Model Context Protocol
Security triage, inside your agent
A remote MCP server. Four read-only tools, no installation, no API key, and nothing stored. Point your client at one URL.
https://triage.garphengate.com/mcpThe four tools
check_file
What is this export, which analysis applies, how many findings does it contain, how confident is the detection, and whether the free tier covers it. Makes no model call and costs nothing. Call it first when a file's origin is uncertain.
check_exploitation
Pass CVE ids, get back which are in CISA's Known Exploited Vulnerabilities catalogue and which have a meaningful EPSS score. Live data rather than recollection, no model call, and usually the first question worth asking about a backlog.
triage_scan
The full ranked report: what to fix first, what collapses into one root cause, what is safely deprioritised and why, with remediation and the evidence quoted from your own file. Free for 200 findings, three calls a day.
list_analysis_types
The catalogue: every analysis, what it needs as input, and whether the free tier covers it.
Every tool is annotated
readOnlyHint: true and destructiveHint: false. Nothing here
creates, modifies, deletes or spends anything.
Connecting it
Claude Code
claude mcp add --transport http garphengate https://triage.garphengate.com/mcpClaude Desktop, or any client using a config file
{
"mcpServers": {
"garphengate": {
"type": "streamable-http",
"url": "https://triage.garphengate.com/mcp"
}
}
}Anything else
It is a standard remote MCP server speaking streamable HTTP with stateless JSON
responses. Protocol versions 2026-07-28 through 2025-03-26 are
supported, so both the modern per-request negotiation and the older
initialize handshake work.
curl -s https://triage.garphengate.com/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list",
"params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}' | jqA worked example
What a useful sequence looks like from an agent's side:
check_filewith the export → "Nessus CSV export, high confidence, 4,305 findings, vulnerability triage, free tier eligible".check_exploitationwith the CVEs you extracted → "3 of 87 are in CISA KEV", a free, instant answer that often decides the next hour's work on its own.triage_scanwith the file and one sentence of environment context → the ranked report.
That middle step matters more than it looks. It is a lookup, not a judgement, so it is both free and certain, and it frequently answers the actual question before any analysis is needed.
Limits and scope
Free tier limits
- 2 MB per file
- 200 findings analysed per triage call
- 3 triage calls per day per address
- The full finding count is always reported, even when only 200 were analysed
- No account, no key, nothing stored
More than that is agreed as a scoped service: request a scope.
Scope, permanently
- Read-only: nothing is created, modified or deleted
- No scanning: it reads only the file you pass it
- No exploit code, attack tooling or intrusion steps, at any tier
- Your file is analysed in memory and discarded
Questions people actually ask
Do I need an API key?
No. That is the point of exposing it this way. An agent can use it the moment its operator pastes the URL.
What happens when I hit the daily limit?
The tool returns an error your model can read, explaining the limit and where to request a scope for more. It is a tool error rather than a protocol error, so the agent can adapt rather than falling over.
Does it stream?
No. Every response is a single JSON object, which the protocol explicitly permits. The tools return one result each, so a stream would add complexity and buy nothing.
Can my agent pay for larger analyses automatically?
No. Nothing on this server costs anything, and it takes no payments. Larger or recurring work is agreed with a person as a scoped service: request a scope.
Where is it listed?
It is not in the official MCP registry yet. The URL above is all a client needs.
Paste one URL and try it
https://triage.garphengate.com/mcp