Skip to main content
Glama
subodhkc

haiec-ai-agent-security-free-mcp

by subodhkc
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault

No arguments

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}

Tools

Functions exposed to the LLM to take actions

NameDescription
scan_ai_securityA

Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Produces deterministic findings with explicit coverage, Security Concern Families, Scan Receipts, and Evidence Envelopes.

USE when a developer asks to:

  • "check this for security issues"

  • "audit this task before I push"

  • "review this change for security problems"

  • "scan this AI agent" or "scan this AI app"

  • "check my LLM application"

  • "security review this PR"

  • "is this safe to merge"

  • "check this before deployment"

  • "audit this code for vulnerabilities"

  • "run a security scan"

  • "check for security risks before commit"

  • "review this implementation before pushing"

Also use for:

  • reviewing AI/LLM/agent source code for security

  • validating AI code before merge

  • checking an agent before deployment

  • reviewing RAG or model integration security

  • looking for unsafe AI source-code patterns

  • checking AI-output-to-dangerous-action flows

  • checking AI source-code secrets/security controls

DO NOT use for:

  • actual LLM response/content verification (use verify_llm_content)

  • tenant/RLS/cross-customer isolation (use scan_tenant_isolation)

  • generic compliance questionnaires or compliance certification

  • generic non-AI source scanning where no AI check applies

This tool performs static analysis only. It does NOT execute target code, make network requests, or emit telemetry. BLOCK findings are advisory — deployment enforcement is handled by check_deploy_security (not yet implemented).

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.4/5.0

Scored across 1 tool

Disambiguation5/5

Only one tool is exposed, so there is no possibility of confusing it with another tool. The description also explicitly lists out-of-scope use cases, which helps clarify the intended boundary.

Naming Consistency5/5

The single tool name 'scan_ai_security' follows a clear snake_case verb_noun convention. With only one name, there are no conflicting patterns or inconsistent verb styles to penalize.

Tool Count3/5

One tool is a minimal, thin surface for the stated security-audit workflow. It can handle the core scanning request, but the surface feels sparse given the referenced verify_llm_content, scan_tenant_isolation, and not-yet-implemented check_deploy_security operations.

Completeness3/5

The scan tool covers static analysis and returns structured findings, but the workflow has a clear dead end: BLOCK findings are advisory and deployment enforcement is explicitly not yet implemented. There is also no way to manage or act on findings beyond the initial scan.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources