Krysta Wing

Get Started.

Krysta is a security toolkit for AI agent infrastructure. It discovers MCP servers in your project, scans them for vulnerabilities, and lets you enforce runtime policies via a security gateway.

Run without installing:

bash

npx krysta probe --deep

Or install globally:

bash

npm install -g krysta

The npm package is a thin wrapper. On install it downloads the correct pre-built Rust binary for your platform from GitHub releases. Node.js 16+ is required. The binary itself has no runtime dependencies.

01 / Quick Start

Scan your MCP servers

Krysta discovers every MCP server configured on your machine — Claude Desktop, Cursor, VS Code — and checks it against known vulnerability patterns.

Basic scan (config-level checks only):

bash

npx krysta probe

Scan a specific directory or config path:

bash

npx krysta probe --path "path/to/config/directory"

Full deep scan — connects to each server, downloads and inspects its package source, and confirms real findings with live testing:

bash

npx krysta probe --deep

Krysta searches for claude_desktop_config.json, .cursor/mcp.json, and mcp_settings.json at the given path. No config needed to get started.

02 / krysta probe

The scanner

Discovers MCP servers from config files and runs static, package, source-code, and dynamic security checks against each one.

All flags:

bash

krysta probe [FLAGS]

  -p, --path <DIR>       Directory or config path to scan (default: .)
  -d, --deep             Connect to each server, fetch tool schemas, and run dynamic checks
      --upload           Send results to the dashboard (requires krysta login first)

Static checks (always run)

KRYSTA-001High

Missing authentication

No auth token or credentials found in the server config.

KRYSTA-004Medium

Potential path traversal risk

Server name suggests file system access (contains "file" or "fs").

03 / Deep Scan

Live protocol testing

With --deep, krysta connects to each server over its actual transport — stdio or SSE — speaks the MCP protocol directly, and inspects real tool schemas and behavior.

bash

npx krysta probe --deep

What happens under the hood:

bash

1. Connects to each server over its configured transport (stdio process or SSE endpoint)
2. Performs the MCP initialize handshake, then requests tools/list
3. For npm-based servers, downloads the published package and statically scans its source
4. Runs every tool through the vulnerability database, matching schemas and descriptions
5. For select checks, sends a safe canary payload and confirms the result — turning a
   suspected finding into a confirmed one

Deep scan works on both stdio and SSE transports. Stdio servers are spawned as a child process and spoken to over stdin/stdout; SSE servers are connected to directly. Timeout is configurable per connection.

Vulnerability database — all 10 entries

CVE-2026-MCP-001Critical

Command injection via tool description

CVE-2026-MCP-002High

Path traversal in file system tools

CVE-2026-MCP-003High

SSRF via fetch_url tool

CVE-2026-MCP-004Critical

Credential exposure in environment variables

CVE-2026-MCP-005Critical

Exec/Shell injection via subprocess

CVE-2026-MCP-006Critical

Hardening bypass via npx -c flag

CVE-2026-MCP-007High

Tool description poisoning

CVE-2026-MCP-008Medium

Unpinned server config (supply chain risk)

CVE-2026-MCP-009High

Insecure SSE transport — missing authentication

CVE-2026-MCP-010High

Missing auth on public SSE endpoint

04 / Results

Reading the output

After scanning, krysta prints a summary table and writes two files to ~/.krysta/.

Example terminal output:

bash

🔍 Krysta Probe — Scanning for MCP servers...

Found 2 MCP server(s)

  📡 filesystem (Stdio)
    🟠 filesystem — Missing authentication
    🟡 filesystem — Potential path traversal risk

  📡 shell-server (Stdio)
    🔴 shell-server — Confirmed command injection

═════════════════════════════════════════════════════════════════
 SCAN SUMMARY
═════════════════════════════════════════════════════════════════

  Servers Found:    2
  Total Findings:   3

  🔴 Critical:     1
  🟠 High:         1
  🟡 Medium:       1
  🟢 Low:          0

  Risk:        🔴 CRITICAL

Files written after scan

~/.krysta/krysta-report.json

JSON · written if findings exist

Full structured report with scan date, server list, severity breakdown, and all findings. Pass --upload to send this to the dashboard.

~/.krysta/krysta-mesh-policy.yaml

YAML · written if findings exist

Auto-generated mesh policy file derived from findings. Critical and High findings become block rules, Medium and Low become log rules. Feed directly into krysta-mesh.

Read the JSON report:

bash

cat ~/.krysta/krysta-report.json

Upload to the dashboard (requires krysta login first):

bash

npx krysta probe --deep --upload

05 / krysta-mesh

Runtime gateway

krysta-mesh is a security proxy that sits between your AI agent and the MCP server. It inspects every tool call in real time and blocks or logs based on a YAML policy file.

Build from source:

bash

git clone https://github.com/Krysta-Wing/krysta_mesh
cd krysta_mesh
cargo build --release

Start the gateway:

bash

krysta-mesh start --upstream http://localhost:3001 --port 8080 --policy mesh-policy.yaml

Point your agent at the gateway instead of the MCP server directly:

bash

# Before: agent → http://localhost:3001  (MCP server)
# After:  agent → http://localhost:8080  (krysta-mesh) → http://localhost:3001

Start flags

-u, --upstream

URL · required

The URL of the real MCP server to forward allowed requests to.

-p, --port

u16 · default 8080

Port the gateway listens on.

-f, --policy

path · default mesh-policy.yaml

Path to your YAML policy file.

The gateway intercepts tools/call JSON-RPC requests and evaluates them against all policy rules in order. Other methods (like tools/list) are forwarded transparently.

Example gateway output:

bash

🛡️  Krysta Mesh — Starting security gateway...

✅ Policy loaded: 5 rules
🌐 Listening on: http://0.0.0.0:8080
⬆️  Upstream: http://localhost:3001

All MCP traffic will be inspected and filtered.

06 / Policy File

Writing rules

A policy file is a YAML document with a name and a list of rules. Rules are evaluated in order for every tools/call request.

Full example policy:

yaml

name: "default-security-policy"
rules:
  - name: "block-command-execution"
    action: block
    severity: Critical
    condition:
      tool_pattern: "execute|command|shell|exec"

  - name: "block-dangerous-paths"
    action: block
    severity: High
    condition:
      tool_name: "read_file"
      argument_contains: ["../", "/etc/", "/root/", ".ssh"]

  - name: "log-file-operations"
    action: log
    severity: Medium
    condition:
      tool_pattern: "file|read|write"

Rule fields

name

string · required

Unique rule identifier. Shown in blocked request logs.

action

block | log | allow · required

block returns an error to the agent. log records and forwards. allow forwards with no logging.

severity

Critical | High | Medium | Low · required

Informational. Does not change action behavior.

condition.tool_name

string · optional

Exact match on the tool name from the tools/call request.

condition.tool_pattern

regex string · optional

Regex matched against the tool name. Example: "execute|shell|exec".

condition.argument_contains

string[] · optional

The rule fires if any string in the list appears anywhere in the serialized arguments JSON.

krysta probe --deep auto-generates a policy file at ~/.krysta/krysta-mesh-policy.yaml based on findings. Use it as a starting point and customize from there.

Apply the auto-generated policy:

bash

krysta-mesh start --upstream http://localhost:3001 --policy ~/.krysta/krysta-mesh-policy.yaml

07 / Vulnerability DB

krysta-core

krysta-core is the shared Rust library that powers both probe and mesh. It contains the vulnerability database, severity and category types, and the policy rule structures.

Vulnerability categories:

CommandInjection

Arbitrary command execution through tool input or shell calls.

PathTraversal

File read/write without path validation, allowing access outside workspace.

SSRF

URL fetching that can reach internal services or cloud metadata endpoints.

CredentialExposure

Hardcoded API keys, tokens, or secrets in config files.

ToolPoisoning

Malicious instructions injected into tool descriptions to manipulate agent behavior.

NetworkExposure

Server bound to 0.0.0.0 or a public IP without authentication.

Authentication

MCP server accessible with no auth token or credentials required.

InformationDisclosure

Server leaks internal state, error details, or environment variables.

The vulnerability database is compiled into the binary — it is not fetched at runtime. New CVE entries are added in krysta_core/src/vuln_db.rs and released with new binary versions.

08 / Errors

When things go wrong

Common failure modes and how to resolve them.

No MCP servers found

Cause: krysta found no recognized config file at the given path.

Fix: Check that claude_desktop_config.json, .cursor/mcp.json, or mcp_settings.json exists in the target path.

MCP handshake timed out

Cause: The server process did not respond to the initialize request in time — often a startup crash or invalid config argument.

Fix: Check stderr output for the server process; a common cause is a placeholder path in the config args that does not exist on disk.

Binary not found on npm install

Cause: The GitHub release for your platform is not available yet, or the download was blocked.

Fix: Check https://github.com/Krysta-Wing/krysta_probe/releases for available binaries. Build from source with: cargo build --release

Policy file not found (krysta-mesh)

Cause: The path passed to --policy does not exist.

Fix: Run krysta probe --deep first to auto-generate ~/.krysta/krysta-mesh-policy.yaml, or create a policy file manually.

Upload failed: HTTP 401

Cause: No valid session. The --upload flag requires authentication.

Fix: Run krysta login first. This opens a browser to authorize and saves credentials locally.