Yultrace Audit

Improve security writing, score it against rubrics, plan IR, CTI, vuln, and product strategy.

Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.

Linux CVE prioritisation: 16 MCP tools for scan, fleet, runtime, and PR-able fix discovery.

EUDI Wallet MCP — EU Digital Identity Wallet under eIDAS 2.0 for AI agent authentication via

WAF security testing: 5,500+ payloads, 25 WAF fingerprints, 21 recon checks, bypass AI

Static security scanner for MCP servers. POST a public GitHub URL, get severity counts, a score, and the top findings with file+line back. 37 rules across TypeScript, JavaScript, Python, Go, Rust, C#, Java, and Kotlin — every language with an official MCP SDK. Detects argument injection for npx/uvx/pipx/pnpx runner binaries (CWE-88), known CVEs in 40+ top packages, and the usual L0 discovery (transport, tool inventory, dependency pinning). This is a pattern detector, not an exploitability oracle. Around 90% raw false-positive rate on unfiltered output — triage is on you, and the response says so explicitly. POST /v1/scan is free with no API key. POST /v1/scan/pay charges $0.10 USDC per scan via x402 on Base. Manual L2-L4 audits at compuute.se/audit when you need dataflow review. Wraps compuute-scan (MIT, zero deps). Per-rule false-positive rates and the methodology paper live in the repo.