Llamascope Mcp

[](https://pypi.org/project/llamascope-mcp/) [](https://github.com/CobaltoSec/llamascope-mcp/actions) [](tests/) [](LICENSE) [](pyproject.toml)

llamascope-mcp

> MCP server for auditing exposed AI infrastructure — before attackers find it.

llamascope-mcp detects unauthenticated Ollama, Gradio, vLLM, LMStudio, FastAPI and custom AI agent instances exposed on your network or the internet. It checks for model poisoning, configuration leaks, CVE-mapped vulnerabilities, prompt injection, and jailbreak surfaces.

Part of the CobaltoSec toolkit alongside Corvus (MCP security) and Condor (agentic AI security).

Install

pip install llamascope-mcp

Or as an MCP server in Claude Code / Claude Desktop:

{
  "llamascope": {
    "command": "llamascope-mcp",
    "env": {
      "LLAMASCOPE_PROXY": "socks5://127.0.0.1:9150"
    }
  }
}

MCP Tools — 10

| Tool | What it does | |------|-------------| | scan_host | Full audit of one host: fingerprint + enumerate + all checks | | scan_network_range | Scan all hosts in a CIDR range concurrently | | probe_surface | Hit 14 common AI service paths to fingerprint what's running | | enumerate_models | List loaded models and analyze their registry origin | | check_model_poisoning | Detect models from untrusted or unusual registries | | check_config_leak | Test for unauthenticated API access and backend URL exposure | | check_ai_cves | Match detected service versions against known CVEs | | probe_inference | Run a test prompt to confirm unauthenticated inference access | | test_prompt_injection | Send prompt injection payloads and score the response | | test_jailbreak | Send jailbreak payloads and score the response |

Detected Platforms

| Platform | Detection method | |----------|-----------------| | Ollama | /api/tags, /api/version | | Gradio | X-Gradio-Version header, /info | | vLLM | /v1/models, OpenAI-compatible schema | | LM Studio | /v1/models + lmstudio in response | | FastAPI AI agent | /openapi.json with model/tool fields | | Custom AI agent | / response with model/tools/agent keywords |

OPSEC

llamascope-mcp implements a strict scan/interaction split:

• Scan path (scan_host, scan_network_range, probe_surface): all HTTP via httpx with LLAMASCOPE_PROXY support (SOCKS5/HTTP)
• Interaction path (probe_inference, test_prompt_injection, test_jailbreak): direct calls — always route through Kali or a controlled egress point

Set LLAMASCOPE_PROXY=socks5://127.0.0.1:9150 for Tor-routed scan traffic.

Quick start

# As a library
from llamascope.scanner import scan_host
results = await scan_host("192.168.1.50", port=11434)

# Via Claude Code MCP
# "Scan 192.168.1.50 for exposed AI services"
# "Check if any models on this host are from untrusted registries"
# "Run a prompt injection test against the Gradio endpoint on port 7860"

License

MIT © CobaltoSec

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: CobaltoSec
• Source: CobaltoSec/llamascope-mcp
• License: MIT

Install and usage instructions live in the source repository linked above.