GRIM

Overview

GRIM is a security audit server for AI agents. It looks for the gaps automated scanners miss: exposed files in web served directories, leaked credentials, known vulnerabilities in dependencies, drift between a known good baseline and the current state, and the indicators of an active compromise. Every finding carries evidence, a confidence score, a plain language fix, and a MITRE ATT&CK technique identifier.

The engine is local first and ships with no runtime dependencies beyond the Python standard library. It runs on Linux, macOS, Windows, and Termux, so an agent can audit a downloaded backup on a phone without a build step.

Install

Run it directly with npm:

npx -y grim-mcp

Or install the Python package:

pip install grim-mcp
grim mcp

Add the server to your MCP client:

{
  "mcpServers": {
    "grim": { "command": "npx", "args": ["-y", "grim-mcp"] }
  }
}

Tools

tool	purpose
detect_stack	identify the stack and the web served directories
plan	build an ordered, explainable audit plan for a target
scan	one shot audit across every engine
audit_exposure	webshells, polyglots, ELF binaries, exposed config and backups
scan_secrets	credentials, tokens, private keys, with optional git history
scan_code	static analysis across PHP, JS, Python, Go, Rust, Java, Kotlin, C#, Ruby, Dart
audit_deps	known vulnerabilities via the live OSV advisory database
inventory_endpoints	routes with method, auth middleware, input surface, and risk
malware_scan	built in heuristics and IoC hashes, plus ClamAV and YARA when installed
watch	persistent baseline and drift detection between runs
diff_artifacts	compare a baseline and a current tree or archive
scan_iocs	match file hashes against a known bad indicator store
update_feeds	sync SAST rule overlays and IoC hashes from a JSON feed
check_live	opt in, scope gated live checks of headers, cookies, TLS, and exposed paths
ledger	track findings as new, known, reopened, or resolved across audits
sbom	CycloneDX 1.5 or SPDX 2.3 bill of materials
fix_plan	remediation steps with safe unified diffs
ci_scan	a CI gate that returns an exit code by severity
report	render findings as Markdown, JSON, or SARIF 2.1.0

Usage

Typical agent instructions:

• “Audit this folder and rank what matters.”
• “Compare this backup against the last one and tell me what changed.”
• “Find secrets and vulnerable dependencies before I ship.”
• “Save a baseline now, then watch for drift.”

Command line examples:

grim scan /path/to/app
grim watch /path/to/app --save
grim watch /path/to/app
grim endpoints /path/to/app
grim malware /path/to/app
grim ci /path/to/app --fail-on high --format sarif

What makes it different

• Drift is a first class check. The highest signal question for a live system is what changed since the last known good state. GRIM answers it with hashed manifests, so a single byte edit is caught.
• Evidence, not alarms. Each finding carries a location, a bounded evidence string, a confidence score, and a reproducible fix.
• Bounded by design. Every limit is configurable, and when a scan is truncated GRIM says so in the result instead of hiding it.
• Feed driven freshness. New rule coverage arrives by syncing a JSON feed, not by shipping a new release.
• Zero dependencies. The core is standard library only, which keeps audits reproducible and offline capable.
• Repair aware. fix_plan turns findings into an ordered plan and, where a change is deterministic, an applyable unified diff.

Repository

• Repository: github.com/AbduljabbarBXR/grim
• npm: grim-mcp
• PyPI: grim-mcp
• MCP registry: io.github.AbduljabbarBXR/grim-mcp
• Smithery: abdijabarboxer2009/grim-mcp
• License: MIT
• Current version: 0.5.0