PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
Custom rule files, each {"filename": "0094-local.xml", "xml": "<group>...</group>"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files.
Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit.
Wazuh manager version: 4.14.7 or 4.14.9.
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
| Argument | Type | Description |
|---|---|---|
| files* | array | Custom rule files, each {"filename": "0094-local.xml", "xml": "<group>...</group>"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files. |
| api_key | string | Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit. |
| wazuh_version | string | Wazuh manager version: 4.14.7 or 4.14.9. |
{
"type": "object",
"title": "audit_wazuh_rulesArguments",
"required": [
"files"
],
"properties": {
"files": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
},
"title": "Files",
"description": "Custom rule files, each {\"filename\": \"0094-local.xml\", \"xml\": \"<group>...</group>\"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files."
},
"api_key": {
"type": "string",
"title": "Api Key",
"default": "",
"description": "Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit."
},
"wazuh_version": {
"type": "string",
"title": "Wazuh Version",
"default": "4.14.9",
"description": "Wazuh manager version: 4.14.7 or 4.14.9."
}
}
}Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.
| Argument | Type | Description |
|---|---|---|
| evidence* | string | Raw output of the commands above, pasted as one text block (up to 20 KB). |
{
"type": "object",
"title": "check_php2shellArguments",
"required": [
"evidence"
],
"properties": {
"evidence": {
"type": "string",
"title": "Evidence",
"description": "Raw output of the commands above, pasted as one text block (up to 20 KB)."
}
}
}Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.
| Argument | Type | Description |
|---|---|---|
| hostname* | string | Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused. |
{
"type": "object",
"title": "check_post_quantum_tlsArguments",
"required": [
"hostname"
],
"properties": {
"hostname": {
"type": "string",
"title": "Hostname",
"description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused."
}
}
}Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.
| Argument | Type | Description |
|---|---|---|
| hostname* | string | Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused. |
{
"type": "object",
"title": "check_tls_certificateArguments",
"required": [
"hostname"
],
"properties": {
"hostname": {
"type": "string",
"title": "Hostname",
"description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused."
}
}
}Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).
| Argument | Type | Description |
|---|---|---|
| logs* | array | Raw log lines exactly as the agent would forward them, one event per item. |
| rules | array | Optional custom rule files: [{"filename": "0096-local.xml", "xml": "<group>...</group>"}]. Filename order matters: files load by name together with the stock ruleset. |
| decoders | array | Optional custom decoder files, same shape as rules. |
| log_format | string | Wazuh log_format, e.g. syslog or json. |
{
"type": "object",
"title": "test_wazuh_ruleArguments",
"required": [
"logs"
],
"properties": {
"logs": {
"type": "array",
"items": {
"type": "string"
},
"title": "Logs",
"description": "Raw log lines exactly as the agent would forward them, one event per item."
},
"rules": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
},
"title": "Rules",
"default": [],
"description": "Optional custom rule files: [{\"filename\": \"0096-local.xml\", \"xml\": \"<group>...</group>\"}]. Filename order matters: files load by name together with the stock ruleset."
},
"decoders": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
},
"title": "Decoders",
"default": [],
"description": "Optional custom decoder files, same shape as rules."
},
"log_format": {
"type": "string",
"title": "Log Format",
"default": "syslog",
"description": "Wazuh log_format, e.g. syslog or json."
}
}
}