Connect
Claude Code:
claude mcp add --transport http atk-checks https://atkvn.com/agent/mcp
Any client that takes a JSON config:
{
"mcpServers": {
"atk-checks": { "type": "http", "url": "https://atkvn.com/agent/mcp" }
}
}
Listed in the official MCP Registry as com.atkvn/security-checks. HTTP reference: atkvn.com/agent/v1/docs · discovery: /openapi.json, /.well-known/x402.
Tools and prices
| Check | MCP tool / HTTP | Price |
|---|---|---|
| Does a public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? | check_post_quantum_tlsGET /agent/v1/pq-tls/{hostname} | Free |
| Certificate issuer, expiry, days left, and whether the chain verifies for the name from a strict client | check_tls_certificateGET /agent/v1/certificate/{hostname} | Free |
| Up to 10 hostnames in one call, with what to fix for each | POST /agent/v1/tls-batch | USD 0.05 per call (x402) |
Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load: file load order against the stock ruleset, missing parents, colliding ids | audit_wazuh_rules (counts + 2 findings)POST /agent/v1/wazuh-audit/preview | Free |
| The same audit, every finding with its fix | POST /agent/v1/wazuh-audit | USD 2 per call (x402) |
| New. Run your rules and decoders on a real wazuh-manager 4.14.9 against your log lines: which decoder and rule matched, whether your rule fired, load warnings such as 7617/7619 | test_wazuh_rulePOST /agent/v1/wazuh-testfire/free | Free: 1 line with your files, 3 with the stock ruleset, summary |
| The same test with up to 10 log lines, decoded fields, groups, MITRE and the full alert | POST /agent/v1/wazuh-testfire | USD 0.10 per call (x402) |
A paid call without payment answers 402 Payment Required with the x402 terms in the Payment-Required header. Any x402 client pays and retries automatically. Settlement is USDC on Base mainnet.
What the checks do, and what they do not
- Each TLS check is one ordinary handshake to port 443 per probe type, the same as a browser opening the page. No port scanning, no login, no exploitation.
- Only public DNS names are accepted. IP addresses, internal names and names that resolve to private addresses are refused.
- Results are cached for an hour, and the service has an hourly capacity limit.
- The TLS checks see the public front door only. What sits behind a CDN or load balancer is not visible from outside, and the answer says so.
- The rule test runs in an isolated wazuh-manager with no network, one request at a time, with a fresh logtest session per call; your files are removed after the call. It uses the logtest engine: frequency and timeframe rules need event history that one call does not have, and a rule can match in logtest yet not alert in live analysisd in some cases (wazuh/wazuh#39536).
- The Wazuh audit is static. It reads your files against the stock ruleset of 4.14.7 or 4.14.9. The load-order behaviour it flags was measured on those versions in our lab; see the 7617/7619 note.
Early service. This went live on 22 October 2026. If a result looks wrong, write to support@atkvn.com with the hostname or the rule file; a wrong paid answer is refunded.