GenAI Security Advisor MCP — OWASP GenAI Security Project

What it does

Five read-only tools, all backed by the same corpus/MANIFEST.yaml the skill itself reads — fetched live from GitHub at request time, so the two are never out of sync.

`list_resources`

Catalog entries filtered by status, initiative, or format.

`list_initiatives`

Category overview with current/total resource counts — a good starting point before drilling in.

`get_resource`

One resource's full metadata, file list, and a raw_url per file — or a source_url for entries with no vendored copy.

`get_file`

Read a specific text file's content directly (.md/.yaml/.yml/.json/.txt).

`search_corpus`

Full-text search across markdown/json content, extracted PDF text, and every resource's title/notes.

PDF matches are clearly flagged as an unreviewed offline extraction — never presented as citable.

Architecture

Built to need nothing beyond GitHub (for the corpus) and Cloudflare's free tier (to serve it) — no database, no queue, no server to patch.

Piece	How
Hosting	Cloudflare Workers, plain free tier — no Durable Objects, KV, or D1
Protocol	MCP over Streamable HTTP, stateless (no session tracking, no Durable Object required)
Corpus data	Nothing vendored here — every call reads `GenAI-Security-Advisor`'s `corpus/MANIFEST.yaml` and files live from GitHub, edge-cached 5 minutes
PDF search	Text extracted offline in the source repo (`corpus/_extracted/`, via a scheduled GitHub Action) — Workers' free-tier 10ms CPU budget can't parse a 100-page PDF live unreviewed
Auth	None — the corpus is already public. CORS is open for any client.

Full design rationale, including why GitHub Pages/Codespaces were ruled out for the serving layer, is in the repo README.

Connecting a client

Point any Streamable-HTTP-capable MCP client at the endpoint below. No installation, no API key.

Claude Code CLI

claude mcp add --transport http genai-security-advisor \
  https://genai-security-advisor-mcp.genai-security-advisor-mcp.workers.dev/mcp

Any MCP client raw endpoint

Streamable HTTP, JSON-RPC 2.0, stateless — one POST per call:

curl -X POST https://genai-security-advisor-mcp.genai-security-advisor-mcp.workers.dev/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Prefer working from a local checkout instead? That's exactly what the companion genai-security-advisor skill is for — same corpus, read directly off disk inside a clone of GenAI-Security-Advisor, no network round-trip per query.

Security model

Public, read-only, and deliberately narrow in what it will fetch.

Read-only

No tool can write to GitHub or anywhere else. The server holds no write credentials at all.

No auth needed

The corpus is already public CC BY-SA 4.0 / OWASP-published content — nothing here is a secret worth gating.

Path-traversal safe

get_file validates every path against both a syntactic allowlist and the source repo's actual file tree before fetching.

No secrets committed

An optional read-only GitHub token (to raise rate limits) is set via wrangler secret put, never in the repo.

Licensing

Same split as the skill — check corpus/MANIFEST.yaml for the license of any specific document before redistributing it.

Apache-2.0

Covers this server's own code and documentation (this page included).

Free to use, modify, and redistribute
See LICENSE in the repo

CC BY-SA 4.0

Covers the corpus content this server reads and returns — third-party OWASP GenAI Security Project research, not covered by this repo's Apache-2.0 grant.

See each resource's license field via list_resources / get_resource
Share and adapt freely, with attribution, share-alike

Nothing is vendored here. This repo contains only server code — the corpus itself lives in, and is licensed per, GenAI-Security-Advisor.

PDF extractions are not a separate license grant. The offline text extractions used for search inherit their source PDF's license but are explicitly unreviewed and not citable — see corpus/_extracted/README.md in the source repo.