Axur Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Axur Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 5 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for the Axur cybersecurity platform. Provides read-only access to ticket data, enabling AI assistants to search, inspect, and analyze security incidents.
ticketsSearch and retrieve tickets.
| Action | Description |
|---|---|
list | Search/filter tickets with pagination and sorting |
get | Get a single ticket by key |
bulk_get | Get multiple tickets by comma-separated keys |
history | Get ticket change history |
types | List all supported ticket types |
ticket_detailsGet detailed information for a specific ticket.
| Action | Description |
|---|---|
fields | Ticket field values (status, type, domain, IP, etc.) |
texts | Comments, descriptions, evidence messages |
snapshots | Detection snapshots (domain info, ISP, content, digital location) |
attachments | List attachments for a detection |
lifecycle | Available state transitions |
takedown | Takedown options and eligibility |
timeline | Full ticket timeline |
ticket_statsRetrieve ticket statistics and metrics.
| Action | Description |
|---|---|
count_by_status | Ticket count by status (requires from, to, status) |
incident_by_type | Incidents grouped by threat type |
takedown_metrics | Takedown success rate, median time to notification |
internal_treatment | Internal treatment success rate and metrics |
takedown_uptime | Resolution uptime distribution (buckets: <1d, 2d, 5d, etc.) |
treatment_uptime | Treatment uptime distribution |
global_median | Median incidents across all Axur customers (13-month trend) |
global_mean | Mean incidents across all Axur customers |
segment_median | Median incidents for your market segment |
segment_mean | Mean incidents for your market segment |
git clone https://github.com/Just5ky/axur-mcp.git
cd axur-mcp
npm install
npm run buildcp .env.example .env
# Edit .env and add your Axur API tokenAdd to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"axur": {
"command": "node",
"args": ["/path/to/axur-mcp/dist/index.js"],
"env": {
"AXUR_API_TOKEN": "your_token_here"
}
}
}
}# Run directly
AXUR_API_TOKEN=your_token node dist/index.jsOnce connected to an AI assistant:
This server covers the read-only Axur Platform ticket APIs:
tickets-api — ticket search, retrieval, statstickets-core — field values, ticket typestickets-texts — textual data (comments, evidence)tickets-snapshots — detection snapshotstickets-attachments — attachment listingtickets-lifecycle — lifecycle state inspectiontickets-takedown — takedown status inspectiontickets-timeline — timeline historyThe Axur API enforces a rate limit of 60 requests per minute on stats endpoints. The server surfaces 429 errors directly — plan queries accordingly.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.