A
licenseNot graded
qualityC
maintenanceSimulates malicious MCP server behaviors — spawning shells, running encoded PowerShell, and reading decoy credential files — so defenders can validate Sysmon, Wazuh, and Sigma detections against real process lineage from an MCP stdio session.
MIT