ai-security-wiki
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| classify_systemA | Start an AI security audit here. Identify ML, GenAI and agentic deployment patterns from explicit system features. Unknown inputs produce questions; combine all applicable patterns. |
| scope_risksA | After classification, filter DASF risks using the union of deployment-pattern Yes cells, then deduplicate linked controls. Returns source citations and unspecified applicability. This is scoping, not a vulnerability finding. |
| search_knowledgeA | Find DASF risks and controls by literal words, IDs or source framework mapping. Paginated source-backed results; use get_risk/get_control for details. Translate natural-language search terms to source English when needed. |
| get_riskA | Read one complete DASF risk, impacts, deployment applicability, mappings and official source row. |
| get_controlB | Read one DASF control, platform documentation, source mappings and project-authored verification criteria. |
| investigate_riskA | Learn how to investigate a DASF risk: trust boundary, failure hypothesis, evidence requests, bounded tests and per-control acceptance criteria. Does not scan or execute tests. |
| build_audit_planB | Create an evidence-first audit plan and unverified risk register after system classification. Includes intake, source-scoped risks and control verification backlog. |
| propose_remediationA | Propose control changes and retest criteria for selected risk IDs. No changes are applied; select proposals against actual evidence and assign owners/rollback. |
| explain_findingB | Prepare an English or Brazilian Portuguese explanation of a risk and caller-reported evidence. Distinguishes a possible risk from an independently verified failure; guides the calling agent to explain the source mechanism in the user’s language. |
| get_referenceB | Read the wiki method, glossary, source caveats or the portable audit skill and its required personality/methods/review lenses. Available even in MCP hosts without resource support. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| audit-ai-security | Classify an ML, GenAI or agentic system, scope DASF risks and plan an evidence-backed defensive audit. |
| explain-security-finding | Explain an AI security failure in plain language with evidence, impact and correction. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| overview | Snapshot, counts, source provenance and suggested workflow |
| index | AI Security Wiki: index |
| methodology | AI Security Wiki: methodology |
| agent-security | AI Security Wiki: agent-security |
| glossary | AI Security Wiki: glossary |
| finding-template | AI Security Wiki: finding-template |
| source-issues | AI Security Wiki: source-issues |
| source-register | AI Security Wiki: source-register |
| toolkit | AI Security Wiki: toolkit |
| skill | AI Security Wiki: skill |
| personality | AI Security Wiki: personality |
| methods | AI Security Wiki: methods |
| review-rubric | AI Security Wiki: review-rubric |
| skill-sources | AI Security Wiki: skill-sources |
| DASF-R-1.1 | Insufficient access controls |
| DASF-R-1.2 | Missing data classification |
| DASF-R-1.3 | Poor data quality |
| DASF-R-1.4 | Ineffective storage and encryption |
| DASF-R-1.5 | Lack of data versioning |
| DASF-R-1.6 | Insufficient data lineage |
| DASF-R-1.7 | Lack of data trustworthiness |
| DASF-R-1.8 | Legality of data |
| DASF-R-1.9 | Stale data |
| DASF-R-1.10 | Lack of data access logs |
| DASF-R-1.11 | Compromised 3rd-party datasets |
| DASF-R-2.1 | Preprocessing integrity |
| DASF-R-2.2 | Feature manipulation |
| DASF-R-2.3 | Raw data criteria |
| DASF-R-2.4 | Adversarial partitions |
| DASF-R-3.1 | Data poisoning |
| DASF-R-3.2 | Ineffective storage and encryption |
| DASF-R-3.3 | Label flipping |
| DASF-R-4.1 | Lack of traceability and transparency of model assets |
| DASF-R-4.2 | Lack of end-to-end ML lifecycle |
| DASF-R-5.1 | Lack of tracking and reproducibility of experiments |
| DASF-R-5.2 | Model drift |
| DASF-R-5.3 | Hyperparameters stealing |
| DASF-R-5.4 | Malicious libraries |
| DASF-R-6.1 | Evaluation data poisoning |
| DASF-R-6.2 | Insufficient evaluation data |
| DASF-R-6.3 | Lack of Interpretability and Explainability |
| DASF-R-7.1 | Backdoor machine learning / Trojaned model |
| DASF-R-7.2 | Model assets leak |
| DASF-R-7.3 | ML Supply chain vulnerabilities |
| DASF-R-7.4 | Source code control attack |
| DASF-R-8.1 | Model attribution |
| DASF-R-8.2 | Model theft |
| DASF-R-8.3 | Model lifecycle without HITL (human-in-the-loop) |
| DASF-R-8.4 | Model inversion |
| DASF-R-9.1 | Prompt inject |
| DASF-R-9.2 | Model inversion |
| DASF-R-9.3 | Model breakout |
| DASF-R-9.4 | Looped input |
| DASF-R-9.5 | Infer training data membership |
| DASF-R-9.6 | Discover ML model ontology |
| DASF-R-9.7 | Denial of Service (DoS) |
| DASF-R-9.8 | LLM hallucinations |
| DASF-R-9.9 | Input Resource Control |
| DASF-R-9.10 | Accidental exposure of unauthorized data to models |
| DASF-R-9.11 | Model Inference API Access |
| DASF-R-9.12 | LLM Jailbreak |
| DASF-R-9.13 | Excessive agency |
| DASF-R-10.1 | Lack of audit and monitoring inference quality |
| DASF-R-10.2 | Output manipulation |
| DASF-R-10.3 | Discover ML model ontology |
| DASF-R-10.4 | Discover ML model family |
| DASF-R-10.5 | Black-box attacks |
| DASF-R-10.6 | Sensitive data output from a model |
| DASF-R-11.1 | Lack of MLOps — repeatable enforced standards |
| DASF-R-12.1 | Lack of vulnerability management |
| DASF-R-12.2 | Lack of penetration testing, red teaming and bug bounty |
| DASF-R-12.3 | Lack of incident response |
| DASF-R-12.4 | Unauthorized privileged access |
| DASF-R-12.5 | Poor security in the software development lifecycle |
| DASF-R-12.6 | Lack of compliance |
| DASF-R-12.7 | Initial Access |
| DASF-R-13.1 | Memory Poisoning |
| DASF-R-13.2 | Tool Misuse |
| DASF-R-13.3 | Privilege Compromise |
| DASF-R-13.4 | Resource Overload |
| DASF-R-13.5 | Cascading Hallucination Attacks |
| DASF-R-13.6 | Intent Breaking & Goal Manipulation |
| DASF-R-13.7 | Misaligned & Deceptive Behaviors |
| DASF-R-13.8 | Repudiation & Untraceability |
| DASF-R-13.9 | Identity Spoofing & Impersonation |
| DASF-R-13.10 | Overwhelming Human in the Loop |
| DASF-R-13.11 | Unexpected RCE and Code Attacks |
| DASF-R-13.12 | Agent Communication Poisoning |
| DASF-R-13.13 | Rogue Agents in Multi-Agent Systems |
| DASF-R-13.14 | Human Attacks on Multi-Agent Systems |
| DASF-R-13.15 | Human Manipulation |
| DASF-R-13.16 | Prompt Injection |
| DASF-R-13.17 | Confused Deputy |
| DASF-R-13.18 | Tool Poisoning |
| DASF-R-13.19 | Credential and Token Exposure |
| DASF-R-13.20 | Insecure Server Configuration |
| DASF-R-13.21 | Supply Chain Attacks |
| DASF-R-13.22 | Excessive Permissions and Scope Creep |
| DASF-R-13.23 | Data Exfiltration |
| DASF-R-13.24 | Context Spoofing and Manipulation |
| DASF-R-13.25 | Insecure Communication |
| DASF-R-13.26 | Malicious Server Connection |
| DASF-R-13.27 | Insecure Credential Storage |
| DASF-R-13.28 | UI/UX Deception |
| DASF-R-13.29 | Insufficient Server Validation |
| DASF-R-13.30 | Client-Side Data Leakage |
| DASF-R-13.31 | Excessive Permission Granting |
| DASF-R-13.32 | Client-Side Code Execution |
| DASF-R-13.33 | Insecure Communication Handling |
| DASF-R-13.34 | Session and State Management Failures |
| DASF-R-13.35 | Update and Patch Management |
| DASF-1 | SSO with IdP and MFA |
| DASF-2 | Sync users and groups |
| DASF-3 | Restrict access using IP access lists |
| DASF-4 | Restrict access using private link |
| DASF-5 | Control access to data and other objects |
| DASF-6 | Classify data |
| DASF-7 | Enforce data quality checks on batch and streaming datasets |
| DASF-8 | Encrypt data at rest |
| DASF-9 | Encrypt data in transit |
| DASF-10 | Version data |
| DASF-11 | Capture and view data lineage |
| DASF-12 | Delete records from datasets |
| DASF-13 | Use near real-time data |
| DASF-14 | Audit actions performed on datasets |
| DASF-15 | Explore datasets and identify problems |
| DASF-16 | Secure model features |
| DASF-17 | Track and reproduce the training data used for ML model training |
| DASF-18 | Govern model assets |
| DASF-19 | Manage end-to-end machine learning lifecycle |
| DASF-20 | Track ML training runs |
| DASF-21 | Monitor data and AI system from a single pane of glass |
| DASF-22 | Build models with all representative, accurate and relevant data sources |
| DASF-23 | Register, version, approve, promote, deploy and monitor models |
| DASF-24 | Control access to models and model assets |
| DASF-25 | Use retrieval augmented generation (RAG) with large language models (LLMs) |
| DASF-26 | Fine-tune large language models (LLMs) |
| DASF-27 | Pretrain a large language model (LLM) |
| DASF-28 | Create model aliases, tags and annotations |
| DASF-29 | Build MLOps workflows |
| DASF-30 | Encrypt models |
| DASF-31 | Secure model serving endpoints |
| DASF-32 | Govern and monitor access of AI model and model serving endpoints |
| DASF-33 | Manage credentials securely |
| DASF-34 | Run models in multiple layers of isolation |
| DASF-35 | Track model performance |
| DASF-36 | Set up monitoring alerts |
| DASF-37 | Set up inference tables for monitoring and debugging models |
| DASF-38 | Platform security — penetration testing, red teaming, bug bounty and vulnerability management |
| DASF-39 | Platform security — Incident Response Team |
| DASF-40 | Platform security — internal access |
| DASF-41 | Platform security — secure SDLC |
| DASF-42 | Employ data-centric MLOps and LLMOps |
| DASF-43 | Use access control lists |
| DASF-44 | Triggering actions in response to a specific event |
| DASF-45 | Evaluate models |
| DASF-46 | Store and retrieve embeddings securely |
| DASF-47 | Compare LLM outputs on set prompts |
| DASF-48 | Use hardened Runtime for Machine Learning |
| DASF-49 | Automate LLM evaluation |
| DASF-50 | Platform compliance |
| DASF-51 | Share data and AI assets securely |
| DASF-52 | Source code control |
| DASF-53 | Third-party library control |
| DASF-54 | Implement AI guardrails |
| DASF-55 | Monitor audit logs |
| DASF-56 | Restrict outbound connections from models |
| DASF-57 | Use attribute-based access controls (ABAC) |
| DASF-58 | Protect data with filters and masking |
| DASF-59 | Use clean rooms |
| DASF-60 | Rate limit number of inference queries |
| DASF-61 | Train users on AI risk taxonomy and AI/ML security |
| DASF-62 | Implement network segmentation |
| DASF-63 | Update software |
| DASF-64 | Limit access from AI models and agents |
| DASF-65 | Implement end-to-end AI traceability |
| DASF-66 | Use Human-in-the-loop feedback |
| DASF-67 | Federate authentication |
| DASF-68 | Use Securely Hosted Managed MCP Servers |
| DASF-69 | Securely host Custom MCP Servers |
| DASF-70 | Securely connect to External MCP Servers |
| DASF-71 | Log and register AI agents |
| DASF-72 | Securely store and reuse agent state |
| DASF-73 | Register prompts |
TDQS
Scored across 10 tools
Each tool targets a distinct step or resource: classify, scope, plan, investigate, remediate, explain, plus three lookup tools. The closest pairs (search_knowledge vs. get_risk/get_control, and investigate_risk vs. explain_finding) are explicitly separated in the descriptions (search vs. read details; investigate vs. explain). Minor residual overlap between investigate_risk and explain_finding keeps it from a 5.
All ten tools use snake_case verb_noun form (classify_system, scope_risks, investigate_risk, get_control). get_reference/get_risk/get_control form a coherent get_* family and the action verbs clearly map to workflow stages. Only build_audit_plan adds a third noun, which is still readable and consistent.
Ten tools for a multi-stage audit workflow (classify → scope → plan → investigate → remediate → explain) with three reference readers is well-scoped. No redundant or filler tools are apparent; each corresponds to a workflow step or lookup need.
The surface covers the full advisory lifecycle from classification through remediation proposals and explanation, and explicitly declares what it does not do (no scanning, no execution, no applied changes). The main gap is that there is no tool to record evidence/verification outcomes or update an existing audit plan, so the loop from retest back into the register is left to the calling agent.