@mhdd_24/ai-red-team-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@mhdd_24/ai-red-team-mcpScan this content for policy or safety issues: 'How do I bypass login?'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@mhdd_24/ai-red-team-mcp
MCP server for Structured robustness/security testing.
Same architecture as @mhdd_24/sublime-mcp.
Full documentation: docs/WIKI.md
How it works (30 seconds)
You (chat) → MCP client → ai-red-team-mcp → AI Red Team APIs / CLIs / local toolsRelated MCP server: PromptWall MCP Server
Prerequisites
Requirement | Notes |
Node.js 18+ | ESM TypeScript MCP server |
Credentials / CLIs | See environment variables below |
Install
Option A — npm (after publish)
npm install -g @mhdd_24/ai-red-team-mcpOption B — npx
npx @mhdd_24/ai-red-team-mcpOption C — clone and build
git clone https://github.com/Mhdd-24/AI-Red-Team-MCP.git
cd AI-Red-Team-MCP
npm install
npm run build
node dist/index.jsConfigure Cursor
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"airedteam": {
"command": "npx",
"args": ["-y", "@mhdd_24/ai-red-team-mcp"],
"env": {
"_": "optional"
}
}
}
}Local development:
{
"command": "node",
"args": ["/absolute/path/to/AI-Red-Team-MCP/dist/index.js"]
}Environment variables
Variable | Description |
— | No required env |
Tools
Tool | Description |
| Show Structured robustness/security testing configuration / health. |
| Scan text for policy/safety issues. |
| Generate a test suite outline. |
License
ISC
Available Tools
3 toolsairedteam_scanC
Scan text for policy/safety issues.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Input/output text |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only says 'scan' without clarifying whether the operation is read-only, what kind of output it produces, whether it modifies anything, or how results are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence and is appropriately front-loaded. It is not bloated, though its brevity contributes to some ambiguity in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description is too sparse. It does not explain what a successful scan returns, how to interpret results, or how this tool relates to its siblings. An agent would likely need additional information to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'text' parameter. The tool description adds no new parameter-level meaning beyond what the schema provides, but the schema is sufficient, warranting the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Scan') and resource ('text') with a specific purpose ('policy/safety issues'). It is understandable and distinct enough from the sibling tools, though it does not explicitly differentiate itself from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus airedteam_status or airedteam_suite. There is no mention of exclusions, prerequisites, or typical scenarios, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
airedteam_statusB
Show Structured robustness/security testing configuration / health.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure. The verb 'Show' implies a read-only operation, but the description does not explicitly state that it has no side effects, requires no permissions, or returns a snapshot. It also does not disclose whether it reflects current state or cached data. The lack of explicit safety information is a gap for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, and the action verb is front-loaded. It is appropriately concise for a simple status/health tool, though it could be slightly more specific without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and no annotations, the description should at least clarify what the output looks like or what 'configuration / health' specifically refers to. It does not describe the return format, the scope of 'health', or any prerequisites. For a tool this simple, it is adequate but leaves the agent guessing about the exact nature of the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema has 100% coverage (empty properties). Per the baseline rule for 0 parameters, a score of 4 is appropriate because there are no parameter semantics to clarify; the description does not need to add parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Show') and a resource ('configuration / health'), and the phrase 'robustness/security testing' provides some context. It is not a tautology, and it is distinguishable from the sibling tools (scan and suite), which imply running tests. However, the phrasing is a bit ambiguous ('configuration / health' could mean either or both).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus the siblings (airedteam_scan, airedteam_suite). It does not mention typical use cases, prerequisites, or that it should be used before/after other operations. The agent must infer its role from the name and description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
airedteam_suiteC
Generate a test suite outline.
| Name | Required | Description | Default |
|---|---|---|---|
| policy | Yes | Policy summary |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. The verb 'Generate' suggests a non-destructive action, but no side effects, permissions, or state changes are mentioned. For a tool that likely creates an outline, the description does not clarify whether it modifies any existing data or what the output structure is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is appropriately concise and free of redundancy. However, it is not front-loaded with any scoping or differentiation details, and while it earns its place, it does not provide any extra value beyond the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (one parameter, no output schema), the description is still incomplete. It does not explain what a test suite outline consists of, how the policy parameter is used, or what the return value looks like. An agent would lack sufficient context to invoke the tool correctly or interpret its results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single parameter 'policy' with the description 'Policy summary', so the parameter is already documented. The tool description adds no additional meaning about the policy's format, role, or how it influences the output, leaving the schema to do the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Generate') and resource ('test suite outline'), making the primary action clear. However, it does not differentiate itself from sibling tools (airedteam_status, airedteam_scan) by mentioning scope or alternatives, so it lacks the explicit contrast seen in high-quality definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its siblings. The description implies usage when an outline is needed, but there is no mention of prerequisites, context, or situations where this tool is inappropriate, leaving the agent to infer the intended scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.0.0- First observed
airedteam_scan - First observed
airedteam_status - First observed
airedteam_suite
TDQS
Scored across 3 tools
Each tool has a clear, distinct purpose: status shows health/configuration, scan performs direct text analysis, and suite generates a test plan. There is no realistic confusion between them.
All tools share the consistent airedteam_ prefix and use lowercase snake_case, making the naming predictable. However, they do not follow a strict verb_noun pattern: scan is a verb while status and suite are nouns.
Three tools is at the lower end of the well-scoped range, but each one earns its place in a focused red-team utility server. There is no redundancy or unnecessary bloat.
The set covers health/status, text scanning, and test-suite outline generation, but there is no tool to execute a generated suite or retrieve detailed scan results. This leaves notable gaps in a full red-team testing workflow.
Maintenance
Related MCP Connectors
Scan text, documents, websites, and MCP metadata for prompt injection and sensitive-data risks.
Prompt injection detection API for AI agents. Scan untrusted text before passing it to an LLM.
Writes adversarial test suites for AI-built code. Your agent's test engineer.
Check AI work against requirements and return structured verdicts, findings, and repair steps.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to perform authorized security testing and penetration testing operations including SSL/TLS analysis, port scanning, vulnerability scanning, and HTTP security header audits through natural language interactions.1MIT
- AlicenseNot gradedqualityAmaintenanceEnables scanning LLM prompts and responses for prompt injection, jailbreaks, PII leakage, secret leakage, and other malicious content using deterministic rules, returning verdicts and safe redacted text.1MIT

EVIDIQ Bulwarkofficial
AlicenseNot gradedqualityBmaintenanceProvides deterministic scanning and detection of prompt injection, jailbreak, data-exfiltration, and system-prompt leaks, with EIP-191 signed attestations and 0G Storage anchoring for verifiable safety reports.1MIT
mirage-mcpofficial
FlicenseNot gradedqualityBmaintenanceEnables auditing an AI agent's guardrails by providing adversarial test prompts and scoring responses against known refusal/guardrail patterns.-