{
  "protocolVersion": "0.3.0",
  "name": "GarphenGate",
  "description": "AI-assisted security analysis. Submit scanner exports, configuration dumps or logs and receive a prioritised, contextualised findings report.",
  "url": "https://triage.garphengate.com/mcp",
  "preferredTransport": "JSONRPC",
  "provider": {
    "organization": "GarphenGate",
    "url": "https://garphengate.com"
  },
  "documentationUrl": "https://garphengate.com/openapi.json",
  "iconUrl": "https://garphengate.com/icon-512.png",
  "version": "1.0.0",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false
  },
  "defaultInputModes": [
    "application/json",
    "text/csv",
    "text/plain"
  ],
  "defaultOutputModes": [
    "application/json",
    "text/markdown"
  ],
  "skills": [
    {
      "id": "triage_scan",
      "name": "Triage a vulnerability scan",
      "description": "Take a scanner export and return findings ranked by real-world risk: what is exploited in the wild, what is reachable, what to fix first.",
      "tags": [
        "security",
        "vulnerability",
        "triage",
        "cve"
      ],
      "examples": [
        "Triage this Trivy report and tell me what to patch tonight.",
        "Which of these 400 findings are actually being exploited?"
      ],
      "inputModes": [
        "application/json",
        "text/csv"
      ],
      "outputModes": [
        "application/json",
        "text/markdown"
      ]
    },
    {
      "id": "check_exploitation",
      "name": "Check a CVE for real-world exploitation",
      "description": "Look a CVE up against the CISA KEV catalogue and EPSS, and say whether it is known-exploited and how likely exploitation is.",
      "tags": [
        "security",
        "cve",
        "kev",
        "epss"
      ],
      "examples": [
        "Is CVE-2021-44228 in KEV?",
        "What is the EPSS score for CVE-2024-3094?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ]
    },
    {
      "id": "check_file",
      "name": "Identify a report before submitting it",
      "description": "Say which scanner produced a file, how many findings it holds, and whether the free tier covers it. Free, and it analyses nothing.",
      "tags": [
        "security",
        "normalisation"
      ],
      "examples": [
        "What format is this file, and does the free tier cover it?"
      ],
      "inputModes": [
        "application/json",
        "text/csv"
      ],
      "outputModes": [
        "application/json"
      ]
    },
    {
      "id": "list_analysis_types",
      "name": "List available analyses",
      "description": "The current catalogue of analysis types, what each one is for and whether the free tier covers it. There are no self-serve prices: larger or repeat work is agreed as a scoped service.",
      "tags": [
        "catalogue"
      ],
      "examples": [
        "What can you analyse, and which analyses does the free tier cover?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ]
    }
  ],
  "securitySchemes": {
    "bearer": {
      "type": "http",
      "scheme": "bearer",
      "description": "Account holders authenticate at https://triage.garphengate.com/api/auth/login."
    }
  },
  "x-garphengate": {
    "free_tier": {
      "cost": "free",
      "account_required": false,
      "runs_per_ip_per_day": 3,
      "runs_per_ip_per_hour": 2,
      "max_upload_bytes": 2097152,
      "max_findings_analysed": 200,
      "analysis_types": [
        "vuln-triage",
        "posture-assessment",
        "log-triage"
      ],
      "retention": "none: the upload is analysed in memory and discarded, and no report is stored"
    },
    "pricing": "https://garphengate.com/.well-known/pricing",
    "services": "https://garphengate.com/services",
    "scope_request": "https://garphengate.com/scope",
    "payment": "Invoice and bank transfer. Security services are quoted per scope.",
    "accepted_formats": [
      {
        "name": "Trivy (JSON)",
        "verified": "tested against the vendor's own integration fixtures"
      },
      {
        "name": "Trivy (SARIF)",
        "verified": "tested against the vendor's own integration fixtures"
      },
      {
        "name": "generic CSV",
        "verified": "unit-tested with hand-written samples (delimiter sniffing, quoting, BOM); not yet checked against a real export"
      },
      {
        "name": "Nessus",
        "verified": "fingerprinted and unit-tested (CSV and .nessus XML); not yet checked against a real export. XML carries no host; use CSV for host and CVE columns"
      },
      {
        "name": "Qualys",
        "verified": "fingerprinted and unit-tested (CSV, VM XML); not yet checked against a real export. A title block above the CSV header is refused, not skipped"
      },
      {
        "name": "OpenVAS",
        "verified": "fingerprinted; positive extraction not yet unit-tested (recognised, check the preview before relying on it)"
      },
      {
        "name": "AWS Inspector",
        "verified": "recognised by label only and read as a generic JSON vulnerability export: severity, title, description; finding ARN, resource, account, region and remediation are not read"
      },
      {
        "name": "AWS CloudTrail",
        "verified": "recognised by label only; read as a generic JSON event log, not as findings"
      },
      {
        "name": "Snyk",
        "verified": "recognised by label only and read as a generic JSON vulnerability export; not unit-tested"
      },
      {
        "name": "npm audit",
        "verified": "recognised by label only and read as a generic JSON vulnerability export; not unit-tested"
      },
      {
        "name": "Grype (JSON)",
        "verified": "NOT CONFIRMED: the vendor name is recognised, but Grype nests findings under matches[].vulnerability and our extractor may read the wrong list. Ask check_file first, or send a Trivy export instead. Do not rely on this one."
      }
    ]
  }
}