Test and guard the three places agents get attacked: the MCP servers they trust, the text they read and the commands they run.
Scan MCP servers and configs for tool poisoning, hidden instructions, exposed secrets, risky commands and rug pulls. 27 rules, SARIF for CI, offline, Python.
View MCP Security Scanner: Tool Poisoning, Secrets, Rug Pull ChecksTest your LLM app or agent against 119 prompt injection attacks: system prompt leaks, RAG injection, tool hijack, exfiltration, encodings. CI-ready.
View Prompt Injection Test Suite: 119 Test Cases for LLM Apps + CI8 ready Cursor hooks: block rm -rf and force pushes, protect .env, allowlist MCP servers, scan prompts for secrets, run tests on stop. Installer + validator.
View Cursor Hooks Pack: 8 Ready hooks.json Hooks + Installer + ValidatorThree tools that test and guard the parts of an AI agent attackers actually go after: the MCP servers it trusts, the text it reads, and the commands it runs.
| Folder | What it does |
|---|---|
| plugins/mcp-security-scanner/ | mcpscan.py: scan MCP client configs (Claude, Cursor, VS Code, Codex) and live servers for tool poisoning, hidden instructions, tool shadowing, secrets in configs, risky launch commands; pin/verify catches rug pulls (a tool description that changes after you approved it). 27 rules, SARIF/JSON for CI |
| plugins/prompt-injection-test-suite/ | pitest.py: 119 prompt injection test cases (overrides, system prompt extraction, RAG document injection, tool hijack, markdown-image exfiltration, 12 encodings, 10 languages) with deterministic checks against your app, any OpenAI-compatible endpoint or your HTTP API; guards.py output guards; JUnit for CI |
| plugins/cursor-hooks-pack/ | 8 Cursor hooks (block dangerous shell commands, secret-file reads, unknown MCP servers and secrets in prompts; format on edit; audit log; run tests before the agent stops) with an installer, a policy.json, and hookcheck.py to validate and simulate hooks |
./run_tests.sh # every tool's tests (53 tests, Python 3.10+, no dependencies, offline)
./demo.sh # each tool on its examplesBought separately: $29 + $29 + $19 = $77.
The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh passed on Python 3.13 and 3.10.
This folder is a Claude Code plugin marketplace (.claude-plugin/marketplace.json) for the two tools that ship skills:
/plugin marketplace add ./ai-agent-security-bundle
/plugin install mcp-security-scanner@yat-agent-security
/plugin install prompt-injection-test-suite@yat-agent-securityThe Cursor hooks install into a project with python3 plugins/cursor-hooks-pack/tools/install.py <project>. Every tool also runs on its own with python3: see the README in each folder.
The limits in each tool's README apply. None of these makes an agent "secure": the scanner and the hooks are rule-based tripwires, and a passing prompt injection run only means those 119 attacks failed today. Formats were checked against the MCP spec and Cursor docs in November 2026 and can change. Not affiliated with Anthropic, Cursor, OpenAI or the MCP project.
Zip, 116 KB, v1.0, 84 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with Anthropic, Cursor, OpenAI or the MCP project.
Scan MCP servers for tool poisoning, test your LLM app against 119 prompt injection attacks, and guard Cursor's agent with 8 hooks. 3 tools, $49 (save $28).
90 ready Kiro steering files (fileMatch, auto, manual) for Next.js, Django, Rails, Supabase, Laravel, FastAPI, SvelteKit, Expo, plus an installer and checker.
View Kiro Steering Files: 90 Ready Files for 8 Stacks + Checker90 ready Cline rules and skills for 8 stacks, a Memory Bank setup, and a checker and converter for .clinerules. Conditional paths rules, offline, Python.
View Cline Rules Pack: 90 Rules + Skills, Memory Bank, Checker12 ready GitHub Copilot custom agents (.agent.md) with least-privilege tools: reviewer, planner, test writer, security, debugger and more, plus a checker.
View Copilot Custom Agents Pack: 12 .agent.md Agents + CheckerShort weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.