Labsco
MCP SERVER

Firebreak

by protonese3 ↗

Security testing driven by the assistant: 20 tools that scan a target, explain each finding with the HTTP request that proves it, generate the fix, and re-test it.

Vulnerability Scanning & Application Security
Summary
Scope-locked, non-destructive, and every finding comes with its proof.

The guardrails are the interesting part: rate limiting to the target, no lateral movement or subdomain enumeration, and no requests that modify data — probing only. That, plus evidence attached to each finding, is what makes it safe to hand an autonomous client. The vulnerability database is aimed squarely at code an AI wrote, covering patterns like auth applied to some routes but not others, or a permissive RLS policy that shipped.

What it is

A Rust MCP server that gives an AI client an actual penetration-testing toolkit rather than a CLI wrapper. It ships 32 scan checks, a security knowledge base, and a vulnerability database of 47 patterns specific to AI-generated code. Every finding carries the real HTTP request and response behind it.

What you get
  • Scans in three shapes — fast critical-and-high only, a full pen test in black, gray or white box mode, or a focused pass on one area such as auth — plus progress and stop control — `firebreak_scan_quick`, `firebreak_scan_full`, `firebreak_scan_target`, `firebreak_scan_status`, `firebreak_scan_stop`
  • Findings you can work from: a summary with an A-F security score, full evidence for one finding, generated fix code for a named framework, and a re-test that confirms the fix landed — `firebreak_results`, `firebreak_finding_detail`, `firebreak_finding_fix`, `firebreak_replay`
  • Comparison and reporting: diff two scans into fixed, new and unchanged; list previous scans for a target; export JSON, Markdown or HTML; produce a non-technical summary — `firebreak_compare`, `firebreak_scan_history`, `firebreak_report_generate`, `firebreak_report_executive`
  • Knowledge tools that hit no external service: best practices by topic, insecure-pattern scanning of pasted code, vulnerability explanations, stack-specific checklists, OWASP Top 10 mapping, and RLS policy analysis of SQL — `firebreak_best_practice`, `firebreak_check_pattern`, `firebreak_explain_vuln`, `firebreak_security_checklist`, `firebreak_owasp_check`, `firebreak_analyze_rls`
  • Multi-step attack chain analysis over stored results — `firebreak_attack_chain`
Requirements

No account and no key. Build from source with `cargo build --release`, or run `docker compose up -d`; either way it listens on port 9090 and clients connect to http://localhost:9090/mcp over JSON-RPC 2.0. `FIREBREAK_HOST`, `FIREBREAK_PORT` and `RUST_LOG` are the configurable environment variables. Licensed AGPL-3.0, which matters if you run it as a service for others.