The open lab from CVEasy AI.
Runnable security harnesses, red-team probes, and experiments — the free, MIT-licensed slice of the work we do on exposure and AI security. No signup, no telemetry, single-file tools you can read before you run.
| Area | What it is | Status |
|---|---|---|
| ai-redteam/mcp-probes | A security auditor for Model Context Protocol servers. Enumerates a server's tools/resources/prompts and scores how much power and untrusted input it exposes to an agent. | ✅ runnable |
| ctem-bench | An open benchmark for vulnerability prioritization — a TRIS-lite reference scorer (CVSS + EPSS + KEV) and labeled fixtures, so you can measure how well any tool ranks what matters. | 🚧 roadmap |
| experiments | Smaller one-off probes and proofs-of-concept that graduate into their own folder if they earn it. | 🌱 seedbed |
Every tool in here follows the same rules:
- Readable before runnable. Prefer a single file you can audit in one sitting over a framework you have to trust.
- Defensive by default. These are for testing systems you own or are authorized to test. Each tool spells out its scope.
- No phone-home. No telemetry, no analytics, no network calls except the ones you point it at.
- A passing score is not a proof of safety. Our checks tell you what they found, not that nothing is there.
cveasy-forge is one of several free tools we ship. The others:
- cveasy-chatbot-pentest — CLI to pentest any deployed AI chatbot. Six attack classes, 37 probes.
- threat-intel-payloads — quarterly drops of attack-payload manifests with TRIS-lite scoring and reproducible labs.
- cveasy-mcp — MCP server to connect Claude Desktop / Claude Code to your own CVEasy AI install.
CVEasy is a continuous threat-exposure-management platform built around TRIS, a 12-layer risk-scoring framework (patent pending) that scores every CVE against your environment. The full engine is the paid product. The forge is where we put the parts that are more useful to the community in the open than behind a login — the harnesses, the probes, the reference implementations. If they help you, come see what the full platform does.
Issues and PRs welcome — see CONTRIBUTING.md. Security reports go to security@cveasyai.com, not the public tracker; see SECURITY.md.
MIT. Use it, fork it, ship it.