The RedTeam ML API MCP server enables authorized AI/ML API penetration testing and red-team simulation, allowing security teams to test ML/LLM API endpoints for vulnerabilities, score responses, and generate compliance-aligned reports.
list_attack_packs: Discover all available local defensive red-team attack packs (e.g., baseline_safe, aws_2026_professional).
run_red_team: Execute a safe attack pack against an authorized ML API endpoint with configurable options including HTTP method (POST/GET), custom headers, bearer token authentication, rate limiting (delay between requests), per-request timeout, maximum case limits, dry-run mode, and custom input field names.
evaluate_text: Score a single ML API response for defensive risk signals such as prompt injection, sensitive data leakage, unsafe behavior, or policy violations.
generate_report: Produce a structured remediation report from a previous red-team run, summarizing findings and recommended fixes.
generate_operating_model: Create a strategic operating model brief for security teams, red teams, AI architects, platform teams, and executives — mapping red-team findings to guardrail controls, architecture controls, owners, and release decisions.
run_ai_api_pentest: Run a full authorized penetration-test workflow including scope definition, endpoint recon, adversarial campaign execution, evidence capture, bypass-rate metrics, and saved JSON/HTML report artifacts — with explicit authorization gating and alignment to SOC 2, ISO 27001, and GDPR control areas.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@RedTeam ML API MCP run safe red team pack on my chat API"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Professional AI/ML API penetration testing and red-team simulation over MCP.
RedTeam ML API MCP is a defensive red-team simulator for ML and LLM APIs.
It exposes MCP tools and a CLI that let a security team run controlled test packs against an authorized AI/ML API endpoint, score the responses, generate evidence, and align results to SOC 2, ISO 27001, and GDPR control areas.
This project is designed as an adversarial validation plane for AI systems.
The mindset shift is:
From prompt lists to measurable security controls.
From one-time red-team demos to continuous adversarial regression.
From model safety only to full AI system safety: model, prompt, RAG, tools, identity, UI, and deployment.
From guardrails as a checkbox to guardrails as evidence-backed controls.
From pass/fail reports to release decisions with owners, evidence, and remediation.
For AWS-facing work, position it as:
RedTeam ML API MCP validates whether Bedrock Guardrails, application policies, RAG boundaries, and agent tool controls are working before release.
Related MCP server: MCP Pentest
The red-team value is the pentest workflow:
Define authorized scope and rules of engagement.
Perform safe endpoint recon without infrastructure exploitation.
Run adversarial AI test campaigns.
Capture evidence for each case.
Calculate bypass rate by category.
Map failures to guardrail and architecture controls.
Align results to SOC 2, ISO 27001, and GDPR control areas.
Produce JSON and HTML artifacts for security review.
This is designed for authorized AI/ML API penetration testing. It does not perform credential attacks, destructive actions, third-party scanning, or infrastructure exploitation.
The runner is built to avoid unnecessary pressure on target systems:
Default delay between test cases.
Per-request timeout.
Optional max-case limit.
Dry-run mode that validates scope without sending prompts.
Explicit --authorized gate for pentest mode.
Example low-impact run:
redteam-ml-api pentest \
--target-url http://127.0.0.1:8765/chat \
--pack aws_2026_professional \
--authorized \
--delay-seconds 1.0 \
--max-cases 5Many ML APIs are deployed with weak safety, privacy, or operational controls. This project tests those controls before production by simulating realistic but safe adversarial requests.
The simulator focuses on:
Prompt-injection resilience.
Sensitive data leakage.
Unsafe model behavior.
Excessive confidence or hallucinated policy claims.
Weak API contract behavior.
Regression testing between model versions.
flowchart LR
Operator["Security / MLOps Operator"] --> Client["MCP Client\n(Codex, Claude, Cursor, etc.)"]
Client --> Server["RedTeam ML API MCP Server\nstdio JSON-RPC"]
Server --> Packs["Attack Packs\nJSON test cases"]
Server --> Runner["Test Runner\nrate limits + request templates"]
Runner --> Target["Authorized ML API\n/score, /chat, /predict"]
Target --> Runner
Runner --> Evaluator["Response Evaluator\nleakage + refusal + policy checks"]
Evaluator --> Store["Local Evidence\nJSON reports"]
Store --> Client
Client --> Report["Risk Summary + Remediation Plan"]sequenceDiagram
participant U as Operator
participant C as MCP Client
participant M as RedTeam MCP Server
participant A as Attack Pack
participant T as Target ML API
participant E as Evaluator
U->>C: Run red-team pack against staging API
C->>M: tools/call run_red_team
M->>A: Load prompt-injection / leakage cases
loop Each test case
M->>T: Send authorized HTTP request
T-->>M: Return model/API response
M->>E: Score response
end
E-->>M: Findings + risk score
M-->>C: Structured report
C-->>U: Summary and fixeslist_attack_packsLists available local test packs.
run_red_teamRuns an attack pack against an authorized target.
Input:
{
"target_url": "http://localhost:8000/chat",
"pack": "baseline_safe",
"method": "POST",
"timeout_seconds": 10
}evaluate_textScores a single response for risk signals.
Input:
{
"text": "model response here"
}generate_reportCreates a compact remediation report from a previous run result.
generate_operating_modelCreates a strategic operating-model brief for security teams, red teams, AI architects, platform teams, and executive sponsors.
It maps red-team categories to guardrail controls, architecture controls, owners, and release decisions.
run_ai_api_pentestRuns an authorized AI/ML API pentest workflow with scope, recon, campaign execution, evidence, metrics, release decision, and saved report artifacts.
cd "/home/local-renad/renad-repo/RedTeam-ML-PenTest-MCP"
python3 -m venv .venv
. .venv/bin/activate
pip install -e ".[dev]"
python -m pytestRun the demo API:
scripts/start_mock_api.shOpen the browser health check:
http://127.0.0.1:8765/Try a sample browser request:
http://127.0.0.1:8765/chat?input=helloStop the demo API when finished:
scripts/stop_mock_api.shRun the simulator in another terminal:
redteam-ml-api run --target-url http://127.0.0.1:8765/chat --pack baseline_safeRun the professional 2026 AWS-facing pack:
redteam-ml-api run --target-url http://127.0.0.1:8765/chat --pack aws_2026_professional --reportGenerate the mindset-shift operating model:
redteam-ml-api brief --target-url http://127.0.0.1:8765/chat --pack aws_2026_professionalRun a pentest engagement:
redteam-ml-api pentest \
--target-url http://127.0.0.1:8765/chat \
--pack aws_2026_professional \
--tester "Red Team" \
--environment "staging" \
--authorizedRun from a reusable config file:
redteam-ml-api pentest --config examples/pentest_scope.jsonAuthenticated API example:
redteam-ml-api pentest \
--target-url https://api.example.com/chat \
--authorized \
--bearer-token "$API_TOKEN" \
--header "X-Environment: staging" \
--input-field message \
--delay-seconds 1.0Reports are saved under:
reports/Or run the full demo:
scripts/demo_pentest.shMore details:
Start the MCP server:
redteam-ml-api-mcp{
"mcpServers": {
"redteam-ml-api": {
"command": "python",
"args": ["-m", "redteam_ml_api_mcp.server"],
"cwd": "/Users/renad-local/renad-repo/RedTeam-ML-PenTest-MCP"
}
}
}This project is for authorized defensive testing only. It does not exploit infrastructure, bypass authentication, scan third-party systems, or generate malware. Attack packs are plain JSON so teams can review exactly what is being sent.
Evaluate one ML API response for defensive risk signals.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the tool evaluates for risk signals but does not explain what that entails—no mention of safety (read-only?), side effects, authorization needs, or whether it modifies state. The description is too vague to inform the agent about consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacks structure. It front-loads the verb and resource but misses the opportunity to include key details like output or usage. Every word is functional, but the sentence could be restructured to include more information without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one string parameter, no output schema, no annotations), the description is incomplete. It does not explain the return value (e.g., risk score, flagged issues) or any behavioral details. An agent would lack sufficient context to use this tool effectively, especially when sibling tools have richer descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema provides no description for the 'text' parameter (0% coverage), the tool description adds meaning by implying the text should be an ML API response for risk evaluation. This clarifies the parameter's purpose but does not specify format, allowed values, or constraints, so it provides moderate added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool evaluates a single ML API response for defensive risk signals. It uses a specific verb ('evaluate') and resource ('ML API response') and differentiates from siblings by focusing on defensive risk signals rather than generation, reporting, or pentesting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like run_ai_api_pentest or list_attack_packs. No context is given for prerequisites, limitations, or typical use cases, leaving the agent without decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a mindset-shift operating model for security, red team, AI architecture, platform, and executives.
| Name | Required | Description | Default |
|---|---|---|---|
| run_result | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose any behavioral traits such as side effects, authentication needs, input/output specifics, or internal processing. The tool's name implies generation, but no operational details are given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but overly terse. It lacks structure and fails to provide essential details, making it insufficient for effective use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (generating an operating model) and the lack of output schema or parameter details, the description is critically incomplete. The agent cannot infer what the tool returns or how to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter 'run_result' with no description and 0% schema coverage. The description does not explain its purpose, format, or relationship to the output, leaving the agent with no guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool generates an operating model for security, red team, AI architecture, platform, and executives, but 'mindset-shift operating model' is vague and the verb 'generate' is generic. It does not clearly differentiate from sibling tools like 'generate_report'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., generate_report, run_red_team). No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a remediation report from a run_red_team result.
| Name | Required | Description | Default |
|---|---|---|---|
| run_result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose behavioral traits such as whether it modifies data, authentication needs, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no redundancy or extra information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is minimally adequate but does not explain the report's content or format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description adds some meaning by specifying the parameter is a run_red_team result, but lacks structural details or constraints beyond the type object.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (generate), the resource (remediation report), and the source (run_red_team result). It distinguishes from siblings like run_red_team and evaluate_text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after a run_red_team operation but provides no explicit when-to-use or when-not-to-use guidance, nor alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List local defensive red-team attack packs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states action without disclosing behavioral traits like read-only nature or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words; perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description does not hint at return format (e.g., list of names) leaving some ambiguity for a tool with no parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, schema coverage 100%; description adds no parameter info, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and resource 'local defensive red-team attack packs,' clearly distinguishing from sibling tools like 'run_red_team' or 'generate_report'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives; lacks context for when not to use or explicit recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run an authorized AI/ML API penetration-test workflow with scope, recon, campaign execution, evidence, metrics, and report artifacts.
| Name | Required | Description | Default |
|---|---|---|---|
| target_url | Yes | ||
| pack | No | aws_2026_professional | |
| method | No | POST | |
| timeout_seconds | No | ||
| delay_seconds | No | ||
| max_cases | No | ||
| dry_run | No | ||
| headers | No | ||
| bearer_token | No | ||
| input_field | No | input | |
| authorized | Yes | Must be true for targets you own or are approved to test. | |
| tester | No | authorized tester | |
| environment | No | staging | |
| save | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should fully disclose behavioral traits. It mentions 'authorized' and a workflow but does not explain side effects (e.g., potential damage, data modification, rate limits). The description is too generic about the workflow steps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 20 words, making it concise. However, it lists jargon (scope, recon, campaign execution) without explanation, slightly reducing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (14 parameters, no output schema, no annotations), the description is incomplete. It does not explain what the tool returns, how to configure the workflow, or specify prerequisites beyond authorization.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 7% (only 'authorized' has description). The tool description adds no semantic detail for the 14 parameters, such as pack meaning, method significance, or timeout usage. It fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs an authorized AI/ML API penetration-test workflow, specifying the verb 'run' and the resource 'penetration-test workflow'. It distinguishes from siblings like 'evaluate_text' or 'run_red_team' by focusing on AI API pentesting with specific artifacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for authorized pentesting but lacks explicit when-to-use guidance or comparison to alternatives. The 'authorized' parameter description provides some context, but overall no explicit exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a safe red-team pack against an authorized ML API endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| target_url | Yes | ||
| pack | No | baseline_safe | |
| method | No | POST | |
| timeout_seconds | No | ||
| delay_seconds | No | ||
| max_cases | No | ||
| dry_run | No | ||
| headers | No | ||
| bearer_token | No | ||
| input_field | No | input |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It declares the pack is 'safe' but does not disclose actual behaviors: whether it mutates state, requires authorization, has rate limits, or what happens if a vulnerability is found. The term 'red-team' implies adversarial testing, but consequences are unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While the description is concise at one sentence, it is severely under-specified for a tool with 10 parameters. Valuable information is sacrificed for brevity. The sentence lacks structure and does not front-load key behavioral details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, no output schema, no annotations), the description is grossly incomplete. It omits what a pack is, how method/timeout affect execution, the role of dry_run, and expected output. The agent cannot safely or effectively invoke this tool with only this description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds zero information about any of the 10 parameters (e.g., 'pack', 'dry_run', 'bearer_token'). The description fails to compensate for the missing schema descriptions, leaving agents unable to understand parameter purposes or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs a safe red-team pack against an authorized ML API endpoint. It uses specific verbs and resources, distinguishing it from sibling tools like 'run_ai_api_pentest' and 'evaluate_text'. The qualifiers 'safe' and 'authorized' set appropriate scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. It does not mention prerequisites, when not to use, or how to select among sibling tools like 'list_attack_packs' or 'run_ai_api_pentest'. The description lacks context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0evaluate_textgenerate_operating_modelgenerate_reportlist_attack_packsrun_ai_api_pentestrun_red_teamEach tool has a clearly distinct purpose: evaluating responses, generating models/reports, listing packs, and running tests at different granularities. No overlap.
All tool names follow a consistent verb_noun pattern using snake_case, making them predictable and easy to distinguish.
With 6 tools covering listing, testing, evaluation, and reporting, the count is well-scoped for a red-team ML API server without being excessive.
Core red-team workflow is covered (list packs, run tests, evaluate, report), but lacks tools for managing results or configurations, which is a minor gap.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rnadjqaim/RedTeam-ML-PenTest-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
