EyalSec
PYPI · EYALSEC-MCP
Read your EyalSec security events, machines, runs and rules from an AI assistant.
Available components
Last scanned (14 hours ago)
Scores higher than 61% of PyPI servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 31 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2150 tokens (~113/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 17 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 16 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 15 Oct 26 70
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Analysed pypi/eyalsec-mcp@0.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 31 packages
| Packages resolved | 31 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ci_findings CI findings ~127
What programs on one es-python machine reported since a moment: counts by severity, how many are at or above a threshold, which ones no earlier run had reached, and the findings themselves (ids, not values).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | How many findings to list, worst first. |
| machine | string | yes | The machine's name. |
| min_severity | – | – | Threshold; the default is 'high'. |
| since | string | yes | Start of the window: RFC3339 (2026-10-07T12:00:00Z), Unix seconds or an HTTP date. |
Structured output declared, but exposes no named fields.
No examples provided.
event_counts Event counts ~103
How many events the account has: per product list, live versus suppressed, and the count toward the monthly event quota (pass view for the number one product's list is capped by).
| Name | Type | Req | Description |
|---|---|---|---|
| bucket | – | – | 'live' (default: events not suppressed), 'suppressed', or 'all'. |
| view | – | – | Which product's events: 'python' (es-python) or 'browser' (es-chromium). Omit for every product on the account. |
Structured output declared, but exposes no named fields.
No examples provided.
event_map Events map ~369
The es-python events as a graph: which sources untrusted data came from, which files it was read from, and which operations (sinks) it reached, each with event and hit counts and the worst severity. Prefer a date window on a large account.
| Name | Type | Req | Description |
|---|---|---|---|
| advanced | – | – | The events page condition builder, passed through as is: {"match": "all"|"any", "conditions": [{"field": "sink", "op": "contains", "value": "sql", "negate": false}]}. |
| bucket | – | – | 'live' (default: events not suppressed), 'suppressed', or 'all'. |
| date_from | – | – | Start date, YYYY-MM-DD or RFC3339. |
| date_to | – | – | End date, YYYY-MM-DD or RFC3339; includes that whole day. |
| focus_file | – | – | Focus on one file path, exactly as listed in 'files'. |
| focus_sink | – | – | Focus on one sink, exactly as listed in 'sinks'. |
| focus_source | – | – | Focus on one source category (or 'other') and list its newest events. |
| labels | – | – | Label ids (from list_labels) to keep. |
| machine | – | – | One machine, by its display name (exact match). |
| run_uid | – | – | Only events produced by this run (a run_uid from list_runs or get_event). es-python only. |
| severity | – | – | Keep only these severities. |
| sink_exclude | – | – | Case-insensitive regex; drop events whose sink label ('where') matches. |
| sink_include | – | – | Case-insensitive regex; keep only events whose sink label ('where') matches. |
| sources | – | – | Keep only these taint source categories. |
| tags | – | – | Impact classes to keep, such as 'xss' or 'sqli'. |
Structured output declared, but exposes no named fields.
No examples provided.
event_stats Event statistics ~43
The dashboard summary: total hits, distinct event types, counts for the last hour, day and week, the top event types, recent events and a 14-day timeline.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
get_account Account ~44
The account's profile, limits and permissions, the API key's scope and expiry (never the key itself), and how far es-python setup has got, with the next step.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
get_event Get one event ~79
Get one event's full detail: stack trace, where the data came in (origin), where the value was created, nearby source code when the machine sends it, your note, and the runs (program invocations) that produced it.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | integer | yes | The event id (the 'id' field of a search_events result). |
Structured output declared, but exposes no named fields.
No examples provided.
get_event_uniqueness Unique-event definition ~70
What makes two detections count as the same event for one product and scope.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_kind | string | – | The product: 'python' or 'browser'. |
| machine | – | – | A machine's public_id (from list_machines), or omit for the account-wide (global) scope. |
Structured output declared, but exposes no named fields.
No examples provided.
get_taint_settings Taint settings ~65
Which kinds of incoming data a scope treats as untrusted. Each setting is on, off or unset (unset inherits from the level above).
| Name | Type | Req | Description |
|---|---|---|---|
| machine | – | – | A machine's public_id (from list_machines), or omit for the account-wide (global) scope. |
Structured output declared, but exposes no named fields.
No examples provided.
list_activity Activity log ~105
The account's audit trail, newest first, 50 per page, kept for 30 days: sign-ins, machine changes, key generation and API calls.
| Name | Type | Req | Description |
|---|---|---|---|
| action | – | – | One exact action name, such as 'machine.create' or 'auth.login'. |
| before_id | – | – | Next page: the 'id' of the last entry received. |
| before_ts | – | – | Next page: the 'time' of the last entry received. |
| outcome | – | – | Keep only this outcome. |
Structured output declared, but exposes no named fields.
No examples provided.
list_event_names Event names ~31
The distinct sink labels (the 'where' field) across the account's events, useful for building filters.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
list_filters Filters ~42
The account's event filters (standing blacklist or whitelist patterns on the events page).
| Name | Type | Req | Description |
|---|---|---|---|
| engine | – | – | 'python' or 'browser' for one product's Filters page. |
Structured output declared, but exposes no named fields.
No examples provided.
list_labels Labels ~31
The account's triage labels (id, name, color). Use an id in search_events' labels filter.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
list_machines List machines ~51
Every machine on the account: name, status, public_id, OS target, installed and newest build, Python version, product, and flags for a clone, a stalled install or an old copy still reporting.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
list_rule_templates Rule templates ~32
Every rule template the account can see (its own and the EyalSec ones), with their rules and categories.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
list_rules Rules ~62
The rules in one scope. Mode 1 = Hide, 2 = Show, 3 = Raise, 4 = Don't send.
| Name | Type | Req | Description |
|---|---|---|---|
| machine | – | – | A machine's public_id (from list_machines), or omit for the account-wide (global) scope. |
Structured output declared, but exposes no named fields.
No examples provided.
list_runs List runs ~114
The runs behind the account's events, newest first. A run is one invocation of one monitored program, with its command line, how many distinct events it produced and how many times. Pass a run_uid to search_events to see only that run's events.
| Name | Type | Req | Description |
|---|---|---|---|
| before | – | – | next_before from a previous call, to continue. |
| limit | integer | – | Rows per page. |
| machine | – | – | One machine, by its display name (exact match). |
| q | – | – | A case-insensitive piece of the command line. |
Structured output declared, but exposes no named fields.
No examples provided.
list_saved_searches Saved searches ~37
The account's saved events-page searches for one product.
| Name | Type | Req | Description |
|---|---|---|---|
| view | string | – | 'python' (default) or 'browser'. |
Structured output declared, but exposes no named fields.
No examples provided.
search_events Search events ~514
List events from the EyalSec account, newest first, with the same filters as the dashboard's events page. Follows the API's paging for you: a selective filter can return short or empty pages that still have more behind them, so this keeps reading until it has `limit` events, the history is exhausted, or it has read 10 pages. If next_cursor in the answer is not empty, call again with it to continue. Each event carries its id; pass it to get_event for the stack trace, origin and runs.
| Name | Type | Req | Description |
|---|---|---|---|
| advanced | – | – | The events page condition builder, passed through as is: {"match": "all"|"any", "conditions": [{"field": "sink", "op": "contains", "value": "sql", "negate": false}]}. |
| bucket | – | – | 'live' (default: events not suppressed), 'suppressed', or 'all'. |
| cursor | – | – | next_cursor from a previous call with the same filters, to continue. |
| date_from | – | – | Start date, YYYY-MM-DD or RFC3339. |
| date_to | – | – | End date, YYYY-MM-DD or RFC3339; includes that whole day. |
| labels | – | – | Label ids (from list_labels) to keep. |
| limit | integer | – | Stop once at least this many events are collected (whole pages of up to 100). |
| machine | – | – | One machine, by its display name (exact match). |
| run_uid | – | – | Only events produced by this run (a run_uid from list_runs or get_event). es-python only. |
| severity | – | – | Keep only these severities. |
| sink_exclude | – | – | Case-insensitive regex; drop events whose sink label ('where') matches. |
| sink_include | – | – | Case-insensitive regex; keep only events whose sink label ('where') matches. |
| sort | – | – | 'newest' (default) or 'severity' (most severe first). |
| sources | – | – | Keep only these taint source categories. |
| tags | – | – | Impact classes to keep, such as 'xss' or 'sqli'. |
| value_chars | integer | – | Cut each event's str_repr to this many characters (0 = no cut). |
| view | – | – | Which product's events: 'python' (es-python) or 'browser' (es-chromium). Omit for every product on the account. |
| xss_only | – | – | Only es-chromium events whose sink can run script. Needs view='browser'. |
Structured output declared, but exposes no named fields.
No examples provided.
supported_targets Supported targets ~57
The Linux distributions, architectures and Python versions es-python can be installed for. Needs no API key.
| Name | Type | Req | Description |
|---|---|---|---|
| os | – | – | An OS target such as 'ubuntu_24_04_x86_64' to list only the Python versions for it. |
Structured output declared, but exposes no named fields.
No examples provided.
How do I install the EyalSec MCP server?
EyalSec runs locally as a PyPI package, launched with uvx eyalsec-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · eyalsec-mcp
claude mcp add eyalsec-eyalsec-mcp -- uvx eyalsec-mcp
What is the EyalSec MCP server?
EyalSec is an MCP server listed in the public MCP registry as io.github.EyalSec/eyalsec-mcp. Read your EyalSec security events, machines, runs and rules from an AI assistant. This page covers its PyPI package (eyalsec-mcp).
Is the EyalSec MCP server safe to use?
EyalSec scores 55 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the EyalSec MCP server expose?
EyalSec exposes 19 tools: search_events, get_event, event_stats, event_counts, list_event_names, and 14 more. Their descriptions and schemas cost roughly 1,976 tokens of context every time the server is loaded.
Is the EyalSec MCP server still maintained?
EyalSec is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the EyalSec MCP server under?
EyalSec declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.