maintenance
      On-call companion for Wazuh SIEM with a read-only MCP server: alert search, aggregations, timelines, IP profiles, correlation, vulnerabilities, agents, rule info, logtest, reports and knowledge base. Personal data is pseudonymised before it reaches the AI or MCP client (KVKK/GDPR).
      2
      18
      2
      AGPL 3.0

    • Wazuh MCP Server

      devopsfixes-com
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables AI assistants to query Wazuh security alerts, investigate hosts, detect brute-force attempts, and generate security summaries by connecting to a Wazuh manager.
      -
    Try in Browser
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Glama MCP Gateway

    Add one secure layer between your agents and this server.

    Resources