MCP guide · LLM Red Team
@guardbee/mcp-llm-redteam actively tests guardrails on a live LLM endpoint or chatbot you own or are authorized to assess. Unlike static scanners, it sends real probes containing safe, single-use canary tokens and measures whether the model obeyed an override instruction.
What does it do?
The server runs 12 probes against an OpenAI-compatible API, Anthropic Messages API, or custom webhook. It covers jailbreaks, system-prompt extraction, base64/zero-width obfuscation, refusal suppression through fake authority, and multilingual overrides. A bypass is measured deterministically when the target repeats a random canary token; probes never request genuinely harmful output.
Who is it for?
- AI security teams validating staging chatbot guardrails before production
- Product teams using OpenAI, Anthropic, Groq, vLLM, or compatible gateways
- DevSecOps teams that want repeatable LLM security checks after every deploy
- Developers testing their own webhook chatbot from Claude or Cursor
What it is not
- Endpoints you do not own or lack explicit authorization to test
- Requesting genuinely harmful output or developing novel attack techniques
- Replacing a complete manual red-team engagement and risk assessment
Features
| Feature | Description |
|---|---|
| 12 probes / 5 categories | instruction-override, extraction, obfuscation, refusal-suppression, multilingual |
| Canary-based measurement | Deterministic bypass evidence without harmful output |
| 3 target types | OpenAI-compatible API, Anthropic Messages API, or custom webhook |
| Remediation guidance | Why each bypass matters and how to strengthen guardrails |
| CI/CD mode | Test a staging chatbot after deploy with a fail-on threshold |
MCP tools
| Tool | Description |
|---|---|
list_probes | List every probe by category and severity without a network call |
run_probe_suite | Run the suite against an authorized target and report bypassed guardrails |
Install with npm
Global install (handy for Claude Desktop / Cursor):
npm install -g @guardbee/mcp-llm-redteamor via npx (recommended with -y in config):
npx -y @guardbee/mcp-llm-redteamCI/CD example: npx @guardbee/mcp-llm-redteam probe --type=openai --model=gpt-4o-mini --api-key-env=OPENAI_API_KEY --fail-on=high. Custom chatbot: --type=webhook --url=https://staging.example.com/chat. Never pass an API key as a tool parameter; provide only the name of a pre-set environment variable via apiKeyEnv. Every probe consumes target API quota.
Claude Desktop configuration
Config file paths:
- macOS
~/Library/Application Support/Claude/claude_desktop_config.json - Windows
%APPDATA%\Claude\claude_desktop_config.json - Linux
~/.config/Claude/claude_desktop_config.json
Merge this block, then restart Claude Desktop:
{
"mcpServers": {
"guardbee-llm-redteam": {
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-llm-redteam"
],
"env": {
"OPENAI_API_KEY": "sk-..."
}
}
}
}Cursor and other MCP clients
In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.
Example prompts in Claude
- “Run the safe GuardBee red-team suite against my OpenAI endpoint using gpt-4o-mini”
- “List the available LLM red-team probes grouped by category”
- “Which guardrail tests bypassed my staging webhook, and how should I fix them?”
Related links
See surface risk with Guardbee
MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.
Frequently asked questions
Do probes generate harmful content?
No. Each probe uses a random single-use canary token; it never asks for genuinely harmful output.
Which targets are supported?
OpenAI Chat Completions-compatible services, Anthropic Messages API, and custom webhooks accepting POST { prompt }.
Can I run it in production?
Only against targets you own or are explicitly authorized to test. Start in staging; probes send real requests and consume quota.