ATK Security Checks

com.atkvn/security-checks · v0.3.1

New (7 days)Tools changed (7 days)

Measured by MCP Station

Last check	Reachable
Checked at	—
Check success 7 / 30 days	—
First-try success 30 days	—
Median response	—
Lookups 30 days	—
Authentication	No auth
MCP version	2025-06-18
Rank score	—
Declared risk	Read-only (all tools declare readOnlyHint)
Capabilities declared	prompts, resources, tools
Tool definitions	5 tools · with description 100% · input schema is an object 100% · read/destructive hints 100%

PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps

streamable-http · https://atkvn.com/agent/mcp

claude mcp add --transport http security-checks https://atkvn.com/agent/mcp

{
  "mcpServers": {
    "security-checks": {
      "url": "https://atkvn.com/agent/mcp"
    }
  }
}

check_post_quantum_tls
Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.
check_tls_certificate
Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.
audit_wazuh_rules
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
test_wazuh_rule
Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free:
check_php2shell
Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patch

2026-10-24: check_post_quantum_tls, check_tls_certificate, audit_wazuh_rules, test_wazuh_rule, check_php2shell
2026-10-23: check_post_quantum_tls, check_tls_certificate, audit_wazuh_rules, test_wazuh_rule

Website · JSON · Text for agents · Registry updated 2026-10-23