Koskamo

ATK Security Checks MCP

An MCP server providing security validation tools for AI agents, including post-quantum TLS checks, certificate verification, Wazuh rule auditing, and CVE detection. It allows agents to verify cryptographic configurations, test SIEM rule firing on a real manager, and check for specific vulnerabilities like PHP2Shell without requiring user accounts or API keys for basic usage.

Visit ATK New Technology

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

ATK Security Checks MCP logo, by ATK New TechnologyVendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-01Operated by ATK New Technology
MCP endpoint (Streamable HTTP)
https://atkvn.com/agent/mcp
Vendor documentation

What you can do with it

  • Verify if a public hostname negotiates hybrid post-quantum key exchange
  • Audit Wazuh custom rules for load-order issues and shadowing
  • Test Wazuh rules and decoders against log lines on a real manager
  • Check server output for PHP2Shell vulnerability indicators

Source and maintenance

Vendor evidenceRegistry 0.3.1
mcp-registry: com.atkvn/security-checks@0.3.1Project website

Protocol and capabilities

Server
atk-security-checks 0.3.0
MCP protocol
2025-06-18
Tools
5 advertised
Resources
0 advertised
Resource templates
0 advertised
Prompts
0 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": false
  },
  "prompts": {
    "listChanged": false
  },
  "resources": {
    "subscribe": false,
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Use check_post_quantum_tls or check_tls_certificate for any public hostname (one ordinary TLS handshake per probe, no scanning). Use audit_wazuh_rules with the custom rule files exactly as named in /var/ossec/etc/rules/. The free audit returns counts and a preview; the full report needs an API key from https://atkvn.com/agent/. For the PHP2Shell CVEs (CVE-2026-109618/109619) run check_php2shell with output you collect on the server itself.

Tools

5 advertised

check_post_quantum_tls — Check post-quantum TLS
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.

check_post_quantum_tls input schema
{
  "type": "object",
  "title": "check_post_quantum_tlsArguments",
  "required": [
    "hostname"
  ],
  "properties": {
    "hostname": {
      "type": "string",
      "title": "Hostname",
      "description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused."
    }
  }
}
check_post_quantum_tls annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_tls_certificate — Check TLS certificate
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.

check_tls_certificate input schema
{
  "type": "object",
  "title": "check_tls_certificateArguments",
  "required": [
    "hostname"
  ],
  "properties": {
    "hostname": {
      "type": "string",
      "title": "Hostname",
      "description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused."
    }
  }
}
check_tls_certificate annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
audit_wazuh_rules — Audit Wazuh custom rules
Advertised by the server during the last successful anonymous check.
Advertised read-only

Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.

audit_wazuh_rules input schema
{
  "type": "object",
  "title": "audit_wazuh_rulesArguments",
  "required": [
    "files"
  ],
  "properties": {
    "files": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true
      },
      "title": "Files",
      "description": "Custom rule files, each {\"filename\": \"0094-local.xml\", \"xml\": \"<group>...</group>\"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files."
    },
    "api_key": {
      "type": "string",
      "title": "Api Key",
      "default": "",
      "description": "Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit."
    },
    "wazuh_version": {
      "type": "string",
      "title": "Wazuh Version",
      "default": "4.14.9",
      "description": "Wazuh manager version: 4.14.7 or 4.14.9."
    }
  }
}
audit_wazuh_rules annotations
{
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
test_wazuh_rule — Test Wazuh rule on a real manager
Advertised by the server during the last successful anonymous check.
Advertised read-only

Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).

test_wazuh_rule input schema
{
  "type": "object",
  "title": "test_wazuh_ruleArguments",
  "required": [
    "logs"
  ],
  "properties": {
    "logs": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "title": "Logs",
      "description": "Raw log lines exactly as the agent would forward them, one event per item."
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true
      },
      "title": "Rules",
      "default": [],
      "description": "Optional custom rule files: [{\"filename\": \"0096-local.xml\", \"xml\": \"<group>...</group>\"}]. Filename order matters: files load by name together with the stock ruleset."
    },
    "decoders": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true
      },
      "title": "Decoders",
      "default": [],
      "description": "Optional custom decoder files, same shape as rules."
    },
    "log_format": {
      "type": "string",
      "title": "Log Format",
      "default": "syslog",
      "description": "Wazuh log_format, e.g. syslog or json."
    }
  }
}
test_wazuh_rule annotations
{
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
check_php2shell — Check PHP2Shell (CVE-2026-109618/109619)
Advertised by the server during the last successful anonymous check.
Advertised read-only

Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.

check_php2shell input schema
{
  "type": "object",
  "title": "check_php2shellArguments",
  "required": [
    "evidence"
  ],
  "properties": {
    "evidence": {
      "type": "string",
      "title": "Evidence",
      "description": "Raw output of the commands above, pasted as one text block (up to 20 KB)."
    }
  }
}
check_php2shell annotations
{
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

0 advertised

No prompt definitions available.

Resources

0 advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
2204 ms
95th percentile latency
2204 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 2204 ms · metadata changed · 5 tool(s), 0 resource(s), 0 resource template(s), 0 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http atk-security-checks-mcp https://atkvn.com/agent/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add atk-security-checks-mcp --url https://atkvn.com/agent/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable atk-security-checks-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "atk-security-checks-mcp": {
      "url": "https://atkvn.com/agent/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "atk-security-checks-mcp": {
      "type": "streamableHttp",
      "url": "https://atkvn.com/agent/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start atk-security-checks-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "atk-security-checks-mcp": {
      "type": "http",
      "url": "https://atkvn.com/agent/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http atk-security-checks-mcp https://atkvn.com/agent/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "atk-security-checks-mcp": {
      "url": "https://atkvn.com/agent/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "atk-security-checks-mcp": {
      "serverUrl": "https://atkvn.com/agent/mcp"
    }
  }
}

Let your agent find its tools

Find servers like ATK Security Checks MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 6,746

Do you run ATK Security Checks MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing