ATK Security Checks
PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps
Should I use this
Quality & Safety
Findings (4)
- HIGHTool poisoning patterns detected
- MEDIUMTool description contains URL to non-standard domainin test_wazuh_rule
- LOWTool 'check_post_quantum_tls' description lacks action verbin check_post_quantum_tls
- LOWTool 'check_tls_certificate' description lacks action verbin check_tls_certificate
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"security-checks": {
"url": "https://atkvn.com/agent/mcp"
}
}
}Remote endpoints
https://atkvn.com/agent/mcpstreamable-httpWhat it can do
Tool inventory
Tools (5)
🟢check_post_quantum_tls(hostname)
Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.
Input Schema
{
"type": "object",
"properties": {
"hostname": {
"description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused.",
"title": "Hostname",
"type": "string"
}
},
"required": [
"hostname"
],
"title": "check_post_quantum_tlsArguments"
}🟢check_tls_certificate(hostname)
Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.
Input Schema
{
"type": "object",
"properties": {
"hostname": {
"description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused.",
"title": "Hostname",
"type": "string"
}
},
"required": [
"hostname"
],
"title": "check_tls_certificateArguments"
}🟢audit_wazuh_rules(files, wazuh_version, api_key)
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
Input Schema
{
"type": "object",
"properties": {
"files": {
"description": "Custom rule files, each {\"filename\": \"0094-local.xml\", \"xml\": \"<group>...</group>\"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files.",
"items": {
"additionalProperties": true,
"type": "object"
},
"title": "Files",
"type": "array"
},
"wazuh_version": {
"default": "4.14.9",
"description": "Wazuh manager version: 4.14.7 or 4.14.9.",
"title": "Wazuh Version",
"type": "string"
},
"api_key": {
"default": "",
"description": "Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit.",
"title": "Api Key",
"type": "string"
}
},
"required": [
"files"
],
"title": "audit_wazuh_rulesArguments"
}🟢test_wazuh_rule(logs, rules, decoders, log_format)
Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).
Input Schema
{
"type": "object",
"properties": {
"logs": {
"description": "Raw log lines exactly as the agent would forward them, one event per item.",
"items": {
"type": "string"
},
"title": "Logs",
"type": "array"
},
"rules": {
"default": [],
"description": "Optional custom rule files: [{\"filename\": \"0096-local.xml\", \"xml\": \"<group>...</group>\"}]. Filename order matters: files load by name together with the stock ruleset.",
"items": {
"additionalProperties": true,
"type": "object"
},
"title": "Rules",
"type": "array"
},
"decoders": {
"default": [],
"description": "Optional custom decoder files, same shape as rules.",
"items": {
"additionalProperties": true,
"type": "object"
},
"title": "Decoders",
"type": "array"
},
"log_format": {
"default": "syslog",
"description": "Wazuh log_format, e.g. syslog or json.",
"title": "Log Format",
"type": "string"
}
},
"required": [
"logs"
],
"title": "test_wazuh_ruleArguments"
}🟢check_php2shell(evidence)
Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.
Input Schema
{
"type": "object",
"properties": {
"evidence": {
"description": "Raw output of the commands above, pasted as one text block (up to 20 KB).",
"title": "Evidence",
"type": "string"
}
},
"required": [
"evidence"
],
"title": "check_php2shellArguments"
}Community
Evidence