Gauntlet
About
Reliability + security testing for Model Context Protocol servers — mcp-fuzz (schema-aware fuzzer, SARIF) and mcp-storm (load tester, p50/p95/p99, CI gating) on one fast async MCP client core.
Details
- Author
- studiomeyer-io
- Downloads
- 197
Jump to
- type confusion (string where a number is required, …)
- boundary (empty / 100k-char strings, i64::MAX, negatives, zero, huge floats)
- missing required fields, wrong-typed arguments, deep nesting
- run: mcp-fuzz run --stdio --sarif mcp.sarif --fail-on high -- node server.js
- uses: github/codeql-action/upload-sarif@v3
The README includes setup instructions such as mcp-fuzz run --stdio -- node my-server.js.
mcp-gauntlet
A reliability + security toolkit for Model Context Protocol servers.
Two single-binary CLIs that share one fast async MCP client core:
| Tool | What it does |
|------|--------------|
| 🔬 mcp-fuzz | Schema-aware fuzzer. Reads each tool's inputSchema and throws a battery of hostile/boundary/malformed payloads at it — finds crashes, hangs, internal errors and silent validation gaps. Emits SARIF for GitHub code scanning. |
| 🌩️ mcp-storm | Load tester ("k6 for MCP"). Drives N concurrent workers against your server, reports p50/p95/p99 latency + throughput per tool, and gates CI on latency/error-rate thresholds. |
Both are written in Rust: one static binary each, no runtime, drop into any CI. They talk MCP over stdio (subprocess) or Streamable HTTP.
> Built by StudioMeyer. Companion to mcp-armor (runtime defense) — mcp-gauntlet is the pre-deploy attacker + load generator.
---
Why
MCP servers fail silently and ship fast. Most have no tests against malformed input and no latency budget. mcp-gauntlet gives you both in two commands you can wire into CI today — without writing a single test by hand, because the payloads are derived from the server's own schema.
---
Install
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
