Bulwark
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BULWARK_NO_PROMO | No | Set to 1 to remove the short, labelled promo line that a few tools append pointing to ZagAIrot's Seatbelt Kit. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_skillsA | List every security skill (name, description, tags). Optionally filter by tag, e.g. 'ai', 'web', 'cloud', 'supply-chain'. |
| get_skillA | Return the full playbook for one skill. Call list_skills first for names. |
| search_securityC | Keyword search across all skills; returns best-matching skills with matching lines. |
| skills_for_taskB | Which skills to load before building something. task_type: web, api, mobile, cloud, llm, agent, data, pipeline, org. |
| secure_coding_checklistC | Pre-commit checklist for new code. language: python, js/ts, go, java, php, c, rust. feature: login, upload, payment, webhook, search, admin, ai-chat, password reset. |
| scan_codeA | Fast regex review of a snippet for common vulnerability patterns (secrets, injection, weak crypto, TLS off, XSS sinks, JWT bypass, SSRF, unsafe deserialization, unpinned CI refs). Heuristic: false positives and misses expected; complements SAST, never replaces it. |
| scan_pathA | Scan a local folder with the same heuristics as scan_code. Skips vendored/build folders, .env files and symlinks. Source lines are hidden by default so secrets are never echoed. Read-only. |
| about_zagairotA | Who makes Bulwark and what else ZagAIrot offers (paid and free), with links. Call only when the user asks about the maker, support, or enforcement beyond advice. |
| threat_modelC | STRIDE-per-element worksheet plus AI-specific threats for a described feature or system. |
| check_known_exploitedA | Search CISA's Known Exploited Vulnerabilities catalog (actively exploited: patch first). query = CVE id, vendor, or product keyword; 'recent' for newest additions. |
| lookup_cveB | Fetch a CVE from NIST NVD: description, CVSS, weaknesses, references. |
| check_package_vulnsA | Query OSV.dev for known vulnerabilities AND known-malicious-package advisories (MAL-*) for a dependency. ecosystem: PyPI, npm, Go, crates.io, Maven, RubyGems, NuGet, Packagist. Empty result does not prove the package is real or intended. |
| recent_ai_threat_sourcesA | Authoritative, regularly updated sources for AI-driven attacks and AI-system security. Fetch them when freshness matters; they change faster than this knowledge base. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| secure_build | Kick off a security-first build of a feature. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| ai-driven-attack-defense | Defending against attackers who use AI - phishing, voice/video deepfakes, automated vuln discovery, adaptive malware, agentic intrusion. |
| ai-generated-code-risks | Pitfalls specific to AI-written code - hallucinated packages, insecure defaults, over-trust - and a review routine. |
| api-security | REST/GraphQL/webhook API hardening against the OWASP API Top 10. |
| authn-session-management | Login, passwords, passkeys, MFA, sessions, JWTs, resets - and defenses against AI-scaled credential attacks. |
| authz-access-control | Authorization design - object-level checks, IDOR/BOLA, RBAC/ABAC, tenant isolation, agent permissions. |
| ci-cd-pipeline-security | Harden build pipelines - pinned actions, least-privilege tokens, OIDC, provenance, no secret exfiltration. |
| cloud-iac-security | Cloud and infrastructure-as-code hardening - IAM, network, storage, metadata, drift, posture scanning. |
| container-kubernetes-security | Secure images, runtime, and Kubernetes clusters. |
| cryptography-essentials | Which primitives to use, how, and what to avoid; key management and post-quantum readiness. |
| data-protection-breach-prevention | Prevent data breaches and limit damage - minimization, classification, encryption, access, exfil controls, backups. |
| input-validation-injection | Stop SQLi, XSS, command/template injection, SSRF, path traversal, XXE, deserialization. |
| llm-app-security | Building LLM-powered apps safely - prompt injection, excessive agency, data leakage, output handling (OWASP LLM Top 10). |
| logging-detection-response | What to log, how to alert, and an incident response loop that limits breach damage. |
| mcp-agent-security | Securing MCP servers, tool use, and autonomous coding agents - tool poisoning, confused deputy, token passthrough, sandboxing. |
| mobile-security | iOS/Android app hardening - storage, transport, auth, binary protection (OWASP MASVS). |
| privacy-compliance | Practical map of privacy and security regulations and breach-notification duties (not legal advice). |
| ransomware-resilience | Prevent, contain, and recover from ransomware and extortion, including double-extortion data theft. |
| secrets-management | Keep credentials out of code and logs; detect, rotate, and shrink the blast radius. |
| secure-coding-core | Baseline rules for any code you write - OWASP Top 10 mapped to concrete habits. |
| supply-chain-security | Stop malicious or vulnerable dependencies - lockfiles, malware feeds, age gates, SBOM, provenance, typosquatting. |
| threat-modeling | A lightweight, repeatable threat-modeling method with STRIDE, attack trees, abuse cases, and AI-specific threats. |
| vetted-open-source-tools | Time-tested open source security tools, how to adopt them without getting burned, and how Aikido approaches it. |
| web-frontend-security | Browser-side defenses - CSP, headers, cookies, CORS, CSRF, clickjacking, third-party scripts. |
TDQS
Scored across 13 tools
Most tools target a distinct resource+action (get_skill vs scan_code vs scan_path vs threat_model vs lookup_cve), and the two scanners are explicitly separated by snippet vs folder. However, three tools (list_skills, search_security, skills_for_task) all answer 'which skills exist,' and check_known_exploited vs lookup_cve both do CVE lookups, so an agent can plausibly misselect on those pairs. Descriptions do provide clear tie-breaking rules, keeping it above a 3.
All names are snake_case, but conventions are mixed: most are verb-first (list_skills, get_skill, scan_code, check_package_vulns) while four are noun-first (threat_model, secure_coding_checklist, skills_for_task, recent_ai_threat_sources). Verbs are also used synonymously (check vs lookup), and about_zagairot breaks the domain pattern entirely.
Thirteen tools is well within the ideal range and each one maps to a distinct step in a security workflow (discover skills, get playbook, checklist, scan, threat model, vulnerability lookup, freshness sources). No filler tools are present, and the single off-topic tool (about_zagairot) is small and clearly gated.
The surface covers discovery, guidance, static scanning, threat modeling, and vulnerability intelligence (NVD, CISA KEV, OSV) well, forming an end-to-end advisory loop. Minor gaps exist: no way to consolidate findings into a report, no remediation/fix-suggestion tool, no compliance or framework mapping, and lookup_cve appears limited to CVE ids rather than package/version-to-CVE resolution (partially offset by check_package_vulns).