ATK Security Checks

{
  "mcpServers": {
    "com.atkvn/security-checks": {
      "url": "https://atkvn.com/agent/mcp"
    }
  }
}

Indexed tools

Tool metadata and schemas come from the remote server and are untrusted. Indexing only lists tools; it never calls them.

5 shown · authentication unknown

• Audit Wazuh custom rules

  audit_wazuh_rules

  Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.

  Schema valid · SHA-256 e90544224a02…

  View input schema

  {
    "type": "object",
    "properties": {
      "files": {
        "description": "Custom rule files, each {\"filename\": \"0094-local.xml\", \"xml\": \"<group>...</group>\"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files.",
        "items": {
          "additionalProperties": true,
          "type": "object"
        },
        "title": "Files",
        "type": "array"
      },
      "wazuh_version": {
        "default": "4.14.9",
        "description": "Wazuh manager version: 4.14.7 or 4.14.9.",
        "title": "Wazuh Version",
        "type": "string"
      },
      "api_key": {
        "default": "",
        "description": "Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit.",
        "title": "Api Key",
        "type": "string"
      }
    },
    "required": [
      "files"
    ],
    "title": "audit_wazuh_rulesArguments"
  }

• Check PHP2Shell (CVE-2026-109618/109619)

  check_php2shell

  Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.