# llmsecurity-mcp

A local, **dependency-free** MCP (Model Context Protocol) server exposing
[LLMSecurity.dev](https://llmsecurity.dev)'s security checks as tools an
AI coding agent (Claude Code, Claude Desktop, Codex, or any other
MCP-capable client) can call directly — no network access, no API key,
nothing leaves your machine.

Everything here runs on the Python standard library only. No `pip install`
of third-party packages is required to use it.

## Tools

| Tool | What it does |
|---|---|
| `scan_agent_config` | Scans `AGENTS.md`, `CLAUDE.md`, `SKILL.md`, `.claude/`, `.codex/` for prompt-injection patterns, including base64-hidden instructions. |
| `check_tool_call_safety` | Classifies a proposed tool call (command + path) as `allow`, `ask`, or `deny` — catches recursive deletes, remote-pipe-to-shell, and credential exfiltration/access patterns. |
| `scan_prompt_for_injection` | Runs the same jailbreak/injection pattern detectors LLMSecurity.dev's hosted scanner uses, against arbitrary text. |
| `scan_rag_source` | Scans local RAG source documents for indirect prompt injection, secrets, and PII before you chunk/embed them. |
| `map_security_coverage` | Maps a scan report's findings to OWASP LLM Top 10 (2025) / NIST AI RMF / MITRE ATLAS — evidence for a review, not a certification. |
| `scan_skill_trust` | Inventories skills and MCP package manifests (`SKILL.md`, `package.json`, `mcp.json`) for external instruction sources, risky install scripts, and exposed credentials. |
| `analyze_model_abuse` | Analyzes model-API telemetry (bursts, cost drains, repeated probes, auth failures) for abuse signals — no prompt bodies required or accepted. |
| `check_mcp_policy` | Evaluates a proposed MCP tool call against a local allowlist/approval/destination policy. |

## Install

```bash
git clone https://github.com/afterdarksys/llmsecurity-mcp
cd llmsecurity-mcp
python3 -m pytest tests/ -q   # optional: confirm it works in your environment (51 tests)
```

No dependencies to install — every tool here is pure standard-library Python (3.10+).

## Configure

### Claude Code

```bash
claude mcp add llmsecurity -- python3 -m workers.agent_security.mcp_server
```

Run that from inside your `llmsecurity-mcp` checkout (or pass `--cwd /path/to/llmsecurity-mcp`
if you're not there).

### Claude Desktop (or any client using `claude_desktop_config.json`-style config)

```json
{
  "mcpServers": {
    "llmsecurity": {
      "command": "python3",
      "args": ["-m", "workers.agent_security.mcp_server"],
      "cwd": "/absolute/path/to/llmsecurity-mcp"
    }
  }
}
```

## Standalone CLIs

Each pillar also has its own CLI, usable without any MCP client at all:

```bash
python3 -m workers.agent_security.cli scan-config .
python3 -m workers.agent_security.cli scan-prompt --file instructions.txt
python3 -m workers.agent_security.cli check-tool --tool-name Bash --input-json '{"command":"rm -rf /"}'
python3 -m workers.supply_chain.cli --mode trust .
python3 -m workers.supply_chain.cli --mode secrets .
python3 -m workers.data_security.cli ./docs
python3 -m workers.governance.cli path/to/scan-report.json
python3 -m workers.model_security.cli model-events.jsonl
python3 -m workers.mcp_security.cli --policy mcp-policy.json --tool send_email --arguments '{"to":"vendor@example.com"}'
```

Run `--help` on any of them for exact flags — they're independent, small
`argparse` wrappers around the same functions the MCP server calls.

## What's deliberately not here

This is a subset of the full LLMSecurity.dev platform, extracted specifically
because it has zero third-party dependencies and needs no network access or
API key:

- **PII anonymization/deanonymization** (`workers.data_security.anonymize`)
  needs `presidio-analyzer` + a spaCy model and is not included — it lives in
  the main platform.
- **Active scanning** (Garak/Promptmap/PyRIT against a live model target) is
  a hosted/authenticated service, not a local tool — see
  [llmsecurity-cli](https://github.com/afterdarksys/llmsecurity-cli) for the
  CLI that talks to it.
- Output-side response scanning (refusal/banned-content/malicious-URL
  detection on a model's reply) is part of the hosted prompt-scanner API,
  also reachable from `llmsecurity-cli`.

## Related

- [llmsecurity.dev](https://llmsecurity.dev) — the hosted platform (dashboard, community prompt library, active scanning).
- [llmsecurity-cli](https://github.com/afterdarksys/llmsecurity-cli) — the `adllmsec` command-line client for the hosted API.

## License

MIT — see [LICENSE](LICENSE).