firebreak_best_practiceLABSCO SUMMARY
Scope-locked, non-destructive, and every finding comes with its proof.
The guardrails are the interesting part: rate limiting to the target, no lateral movement or subdomain enumeration, and no requests that modify data — probing only. That, plus evidence attached to each finding, is what makes it safe to hand an autonomous client. The vulnerability database is aimed squarely at code an AI wrote, covering patterns like auth applied to some routes but not others, or a permissive RLS policy that shipped.
What it is
A Rust MCP server that gives an AI client an actual penetration-testing toolkit rather than a CLI wrapper. It ships 32 scan checks, a security knowledge base, and a vulnerability database of 47 patterns specific to AI-generated code. Every finding carries the real HTTP request and response behind it.
What you get
- Scans in three shapes — fast critical-and-high only, a full pen test in black, gray or white box mode, or a focused pass on one area such as auth — plus progress and stop control —
firebreak_scan_quick,firebreak_scan_full,firebreak_scan_target,firebreak_scan_status,firebreak_scan_stop - Findings you can work from: a summary with an A-F security score, full evidence for one finding, generated fix code for a named framework, and a re-test that confirms the fix landed —
firebreak_results,firebreak_finding_detail,firebreak_finding_fix,firebreak_replay - Comparison and reporting: diff two scans into fixed, new and unchanged; list previous scans for a target; export JSON, Markdown or HTML; produce a non-technical summary —
firebreak_compare,firebreak_scan_history,firebreak_report_generate,firebreak_report_executive - Knowledge tools that hit no external service: best practices by topic, insecure-pattern scanning of pasted code, vulnerability explanations, stack-specific checklists, OWASP Top 10 mapping, and RLS policy analysis of SQL —
firebreak_best_practice,firebreak_check_pattern,firebreak_explain_vuln,firebreak_security_checklist,firebreak_owasp_check,firebreak_analyze_rls - Multi-step attack chain analysis over stored results —
firebreak_attack_chain
Requirements
No account and no key. Build from source with cargo build --release, or run docker compose up -d; either way it listens on port 9090 and clients connect to http://localhost:9090/mcp over JSON-RPC 2.0. FIREBREAK_HOST, FIREBREAK_PORT and RUST_LOG are the configurable environment variables. Licensed AGPL-3.0, which matters if you run it as a service for others.
Setup effort
Build from source — git clone https://github.com/protonese3/Firebreak.git
USE CASES
01
Getting a first read on whether an app is exposed
Run the quick scan, read the summary and its A-F score, then open the evidence for anything critical or high.
02
Closing a finding and proving it closed
Generate fix code for your framework, apply it, then re-test that single finding rather than rerunning the whole scan.
03
Checking whether a release made things better or worse
Diff the new scan against the previous one to separate what was fixed, what is new, and what stayed the same.
04
Reviewing code before it ever ships
Paste the code for pattern scanning, analyze the SQL policies, and pull a checklist for your stack — none of which touches an external service.
05
Handing results to people who do not read scanners
Map findings to OWASP Top 10 and export an executive summary alongside the technical report.
20 tools
Listed in project docs. Your client may show a different list.
firebreak_check_patternfirebreak_explain_vulnfirebreak_security_checklistfirebreak_owasp_checkfirebreak_analyze_rlsfirebreak_scan_quickfirebreak_scan_fullfirebreak_scan_targetfirebreak_scan_statusfirebreak_scan_stopfirebreak_resultsfirebreak_finding_detailfirebreak_finding_fixfirebreak_replayfirebreak_comparefirebreak_scan_historyfirebreak_attack_chainfirebreak_report_generatefirebreak_report_executiveBEFORE YOU INSTALL
What to know first
Tools you get
20 tools named in the project's documentation.
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
Option 1: Build from source
TERMINAL
git clone https://github.com/protonese3/Firebreak.git
cd Firebreak
cargo build --release
./target/release/firebreakMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"firebreak": {
"url": "http://localhost:9090/mcp"
}
}
}Windsurf
WINDSURF · JSON
{
"mcpServers": {
"firebreak": {
"serverUrl": "http://localhost:9090/mcp"
}
}
}
