MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) MCP Server

by gtfo Your server? Claim it

answering

MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) is answering right now. Last checked 15 min ago. It exposes 1 tools.

Security research: MCP registries verify identity, not tool behavior. See gtfo.dev.

Uptime history 91 days of history · worst day 91%

91 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

121 ms

Response time

average over 24h

authentication required

Access

streamable-http

Nothing serious here today

Today is the operative word: we check MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 15 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-killchain-stage1-weather --transport http https://ailm.gtfo.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://ailm.gtfo.dev/mcp

~/.codex/config.toml

[mcp_servers.mcp-killchain-stage1-weather]
url = "https://ailm.gtfo.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-killchain-stage1-weather": {
      "url": "https://ailm.gtfo.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp-killchain-stage1-weather": {
      "type": "http",
      "url": "https://ailm.gtfo.dev/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, but it did not say what kind of credentials it expects.

Available tools 1

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

weather

get_weather

Fetches current weather conditions for a given city.

Endpoints

URL	Transport	State	Latency	Checked
https://ailm.gtfo.dev/mcp	streamable-http	needs auth	79 ms	15 min ago

Alternatives to MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior)

same job, measured the same way

Open Registry Poc

by nottiboy137

PoC: Open Registry supply chain — unvetted server listing (security research)

44 installs/wk local only

MCP Shield

by craftedtrust

Trust verification for MCP servers. Check scores, scan for security issues, search 4,200+ servers.

4 tools answering

Security Suite

by guardbee

Every GuardBee MCP security tool in one server: OWASP MCP Top 10, secrets, supply chain, TLS/DNS

748 installs/wk local only

Loaditout

by loaditoutadmin

Search and install 20,000+ security-graded MCP servers and agent skills.

71 installs/wk local only

Update Hijack Poc

by nottiboy137

PoC benign MCP server for update-hijack security research

24 installs/wk local only

Klisten ToolRank

by co-klisten-api

Search the tool catalog. Customer API key required. Catalog metadata is not a security guarantee.

answering

Abnormal MCP Server

by gregdog

Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.

local only

Helixar Security

by helixar

Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.

2 tools answering

MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) — questions

Answers built from our own checks of this server.

What can MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) do?

It exposes 1 tools, read directly from the server on our last check. Among them: get_weather. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 121 ms. The bar chart above shows every period we have measured.

How do I connect MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior)?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You will need your own credentials: it refuses anonymous clients.

Does MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) need an API key?

Yes. Every time we knock, MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior) answers with an authorization challenge instead of its tool list — that is how we know it is running and gated rather than broken. Bring your own credentials and it will talk.

How fast is MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior)?

It answers our handshake in 121 ms on average, which is faster than 89% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.