1. Conduid
  2. Agents
  3. Purplegate
MCP server · Agents

Purplegate

· github.com/sameermohan-git/purplegate

purplegate — Red/blue-team CI gate for agentic-AI apps. Prompt-injection, secrets, SAST, deps, IaC/RLS, workflow injection, MCP checks. One signed GitHub Action, mapped to OWASP LLM Top 10 v2025 + MITRE ATLAS.

Unclaimed agentic-aiai-securityci-cddevsecopsgithub-actionllm-securitymitre-atlasowaspowasp-llm-top-10prompt-injectionprompt-injection-detectionsasarifsecuritysupply-chain-security
InstallView source
34Low

Scored a month ago · breakdown

About Purplegate

Purplegate is an MCP server in the Agents category: purplegate — Red/blue-team CI gate for agentic-AI apps. Prompt-injection, secrets, SAST, deps, IaC/RLS, workflow injection, MCP checks. One signed GitHub Action, mapped to OWASP LLM Top 10 v2025 + MITRE ATLAS.

Install

From source
git clone https://github.com/sameermohan-git/purplegate

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (8)

Cross-user data disclosureApp references another user's transactions when asked

Parameters not published.

Generic advice leak"RRSPs are generally good" from a finance app that should only answer about user data

Parameters not published.

LLM prompt injection"Who is Trump?" answered despite a finance-app scope guard

Parameters not published.

Live credential in gita real `sk_live_...` committed today

Parameters not published.

Missing Supabase RLS`CREATE TABLE public.transactions` without `ENABLE ROW LEVEL SECURITY`

Parameters not published.

System-prompt leakageAttacker extracts your app's instructions via a crafted payload

Parameters not published.

Vulnerable MCP SDK`mcp-remote` pinned < 0.1.16 (CVE-2025-6514, CVSS 9.7), `@modelcontextprotocol/server-filesystem` < 2025.7.1 (CVE-2025-53109), `mcp` PyPI < 1.23.0 (CVE-2025-66416), plus 7 more

Parameters not published.

Workflow command injection`${{ github.event.issue.title }}` inside a `run:` step

Parameters not published.

Ask AI

✦

Ask AI about Purplegate

Powered by Claude · Grounded in docs

I know everything about Purplegate. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Purplegate

How do I install Purplegate?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Purplegate safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Purplegate still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.