62
grade C
10 days ago
glama
Defense MCP
This is a Linux OS hardening tool. Take a fresh install and immediately harden the heck out of it using just your favourite LLM agent and natural language prompts. "Make my system secure" or "Do a full security audit of my system."
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — dns_security (line 701: /^0\.0\.0\.0\s+(\S+)/.exec(line.trim()))
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: MCP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
DEFENSE_MCP_ALLOWED_DIRS— "": "/tmp,/home,/var/log"config
DEFENSE_MCP_ALLOWED_TOOLSconfig
DEFENSE_MCP_AUTO_INSTALL— false node build/index.jsconfig
DEFENSE_MCP_BACKUP_DIRconfig
DEFENSE_MCP_BACKUP_ENABLED— true Auto-backup before system changesconfig
DEFENSE_MCP_CHANGELOG_PATHconfig
DEFENSE_MCP_COMMAND_TIMEOUTconfig
DEFENSE_MCP_DRY_RUN— "": "true",config
DEFENSE_MCP_LOG_FILEconfig
DEFENSE_MCP_LOG_LEVEL— info Log verbosity (debug/info/warn/error)config
DEFENSE_MCP_LOG_MAX_FILESconfig
DEFENSE_MCP_LOG_MAX_SIZEconfig
DEFENSE_MCP_MAX_OUTPUT_SIZEconfig
DEFENSE_MCP_NETWORK_TIMEOUTconfig
DEFENSE_MCP_POLICY_DIRconfig
DEFENSE_MCP_PREFLIGHT— true Enable pre-flight dependency checksconfig
DEFENSE_MCP_PREFLIGHT_BANNERS— true Show pre-flight status in tool outputconfig
DEFENSE_MCP_PROTECTED_PATHSconfig
DEFENSE_MCP_QUARANTINE_DIRconfig
DEFENSE_MCP_RATE_LIMIT_GLOBALconfig
DEFENSE_MCP_RATE_LIMIT_PER_TOOLconfig
DEFENSE_MCP_RATE_LIMIT_WINDOWconfig
DEFENSE_MCP_READ_ONLYconfig
DEFENSE_MCP_REDACT_OUTPUTconfig
DEFENSE_MCP_REQUIRE_CONFIRMATION— true Require confirmation for destructive actionsconfig
DEFENSE_MCP_RUNTIME_PATH_VERIFYconfig
DEFENSE_MCP_SUDO_TIMEOUTconfig
DEFENSE_MCP_THIRD_PARTY_INSTALL— Requires explicit =true to enableconfig
DEFENSE_MCP_TIMEOUT_DEFAULTconfig
DEFENSE_MCP_TIMEOUT_LYNISconfig
DEFENSE_MCP_TIMEOUT_NMAPconfig
DISPLAYconfig
LOGNAME🔐 secret
MCP_API_KEYconfig
MCP_PORT— 3100 HTTP server port (when MCP_TRANSPORT=http)config
MCP_TRANSPORT— stdio Transport mode: stdio or httpconfig
SSH_CONNECTIONconfig
SSH_TTYconfig
SUDO_ASKPASSconfig
WAYLAND_DISPLAY// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/bottobot-defense-mcp-server-odpyzn)commit: fbd5e81cb100a2d32696433dde77509c667bd6f2
code hash: 7a48c2d60f09a8e4e075c9d2ac82c77015e7e723a0bcb25649c7ce2b30c24d4f
verified: 4/11/2026, 2:26:45 PM