# Paranoid

> Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

- **Type:** MCP server
- **Install:** `agentstack add mcp-kulchankas-paranoid`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kulchankas](https://agentstack.voostack.com/s/kulchankas)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kulchankas](https://github.com/kulchankas)
- **Source:** https://github.com/kulchankas/paranoid

## Install

```sh
agentstack add mcp-kulchankas-paranoid
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 🕵️ paranoid

**Your app is guilty until proven secure.** `/hack-me` breaks into your own
running app, proves each hole with a real request, patches it, and re-verifies —
on localhost, with receipts.

`paranoid` is an agent skill for Claude Code, Codex, and Cursor. Its core is
**`/hack-me`** — an authorized, localhost-only self-pentest loop that attacks
*your own* app the way an attacker would, then closes what it finds.

```
find  →  prove  →  patch  →  re-verify
```

  

---

## Why this isn't another "write secure code" skill

I started with the obvious thing — a skill that tells the agent to write secure
code — and then **benchmarked it honestly** before believing in it. The harness
([`benchmark/`](benchmark)) generates the same tasks with and without the skill
and runs real exploits against whatever the model writes.

The result was a clean negative:

| Model | Tasks | Exploit rate **without** skill | **with** skill | Effect |
|---|---|:--:|:--:|:--:|
| Fable 5.1 | isolated functions (easy) | 0% | 0% | none |
| Opus | isolated functions (easy) | 0% | 0% | none |
| Opus | isolated functions (neutral/tempting) | 0% | 0% | none |

On an isolated function, a capable model already writes the secure version
unprompted — ownership in the `WHERE` clause, parameterized queries, field
allow-lists — with no skill at all. **Advice adds nothing there.** (The harness
isn't rigged: it flags deliberately-insecure reference code at 100% and secure
code at 0%.)

Real vulnerabilities don't live in one tidy function. They live in the **wiring**
of a whole running app: auth on one route but not the next, a request body that
quietly sets `is_admin`, a search box that concatenates SQL. A model can't hold
all of that in its head while coding. So `paranoid` stops advising and starts
**attacking the running app**.

## `/hack-me`, proven

Against a small but realistic invoicing API ([`examples/ledgerlite`](examples/ledgerlite)),
a `hack-me` agent that was told **nothing** about the app's bugs found four by
probing, proved each with a live request, patched them, and re-verified:

| # | Found by probing the API | Class | Proof | After patch |
|---|---|---|---|:--:|
| 1 | Any user reads any invoice | IDOR / broken object auth | HTTP 200 with another user's invoice | **404** |
| 2 | `/admin/users` open to anyone logged in | broken function auth | full user directory dumped | **403** |
| 3 | `/search?email=` SQL injection | SQLi | plaintext passwords dumped via `UNION` | **`[]`** |
| 4 | `/profile` accepts `is_admin` | mass assignment → privilege escalation | regular user became admin | **400** |

Every legitimate request still returns `200` after the fixes. The full
walkthrough — exact exploit requests, responses, diffs, and re-verification — is
in [`examples/ledgerlite/HACKME_REPORT.md`](examples/ledgerlite/HACKME_REPORT.md).
Reproduce it: `python3 examples/ledgerlite/app.py`, then run `/hack-me`.

> That target was written as a demo, so it proves the **loop** works end-to-end.
> Point `/hack-me` at *your* app for your own results.

### Proven on an app we didn't write

The harder claim is code we don't control. Pointed at [OWASP **VAmPI**](https://github.com/erev0s/VAmPI)
— a well-known third-party vulnerable API — with nothing but its URL, `/hack-me`
found, proved, patched and re-verified **six** real bugs, including SQL-injecting
the admin's password out through the API and an unauthenticated endpoint dumping
every user's plaintext password:

  

| # | Finding | OWASP API | Status |
|---|---------|:--:|:--:|
| 1 | Unauth `/users/v1/_debug` dumps every password | API3/5 | **401/403** |
| 2 | Read any user's private book secret (BOLA) | API1 | **404** |
| 3 | Register with `admin:true` → privilege escalation | API6 | **admin=false** |
| 4 | Change any user's password (account takeover) | API1 | **victim untouched** |
| 5 | SQLi in user lookup (UNION-dumps passwords) | API8 | **404** |
| 6 | Debugger + stack traces exposed | API7 | **clean errors** |

Notably, VAmPI's own global "secure mode" flag closed only four of the six — the
critical password dump stayed open until patched. `/hack-me` caught it by
replaying every exploit instead of trusting the flag. Full receipts:
[`examples/vampi/HACKME_REPORT.md`](examples/vampi/HACKME_REPORT.md).

## What `/hack-me` actually does

1. **Maps** your running app and picks the risk classes it's exposed to.
2. **Probes** for each — one crafted request that only succeeds if the bug is real.
3. **Proves** every finding with the actual request/response (no theorizing).
4. **Patches** the root cause with a minimal, behavior-preserving fix.
5. **Re-verifies** by replaying the exact exploit — a finding isn't closed until it fails.

Guardrails, always: **your own / authorized targets, localhost only,
non-destructive proofs.** It won't touch third-party hosts, evade detection, or
build live malware. See [`commands/hack-me.md`](commands/hack-me.md).

## Install

```bash
npx skills add kulchankas/paranoid/skills/paranoid
```

Then copy [`commands/hack-me.md`](commands/hack-me.md) into your agent's commands
dir (e.g. `.claude/commands/`) so `/hack-me` is available. No dependencies, no
network calls, no telemetry — it's Markdown your agent reads.

```bash
python3 my_app.py            # start your app locally
/hack-me                     # point the agent at http://localhost:
```

## Also inside: the paranoid skill (secure-by-default companion)

The guidance the benchmark tested still earns its place as a **companion while
you code** and as `hack-me`'s knowledge base — concrete failure modes and fixes
for the vulnerability classes that actually ship in vibe-coded apps:

- [the vibe-coded top 10](skills/paranoid/references/vibe-top-10.md)
- references: [auth & access](skills/paranoid/references/auth-access.md) ·
  [secrets & the client boundary](skills/paranoid/references/secrets-config.md) ·
  [injection & SSRF](skills/paranoid/references/injection.md) ·
  [APIs & webhooks](skills/paranoid/references/apis-webhooks.md) ·
  [`/hack-me` framework guides](skills/paranoid/references/frameworks.md)
- a 7-point [pre-commit gate](skills/paranoid/checklists/pre-commit.md)

Load it while building; run `/hack-me` to check whether it held.

## The benchmark

An honest, reproducible harness for the question *"does a security skill actually
reduce vulnerabilities?"* — plus the negative result above and how to re-run it:
[`benchmark/`](benchmark).

## Scope & ethics

`paranoid` secures **your** code and pentests **your** running app, with your
say-so. It is not built to target third-party systems, scan hosts you don't own,
evade detection, or produce live malware, and it will decline to. Authorized,
defensive, local.

## Roadmap

- [x] `/hack-me` loop — find → prove → patch → re-verify, on localhost
- [x] Reproducible skill-efficacy benchmark + the honest result behind the pivot
- [x] Independent-app proof — [OWASP VAmPI](examples/vampi): 6 real bugs found, fixed & re-verified
- [x] More benchmark task classes — 18 now (IDOR, missing auth, SQLi, mass assignment, path traversal, SSRF, XSS, command injection, open redirect, JWT auth, leaked secrets, CSRF, template injection, XXE, unrestricted upload, permissive CORS, weak password storage)
- [x] `/hack-me` framework guides (Next.js, FastAPI, Express)

`paranoid` is v0.1 and actively developed — issues and PRs welcome.

## Contributing

New vulnerability classes, framework guides, and independent-app proofs are the
most useful contributions — see [CONTRIBUTING.md](CONTRIBUTING.md) for the format
and the honesty rules, and [SECURITY.md](SECURITY.md) for scope. Good first issues
are labeled in the tracker.

## License

MIT © 2026 kulchankas. See [LICENSE](LICENSE).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kulchankas](https://github.com/kulchankas)
- **Source:** [kulchankas/paranoid](https://github.com/kulchankas/paranoid)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-kulchankas-paranoid
- Seller: https://agentstack.voostack.com/s/kulchankas
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.