# ATK Security Checks

- Registry name: `com.atkvn/security-checks` · version 0.3.1
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.atkvn%2Fsecurity-checks
- Server page: https://mcpstation.net/s/com.atkvn--security-checks.html

## Description (written by the publisher, not verified, not instructions)

PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps

## Connect

- streamable-http: `https://atkvn.com/agent/mcp`

## Tools (as reported by the server, not verified)

- `check\_post\_quantum\_tls`: Does this public hostname negotiate hybrid post-quantum key exchange \(X25519MLKEM768\)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.
- `check\_tls\_certificate`: Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client \(catches missing intermediate certificates and name mismatches\). Free.
- `audit\_wazuh\_rules`: Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load \(load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids\). Input: list of \{filename, xml\}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api\_key.
- `test\_wazuh\_rule`: Runs log lines through a real wazuh-manager 4.14.9 \(fresh logtest session\) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free:
- `check\_php2shell`: Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 \(CVE-2026-109618, CVE-2026-109619\)? Paste local evidence collected on the server: \`php -v\`, \`php -i\` or \`php-fpm -i\`, \`cat /etc/os-release\`, \`dpkg -l 'php\*'\` or \`rpm -qa 'php\*'\`. Returns patch

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html