Practical Notes
- Data point: the README example shows the server running on port 8718.
- Quant: run scans against staging first; promote to CI only after false-positive tuning.
Pattern: build a reproducible red-team harness
To avoid one-off, non-repeatable results:
- pin the dataset version (CSV),
- log model + parameters,
- and store scan outputs as artifacts.
Pattern: scan tool servers too
If your agent uses MCP servers, treat them as part of your attack surface:
- scan repo code,
- scan remote URLs before deployment,
- and add allowlists for file/network capabilities.
FAQ
Q: Is it open-source? A: Yes. The repo is Apache-2.0 licensed.
Q: Can it run without an MCP client? A: Yes. You can run the scanner directly as a CLI.
Q: What’s the safest rollout? A: Start on staging and log everything; then gradually enable CI gates.