72hours security check
Scan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.
使うべきか
品質と安全性
検出事項（1）
- LOWTool 'service_info' description lacks action verbservice_info 内
ツール定義とプロトコルへの準拠に関する自動分析に基づいています。
コンテキストコスト
これは、サーバーのツールがモデルのコンテキストに読み込まれるたびに消費されるおおよそのトークン数です。数が多いほど、ほかのタスクに使える注意が減ります。
インストール
ワンクリックインストール
これを `claude_desktop_config.json` ファイルに追加してください:
{
"mcpServers": {
"72hours": {
"url": "https://oboe-handiness-enroll.ngrok-free.dev/mcp/service/rpc"
}
}
}リモートエンドポイント
https://oboe-handiness-enroll.ngrok-free.dev/mcp/service/rpcstreamable-httpできること
ツール一覧
ツール（15）
🟢service_info
Learn the whole workflow and available service capabilities before creating work.
入力スキーマ
{
"type": "object",
"properties": {},
"title": "service_infoArguments"
}🟡create_workspace
Create a private, expiring workspace. Save its capability only in the user's AI conversation.
入力スキーマ
{
"type": "object",
"properties": {},
"title": "create_workspaceArguments"
}🔴close_workspace(workspace_token)
Revoke this workspace and its result access. Does not cancel already submitted backend jobs.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
}
},
"required": [
"workspace_token"
],
"title": "close_workspaceArguments"
}⚪start_scan(workspace_token, repository_url, request_id, authorized)
Start a REAL public GitHub scan. User authorization required. Reuse request_id on identical retries.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"repository_url": {
"title": "Repository Url",
"type": "string"
},
"request_id": {
"title": "Request Id",
"type": "string"
},
"authorized": {
"default": false,
"title": "Authorized",
"type": "boolean"
}
},
"required": [
"workspace_token",
"repository_url",
"request_id"
],
"title": "start_scanArguments"
}🟢get_scan(workspace_token, scan_id)
Poll every >=10 seconds; on done return actual commit, coverage and up to 50 LLM-input findings.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
}
},
"required": [
"workspace_token",
"scan_id"
],
"title": "get_scanArguments"
}⚪start_analysis(workspace_token, scan_id, fingerprint)
Start GPU Red/Blue review of one real scan finding. Same inputs deduplicate.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
},
"fingerprint": {
"title": "Fingerprint",
"type": "string"
}
},
"required": [
"workspace_token",
"scan_id",
"fingerprint"
],
"title": "start_analysisArguments"
}🟢get_analysis(workspace_token, analysis_id)
Poll GPU status and delivery gates; inference can take several minutes. Never fake ready results.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"analysis_id": {
"title": "Analysis Id",
"type": "string"
}
},
"required": [
"workspace_token",
"analysis_id"
],
"title": "get_analysisArguments"
}🟢get_fix_prompt(workspace_token, analysis_id)
Get a gated real LLM proposal. Agent must inspect code, check repo/commit, fix and test in its workspace.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"analysis_id": {
"title": "Analysis Id",
"type": "string"
}
},
"required": [
"workspace_token",
"analysis_id"
],
"title": "get_fix_promptArguments"
}出力スキーマ
{
"type": "object",
"properties": {
"result": {
"title": "Result",
"type": "string"
}
},
"required": [
"result"
],
"title": "get_fix_promptOutput"
}⚪rescan(workspace_token, previous_scan_id, request_id, authorized)
Rescan the SAME repository default branch. Only published changes are visible; unpushed edits are not.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"previous_scan_id": {
"title": "Previous Scan Id",
"type": "string"
},
"request_id": {
"title": "Request Id",
"type": "string"
},
"authorized": {
"default": false,
"title": "Authorized",
"type": "boolean"
}
},
"required": [
"workspace_token",
"previous_scan_id",
"request_id"
],
"title": "rescanArguments"
}🟢generate_report(workspace_token, scan_id)
Generate the service's report from owned server scan and available analyses, indicating incomplete work.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
}
},
"required": [
"workspace_token",
"scan_id"
],
"title": "generate_reportArguments"
}🟢incident_report(workspace_token, scan_id, kind, incident)
Draft only; NEVER submits. kind: assess/incident-24h/privacy-72h. incident requires discovered_at ISO time; optional organization {name,service_name,contact_email}, summary, incident_types, damage, actions_taken, personal_info {leaked: confirmed/suspected/none, affected_count, items}. Use only user-confirmed facts.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
},
"kind": {
"title": "Kind",
"type": "string"
},
"incident": {
"additionalProperties": true,
"title": "Incident",
"type": "object"
}
},
"required": [
"workspace_token",
"scan_id",
"kind",
"incident"
],
"title": "incident_reportArguments"
}⚪audit_repository(repository_url, request_id, authorized, workspace_token, max_analyses)
One call security audit of a PUBLIC GitHub repo the user is authorized to scan. Creates a workspace if workspace_token is empty (keep the returned token private), scans, waits up to 90 s, starts GPU analysis for the top max_analyses (0-5) findings and returns summary + next steps. Reuse request_id only for the SAME request.
入力スキーマ
{
"type": "object",
"properties": {
"repository_url": {
"title": "Repository Url",
"type": "string"
},
"request_id": {
"title": "Request Id",
"type": "string"
},
"authorized": {
"default": false,
"title": "Authorized",
"type": "boolean"
},
"workspace_token": {
"default": "",
"title": "Workspace Token",
"type": "string"
},
"max_analyses": {
"default": 3,
"title": "Max Analyses",
"type": "integer"
}
},
"required": [
"repository_url",
"request_id"
],
"title": "audit_repositoryArguments"
}🟢audit_status(workspace_token, scan_id)
Scan summary, analysis statuses and which fix prompts (get_fix_prompt) are ready, in one call.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
}
},
"required": [
"workspace_token",
"scan_id"
],
"title": "audit_statusArguments"
}🟢check_fix(workspace_token, scan_id, request_id, authorized)
After fixes are PUSHED to the default branch: rescan the same repo against scan_id and list resolved, persisting, new and key-reissue-needed findings. Same commit means the fix was not pushed yet.
入力スキーマ
{
"type": "object",
"properties": {
"workspace_token": {
"title": "Workspace Token",
"type": "string"
},
"scan_id": {
"title": "Scan Id",
"type": "string"
},
"request_id": {
"title": "Request Id",
"type": "string"
},
"authorized": {
"default": false,
"title": "Authorized",
"type": "boolean"
}
},
"required": [
"workspace_token",
"scan_id",
"request_id"
],
"title": "check_fixArguments"
}⚪verify_demo(mode, verify_job_id)
Runtime proof on the DEMO target only: isolated sandbox replays attacks before/after the fix and runs functional tests. mode: reference (human fix) or ai (Red/Blue generated attacks and fix). Not the user's repo. If a previous call returned status queued/running, pass its verify_job_id to keep polling the same job.
入力スキーマ
{
"type": "object",
"properties": {
"mode": {
"default": "reference",
"title": "Mode",
"type": "string"
},
"verify_job_id": {
"default": "",
"title": "Verify Job Id",
"type": "string"
}
},
"title": "verify_demoArguments"
}コミュニティ
エビデンス