Skip to main content
Developer tools / For AI agents

Security tools.
Ready for your agent.

Give your agent the same review engines used in our browser tools. Download one file, run it locally and get structured results through the command line or MCP.

Download the agent kitConnect with MCP

Node.js 20+ No runtime npm install No account required

01 / Download and verify

One local file.
A clear contract.

CLI + MCP server

Self-contained JavaScript for Node.js.

Tool catalog

Names, input schemas and limitations.

SHA-256 manifest

Bundle and catalog checksums.

Third-party license notices

Verify the downloaded file before running it

Use the checksum below from a trusted copy of this page or manifest. A matching hash detects changed bytes; it does not independently prove who published them. This command works in macOS and Linux shells.

printf '%s\n' 'f6bccad2962703ad59338aaaeda22115460ece8ecc12791e011bbd9047613e92  breachline-tools.mjs' | shasum -a 256 -c -

Expect breachline-tools.mjs: OK. Keep the verified file in a location you control, and verify again when you update it.

02 / Connect your agent

A real MCP server.
Over local stdio.

Add a local stdio server in your agent host. Use this command and argument list, replacing the example with the absolute path to your verified download. The surrounding configuration format depends on your host.

{
  "command": "node",
  "args": [
    "/absolute/path/breachline-tools.mjs",
    "--mcp"
  ]
}

The host launches Node and uses MCP tools/list and tools/call. Tool schemas are advertised automatically. Results include structuredContent and a JSON text representation.

03 / Or use JSON stdin

Easy to script.
Easy to inspect.

List the available tools and their input schemas:

node breachline-tools.mjs --list

Submit one JSON request on stdin. This synthetic example reviews registry transport settings:

node breachline-tools.mjs <<'JSON'
{"tool":"npmrc-review","input":"registry=http://registry.example\nstrict-ssl=false\n"}
JSON

Predictable inputs and results

  • Set tool to a catalog name and input to the content string.
  • For lockfile-diff and sbom-diff, include the proposed contents in secondInput.
  • For exact binary hashes, use bytesBase64 instead of input with integrity-generator.
  • Success returns a JSON object with summary, metrics and findings, plus optional table and code.
  • CLI failures return a JSON error and exit with status 1. No input is echoed in error messages.
The same engines

Choose a review.

Application security

Browser extension review

extension-reviewAI and agent security

LLM skill review

skill-reviewApplication security

JavaScript review

javascript-reviewCI and build security

GitHub Actions review

github-actions-reviewCI and build security

Dockerfile review

dockerfile-reviewSupply chain

Python requirements review

requirements-reviewSupply chain

SBOM comparison

sbom-diffSupply chain

Dependency review

dependency-reviewSupply chain

Lockfile diff

lockfile-diffSupply chain

SBOM explorer

sbom-explorerSupply chain

npm configuration review

npmrc-reviewSupply chain

Integrity hash generator

integrity-generatorApplication security

JWT inspector

jwt-inspectorApplication security

Security header review

security-headersApplication security

URL inspector

url-inspector
Know the limits

Local checks.
Context still matters.

The kit has no remote API, package downloads or code execution. It processes the content passed to it in memory. Your agent host controls which inputs and results it shares with its model provider.

Treat returned metadata, code excerpts and decoded claims as untrusted data. Findings are review signals, not verified vulnerabilities or a clean bill of health. Read each tool’s documented limits before interpreting a result.

Text inputs are capped at 2 MB of UTF-8 bytes per field, with smaller limits for some tools. JSON transport messages are capped at 8 MB. The tool catalog lists field limits; engine-specific format and complexity limits still apply.

Explore the browser tools