llmsecurity-mcp

A local, dependency-free MCP (Model Context Protocol) server exposing LLMSecurity.dev's security checks as tools an AI coding agent (Claude Code, Claude Desktop, Codex, or any other MCP-capable client) can call directly — no network access, no API key, nothing leaves your machine.

Everything here runs on the Python standard library only. No pip install of third-party packages is required to use it.

Tools

Tool	What it does
scan_agent_config	Scans AGENTS.md, CLAUDE.md, SKILL.md, .claude/, .codex/ for prompt-injection patterns, including base64-hidden instructions.
check_tool_call_safety	Classifies a proposed tool call (command + path) as allow, ask, or deny — catches recursive deletes, remote-pipe-to-shell, and credential exfiltration/access patterns.
scan_prompt_for_injection	Runs the same jailbreak/injection pattern detectors LLMSecurity.dev's hosted scanner uses, against arbitrary text.
scan_rag_source	Scans local RAG source documents for indirect prompt injection, secrets, and PII before you chunk/embed them.
map_security_coverage	Maps a scan report's findings to OWASP LLM Top 10 (2025) / NIST AI RMF / MITRE ATLAS — evidence for a review, not a certification.
scan_skill_trust	Inventories skills and MCP package manifests (SKILL.md, package.json, mcp.json) for external instruction sources, risky install scripts, and exposed credentials.
analyze_model_abuse	Analyzes model-API telemetry (bursts, cost drains, repeated probes, auth failures) for abuse signals — no prompt bodies required or accepted.
check_mcp_policy	Evaluates a proposed MCP tool call against a local allowlist/approval/destination policy.

Install

git clone https://github.com/afterdarksys/llmsecurity-mcp
cd llmsecurity-mcp
python3 -m pytest tests/ -q   # optional: confirm it works in your environment (51 tests)

No dependencies to install — every tool here is pure standard-library Python (3.10+).

Configure

Claude Code

claude mcp add llmsecurity -- python3 -m workers.agent_security.mcp_server

Run that from inside your llmsecurity-mcp checkout (or pass --cwd /path/to/llmsecurity-mcp if you're not there).

Claude Desktop (or any client using claude_desktop_config.json-style config)

{
  "mcpServers": {
    "llmsecurity": {
      "command": "python3",
      "args": ["-m", "workers.agent_security.mcp_server"],
      "cwd": "/absolute/path/to/llmsecurity-mcp"
    }
  }
}

Standalone CLIs

Each pillar also has its own CLI, usable without any MCP client at all:

python3 -m workers.agent_security.cli scan-config .
python3 -m workers.agent_security.cli scan-prompt --file instructions.txt
python3 -m workers.agent_security.cli check-tool --tool-name Bash --input-json '{"command":"rm -rf /"}'
python3 -m workers.supply_chain.cli --mode trust .
python3 -m workers.supply_chain.cli --mode secrets .
python3 -m workers.data_security.cli ./docs
python3 -m workers.governance.cli path/to/scan-report.json
python3 -m workers.model_security.cli model-events.jsonl
python3 -m workers.mcp_security.cli --policy mcp-policy.json --tool send_email --arguments '{"to":"vendor@example.com"}'

Run --help on any of them for exact flags — they're independent, small argparse wrappers around the same functions the MCP server calls.

What's deliberately not here

This is a subset of the full LLMSecurity.dev platform, extracted specifically because it has zero third-party dependencies and needs no network access or API key:

• PII anonymization/deanonymization (workers.data_security.anonymize) needs presidio-analyzer + a spaCy model and is not included — it lives in the main platform.
• Active scanning (Garak/Promptmap/PyRIT against a live model target) is a hosted/authenticated service, not a local tool — see llmsecurity-cli for the CLI that talks to it.
• Output-side response scanning (refusal/banned-content/malicious-URL detection on a model's reply) is part of the hosted prompt-scanner API, also reachable from llmsecurity-cli.

Related

• llmsecurity.dev — the hosted platform (dashboard, community prompt library, active scanning).
• llmsecurity-cli — the adllmsec command-line client for the hosted API.

License

MIT — see LICENSE.