Security scanner for AI agents and MCP servers: injection, jailbreak, tool abuse.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
PRO pricing & payment info: 44 probes / 20 attack classes / 0-100 score / CI gate / per-class remediation, 0.15 XNO (ERC-20 or Lightning) or card.
This tool takes no arguments.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
claude mcp add --transport http mcp-agent-security https://llmrt-companion.manhliemcn4euwlu.workers.dev/mcp-agent-security
PRO pricing & payment info: 44 probes / 20 attack classes / 0-100 score / CI gate / per-class remediation, 0.15 XNO (ERC-20 or Lightning) or card.
No arguments.
{
"type": "object",
"properties": {}
}Machine-readable autonomous purchase procedure: how an agent pays (0.15 XNO, or USDC on Base via x402) and receives the PRO download with no human in the loop (callback push + poll fallback).
No arguments.
{
"type": "object",
"properties": {}
}Poll a scan by job id (returned by run_free_scan) until status=done.
| Argument | Type | Description |
|---|---|---|
| job_id* | string |
{
"type": "object",
"required": [
"job_id"
],
"properties": {
"job_id": {
"type": "string"
}
}
}Free LLM agent security review in ~35s. Two parts: (1) 8 live adversarial probes (jailbreak / prompt injection / system-prompt extraction / tool abuse) against your agent spec, and (2) a deterministic static audit of which guardrails the spec text itself is missing. Returns a 0-100 risk score, per-finding evidence, and a paste-ready guardrail sentence for each gap.
| Argument | Type | Description |
|---|---|---|
| spec* | string | Your agent / system prompt (>=20 chars) |
{
"type": "object",
"required": [
"spec"
],
"properties": {
"spec": {
"type": "string",
"description": "Your agent / system prompt (>=20 chars)"
}
}
}Judge one delivery against the task's own acceptance rule and return {verdict: accepted|rejected, reason}. Called by the brick.blue hub when this seat is drawn as validator. Judges only machine-checkable criteria (json_schema / contains / fields); a task with no such rule is accepted, because rejecting needs evidence.
| Argument | Type | Description |
|---|---|---|
| input | any | |
| title | string | |
| result | any | |
| taskId | string | |
| attemptId | string | |
| description | string |
{
"type": "object",
"required": [],
"properties": {
"input": {},
"title": {
"type": "string"
},
"result": {},
"taskId": {
"type": "string"
},
"attemptId": {
"type": "string"
},
"description": {
"type": "string"
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 3, 2026.
No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.
Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.