secure-hulk - Secure-Hulk is a security scanner for Model Contex

项目说明

<di="center">
<img src="src/assets/SecureHulkLogo.png" alt="Secure-Hulk Logo" width="400"/>

# Secure-Hulk

Security scanner for Model Context Protocol servers and tools.
</div>

O

Secure-Hulk is a security scanner for Model Context Protocol (MCP) servers and tools. It helps identify potential security in MCP configurations, such as prompt injection, tool poisoning, cross-origin escalation, data exfiltration, and toxic agent flows.

Features

Installation

Usage

Scanning MCP Configurations

Using OpenAI Moderation API for Harmful Content Detection

Secure-Hulk now supports using OpenAI's Moderation API to detect harmful content in entity descriptions. This provides a more robust detection mechanism for identifying potentially harmful, unsafe, or unethical content.

To use the OpenAI Moderation API:

Options:

The OpenAI Moderation API provides several ad:

1. More accurate detection: The API uses ad AI models to detect harmful content, which can catch subtle harmful content that pattern matching might miss.
2. Categorized results: The API provides detailed categories for flagged content (hate, harassment, self-harm, sexual content, , etc.), helping you understand the specific type of harmful content detected.
3. Confidence scores: Each category includes a confidence score, allowing you to set appropriate thresholds for your use case.
4. Regular updates: The API is regularly updated to detect new types of harmful content as OpenAI's policies evolve.

The API can detect content in these categories:

If the OpenAI Moderation API check fails for any reason, Secure-Hulk will automatically fall back to pattern-based detection for prompt injection .

Using Hugging Face Safety Models for Content Detection

Secure-Hulk now supports Hugging Face safety models for ad AI-powered content moderation. This provides additional options beyond OpenAI's Moderation API, including open-source models and specialized toxicity detection.

To use Hugging Face safety models:

Options:

A models include:

Preset configurations:

Example with multiple guardrails:

The Hugging Face integration provides several ad:

1. Model di: Choose from multiple specialized safety models
2. Open-source options: Use community-de models
3. Customizable thresholds: Fine-tune sensitivity for your use case
4. Specialized detection: Models focused on specific types of harmful content
5. Cost flexibility: pricing options including free tiers

If the Hugging Face API check fails for any reason, Secure-Hulk will log the error and continue with other security checks.

Inspecting MCP Configurations

Managing the Whitelist

Configuration

Scan Options

Whitelist Options

Sponsors

<di="center">
<h3>Proudly sponsored by LambdaTest</h3>
<picture>
<source media="(prefers-color-scheme: dark)" srcset="src/assets/White_512px.png">
<source media="(prefers-color-scheme: light)" srcset="src/assets/Black_512px.png">
<img src="src/assets/Black_512px.png" alt="Lambdates Logo" width="150"/>
</picture>
</div>

License

MIT

项目信息

开发语言：TypeScript

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Secure-Hulk is a security scanner for Model Context Protocol (MCP) servers and tools. It helps identify potential security vulnerabilities in MCP configurations, such as prompt injection, tool poisoning, cross-origin escalation, data exfiltration, and toxic agent flows.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。