secure-kb
Provides OWASP MASTG and MASVS-derived security check cards for Android apps, allowing an agent to profile an Android stack and retrieve mobile-specific security tests (e.g. by MASTG/MASVS reference).
Includes authored security check cards for Electron desktop apps (from official docs) that an agent can retrieve when reviewing an Electron codebase.
Provides OWASP MASTG and MASVS-derived security check cards for iOS apps, allowing an agent to retrieve iOS mobile security tests by MASTG/MASVS reference.
The knowledge base is distilled from OWASP sources — ASVS 5.0, WSTG, MASTG, MASVS, ISTG, and the Top 10 / LLM Top 10 / API Top 10 — exposing 2,057 traceable check cards that an agent can search or fetch by ASVS/WSTG/CWE reference for secure code review.
Includes authored security check cards for Telegram (from official docs) that an agent can retrieve when reviewing a Telegram-based integration.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@secure-kbwhat security checks should I run on my project?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AI Security Knowledge Base (secure-kb)
An AI security knowledge base — security check cards an AI coding agent can search.
Keywords: AI security · AI agent security · OWASP ASVS · WSTG · MASTG · Top 10 · LLM security · prompt injection · secure code review · AppSec · DevSecOps · MCP · Claude · Cursor
2,057 atomic check cards distilled from 67 tracked sources — cards are drawn from 15 public repositories plus 5 official-doc sources — each traceable to a real file, anchor and commit.
Status: public beta (v0.9.0). The build is deterministic and reproducible; retrieval targets are not yet met, so this is deliberately not v1.0.0. See Benchmarks and Known limitations.
Website → · Releases · Contributing · Security
What it is — and what it is not
It is a retrieval layer for AI agents: a merged, normalised corpus of security checks with provenance, a platform router, a fast gate, and a zero-dependency SQLite FTS5 index.
It is not a scanner, and it does not replace a professional security audit. It tells an agent what to verify; tool adapters only describe how to invoke external scanners.
Related MCP server: AI DevSecOps Agent MCP Server
Install in 60 seconds
Zero required dependencies (standard-library Python only). index/ and index/kb.sqlite build
themselves on first use.
git clone https://github.com/pavnxet/ai-security-knowledge-base.git
cd ai-security-knowledge-base
python3 cli/secure_kb.py detect /path/to/project
python3 cli/secure_kb.py profile web --gate fast --format brief
python3 cli/secure_kb.py search "how do I stop sql injection" --k 5
python3 cli/secure_kb.py get SKB-ASVS-V1-2-4 --format mdNo-build fallback — the index ships as shards, so plain tooling works with no build step:
cat index/checks/*.jsonl | jq -c 'select(.severity=="critical")'
cat index/checks/*.jsonl | grep -c "SKB-ASVS"The five-step agent workflow
Detect the stack (
detect) → ranked platforms.Profile it (
profile <platform> --gate fast).Gate — the top checks by priority, domain-balanced, in a small token budget.
Drill down (
get <id>, or by CWE / ASVS / MASVS ref).Report — pass / fail / n-a / unknown, with evidence. No “pass” without evidence.
MCP setup
The MCP server exposes detect_stack, get_profile, search_checks, get_check, start_report,
submit_result, list_tools (7 tools — run list_tools to enumerate).
Claude Code
claude mcp add secure-kb -- python3 /abs/path/to/secure-kb/mcp/server.pyClaude Desktop (claude_desktop_config.json)
{ "mcpServers": { "secure-kb": {
"command": "python3",
"args": ["/abs/path/to/secure-kb/mcp/server.py"] } } }Generic MCP client — JSON-RPC 2.0 over stdio; initialize then tools/call.
What's in it
Source | Cards | Licence |
OWASP Cheat Sheet Series | 1,032 | CC BY-SA 4.0 |
yesmayank/secure-coding-baseline (Tier-2) | 353 | MIT |
OWASP ASVS 5.0 | 339 | CC BY-SA 4.0 |
OWASP WSTG | 112 | CC BY-SA 4.0 |
raroque/vibe-security-skill (Tier-2) | 40 | see |
kadenzipfel/smart-contract-vulnerabilities | 38 | see |
OWASP MASTG (Android/iOS tests) | 32 | CC BY-SA 4.0 |
OWASP MASVS | 20 | CC BY-SA 4.0 |
OWASP ISTG (IoT) | 15 | CC BY-SA 4.0 |
shieldfy/API-Security-Checklist (Tier-2) | 13 | see |
crytic/not-so-smart-contracts | 11 | see |
OWASP Top 10 / LLM Top 10 / API Top 10 | 10 / 10 / 9 | CC BY-SA 4.0 |
mgreiler/secure-code-review-checklist (Tier-2) | 8 | see |
Authored (Telegram, Chrome, Electron — official docs) | 15 | CC BY-SA 4.0 |
Total | 2,057 |
Cards use source-identity IDs — SKB-<SRC>-<official-id> (e.g. SKB-ASVS-V3-4-5,
SKB-WSTG-INFO-01) or a short hash of repo|path|anchor. Merged cards keep every member id in
aliases[], so any historical id still resolves. See docs/PIPELINE.md.
Benchmarks
Held-out sets, frozen. Strict metrics (mapped refs only) — reported as measured.
Set | n | recall@5 | Target | Status |
Held-out (all) | 154 | 0.66 | ≥ 0.70 | below |
Curated v2 (standards-derived) | 59 | 0.44 | ≥ 0.60 | below |
v2_dev (developer vocabulary) | 40 | 0.25 | ≥ 0.60 | below |
Curated v1 | 59 | 0.25 | — | reference |
Templated | 95 | 0.92 | ≥ 0.90 | met |
Fast-gate recall (strict) | 30 | 26.7% | ≥ 0.70 | below |
Determinism: two consecutive rebuilds — and a rebuild with shuffled staging input — produce the
identical manifest.content_hash 0c921baa291a4af4. Reproduce with
python3 scripts/fetch_sources.py && python3 scripts/ingest_from_cache.py && python3 scripts/build_cards_v2.py.
Known limitations
Retrieval is below target. Paraphrase recall is the weak spot; corpus growth added distractors that dedupe did not fully remove.
First-call index build takes a few seconds on a cold checkout (measured ~6 s on one machine, ~19 s on another; later queries are sub-second).
Not yet implemented:
kind: check|guidance, deterministicfix_refs, official-source CWE enrichment, real-lab end-to-end evaluation.Unverified: 8 of 12 tool adapters; the Telegram
secret_tokenclaim; two project-declared licences.Card text is untrusted DATA — never executable instructions or system policy (see
AGENTS.md).
Licence & attribution
Content: CC BY-SA 4.0, where provenance and upstream terms permit; attribution and ShareAlike preserved. Unlicensed / reference-only sources are not redistributed.
Code: MIT.
Human legal review recommended. No OWASP endorsement is implied.
Contributing
See CONTRIBUTING.md. New cards require provenance: source repo, path, anchor, commit, licence.
Security
See SECURITY.md for private vulnerability reporting.
Citation
See CITATION.cff.
Available Tools
7 toolsdetect_stackB
Fingerprint a codebase path and return ranked platforms + recommended profiles.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It implies a read-only scan of a path but never confirms it is non-destructive, says nothing about permissions, cost, or what happens with an invalid path, and gives only a bare sketch of the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with zero filler: verb, resource, and output all present. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description owns return-value explanation; 'ranked platforms + recommended profiles' is a helpful but thin sketch. Combined with the total absence of usage guidance, it is only minimally adequate for a one-param entry-point tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the single parameter has no description, so the description must compensate. 'A codebase path' gives the parameter basic meaning (a filesystem location to scan) but adds no format, relative-vs-absolute, or validation detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Fingerprint') and resource ('a codebase path') plus the output ('ranked platforms + recommended profiles'). This makes it distinguishable from siblings like get_profile or search_checks, though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to use this versus get_profile, search_checks, or start_report, and no prerequisites such as required access to the path. The agent must infer the entry-point role from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_checkC
Fetch one full check card by id.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it discloses almost nothing: no read-only confirmation beyond the verb 'Fetch', no permission requirements, no error behavior for a missing id, and no sense of cost or rate limits. 'Full check card' hints that the complete object is returned but does not define it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with zero filler, and the resource and scope are front-loaded. It is appropriately sized for a trivial one-parameter lookup.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-id read with no output schema, the description is minimally adequate but leaves the agent guessing about the return shape and failure modes. The absence of annotations or an output schema means a little more context would have been cheap and useful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the single undocumented parameter. 'By id' does clarify that the id selects the check, adding meaning beyond the bare 'string' type, but gives no format, prefix, or source for the id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Fetch'), resource ('check card'), and scope ('one ... by id'), which is enough to distinguish it from the plural sibling search_checks. It stops short of explicitly naming search_checks as the alternative, so it is clear but not sibling-differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or named alternatives are given. The only implied guidance is that you must already have an id, which is derived from the schema rather than the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_profileC
Return the ordered launch-gate checks for a platform profile.
| Name | Required | Description | Default |
|---|---|---|---|
| gate | No | ||
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It only implies a read operation and notes the results are 'ordered'; it says nothing about permissions, whether a profile must exist first, pagination, or the response shape. 'Ordered' is a small genuine behavioral detail, which lifts it above the bare minimum.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is efficient, though its brevity reflects under-specification rather than disciplined economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters, an unexplained enum, no output schema, and no annotations, the description is far too thin. It neither defines the parameters nor describes what the returned checks look like, leaving the agent without the information needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the two parameters, and it does not. The 'name' parameter is only obliquely hinted at by 'platform profile', and the 'gate' enum ('fast'/'full') is never mentioned, despite 'launch-gate' suggesting a connection the agent must guess at.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ('Return') with a resource ('ordered launch-gate checks for a platform profile'), so the general action is inferable. However, the core nouns are unexplained jargon: it never says what a 'platform profile' is or how a profile differs from a check, so the agent cannot confidently separate it from siblings like get_check or search_checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool, no prerequisites, and no mention of alternatives. Sibling tools such as search_checks and get_check plausibly overlap, and the description does nothing to route the agent between them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_toolsC
List scanner tool adapters, optionally for a platform.
| Name | Required | Description | Default |
|---|---|---|---|
| platform | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and discloses almost nothing: no indication that it is a read-only enumeration, no auth/permission requirements, no pagination or result-size behavior, and no statement of what happens when the platform filter matches nothing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the resource front-loaded and no filler. It is efficient, though its brevity reflects under-specification rather than tight writing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a listing tool with no output schema, the description should describe what the list contains (adapter names, IDs, supported platforms). It omits return shape entirely and gives no behavioral context, leaving an agent unable to predict results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate for the single parameter. It does clarify that 'platform' is an optional filter rather than a required selector, which adds some meaning, but it never says what values are accepted (name, ID, slug?) or whether the match is exact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'List' and resource 'scanner tool adapters' are identifiable, but 'tool adapters' is internal jargon that an agent cannot confidently map to the sibling tools (detect_stack, search_checks, get_profile). It does not distinguish this listing tool from related lookups like get_check or search_checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'optionally for a platform' implies the parameter narrows results, but there is no guidance on when to call this versus detect_stack, get_profile, or search_checks, and no statement of prerequisites or expected use context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_checksC
Free-text search over check cards with structured filters.
| Name | Required | Description | Default |
|---|---|---|---|
| k | No | ||
| query | Yes | ||
| domain | No | ||
| platform | No | ||
| severity | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full behavioral burden and discloses almost nothing. It does not say whether results are ranked, capped by 'k', paginated, permission-scoped, or what happens when filters conflict with the query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though its brevity tips into under-specification rather than purposeful conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter search tool with zero schema descriptions, no annotations, and no output schema, one sentence is not enough. The agent lacks filter semantics, result-limit behavior, and any notion of what is returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 5 parameters, and the description only gestures at 'free-text' (query) and 'structured filters' without naming domain, platform, severity, or explaining 'k' (results cap?). It does not compensate for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search) and resource (check cards) plus the two retrieval modes (free-text and structured filters). It does not name or contrast with the closest sibling, get_check, so an agent must infer the single-card vs multi-card distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or alternative tools are mentioned. The phrase 'free-text search ... with structured filters' only loosely implies usage; nothing tells the agent to prefer this over get_check or list_tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_reportC
Create a security report skeleton for a target.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full behavioral burden and delivers little. It does not say what state is created, whether the call is idempotent for a repeated target, whether an existing report is overwritten, or whether any identifier is returned for use in later steps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the action verb front-loaded and no filler. Its brevity is efficient rather than padded, though it is arguably under-specified rather than truly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool in a security workflow, with no annotations, no output schema, and an undocumented parameter, the description omits what an agent needs: target format, expected return (report handle/id), and where this fits relative to submit_result. What exists is adequate but clearly incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single 'target' parameter is undocumented. The description only echoes the word 'target' ('for a target') without specifying its format (URL, hostname, IP, scope expression), so it does not compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a security report skeleton') plus the object it acts on ('a target'), which is enough to separate it from the read-oriented siblings (detect_stack, get_profile, search_checks, get_check, list_tools). It stops short of explicitly contrasting itself with submit_result, the other write-side sibling, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus alternatives. It never says whether this is the first step of a workflow, whether it must precede submit_result, or whether it can be called repeatedly for the same target.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_resultC
Record one check result (pass/fail/n/a/unknown) with evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| status | Yes | ||
| evidence | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It implies a mutation via 'Record' but says nothing about whether results are overwritable, idempotent, session-scoped, or subject to rate limits — meaningful gaps for a write tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is appropriately sized, though its brevity is part of why the semantics and workflow gaps above remain unaddressed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write tool with no annotations, no output schema, and 0% schema description coverage on three parameters, the description is under-specified. It omits prerequisites, the meaning of 'id', and what happens to previously recorded results for the same check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists the status values (already enumerated in the schema) and mentions 'evidence', but never explains what 'id' refers to — presumably a check id from get_check/search_checks — nor whether evidence is required for certain statuses.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record one check result') and enumerates the accepted status values, which is more than a tautology. It does not, however, distinguish itself from the sibling start_report or clarify the relationship between recording results and starting a report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this tool versus the read-only siblings (get_check, search_checks) or start_report. Notably, it never states the prerequisite that a report must presumably be started first, leaving the agent to infer the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.9.0- First observed
detect_stack - First observed
get_check - First observed
get_profile - First observed
list_tools - First observed
search_checks - First observed
start_report - First observed
submit_result
TDQS
Scored across 7 tools
Each tool targets a distinct resource and action: fingerprinting (detect_stack), profile retrieval (get_profile), discovery (search_checks, list_tools), point fetch (get_check), and report lifecycle (start_report, submit_result). get_check vs search_checks and get_profile vs get_check are clearly distinguished by resource type and lookup mode. No two tools could be reasonably confused for one another.
All seven tools follow a strict snake_case verb_noun pattern (detect_stack, get_profile, search_checks, get_check, list_tools, start_report, submit_result). The convention is uniform with no camelCase or stylistic deviations, making intent predictable from names alone.
Seven tools is well-scoped for a security knowledge-base workflow that spans detection, lookup, and reporting. Each tool covers a necessary step with no redundant or filler entries.
The surface covers the full scan workflow: detect stack, resolve a profile, search/read checks, create a report, and submit results. However, there is no way to retrieve, finalize, or export the report after start_report, which is a minor lifecycle gap an agent must work around.
Maintenance
Related MCP Connectors
AI-security knowledge as MCP: standards-mapped tools (OWASP, NIST, MITRE) for AI agents.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
Related MCP Servers
- AlicenseAqualityBmaintenanceAn MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.24MIT
- AlicenseBqualityBmaintenanceEnables LLM clients to access DevSecOps tooling such as CI/CD pipeline status, vulnerability triage, log search, and dependency scanning through MCP, turning AI copilots into security-aware engineering partners.6MIT
- FlicenseBqualityCmaintenanceEnables AI agents to perform comprehensive, zero-infrastructure codebase analysis through 24 MCP tools, covering security, quality, architecture, type safety, git history, and dead code detection with high precision and local privacy.45-
- AlicenseAqualityCmaintenanceEnables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.3Apache 2.0