We build the tools we use for client work.
Both tools came out of real assessment work, and both were built with Claude Code. They show the kind of AI-assisted engineering we help clients do for themselves.
cpcsc-mcp
A Model Context Protocol (MCP) server that lets Claude, or any MCP client, assess an Azure subscription against ITSP.10.171 and draft your CPCSC Level 1 self-assessment. You ask a question and get back an answer based on your live configuration.
“Which controls are non-compliant in the access control family, and what’s the remediation effort for each?”
What it covers
- 46 ITSP.10.171 Rev 3 controls across 11 families: the 13 Level 1 controls plus groundwork for Level 2
- 33 automated or hybrid. The rest come with structured manual-review guidance, so a partial pass rate can’t look like a clean one
- Reads Azure Resource Graph, Defender for Cloud, Policy Insights, network security group rules, role assignments and resource locks
- Needs only the Reader and Security Reader roles. It never modifies a resource
Two ways to run it
Local
Runs from Claude Desktop (stdio) or Docker using your own az login. Nothing leaves your machine.
Hosted
A stateless Azure Container App reached over HTTPS, signed in with Entra ID or an API key. It scales to zero when idle.
Built to clear its own bar
cpcsc-mcp was built with Claude Code, and it follows the same practices we recommend to clients: least privilege, a stateless design that scales to zero, and security checks that must pass before every deploy.
Every change passes a security gate before it ships: Bandit (static analysis), pip-audit (dependency vulnerabilities), gitleaks (secrets) and Trivy (container image and infrastructure-as-code). If a fixable high or critical finding turns up, the deploy is blocked. Deploys authenticate with GitHub OIDC, so no credential is stored anywhere.
The licence
- Read everything. You can audit a compliance tool before relying on it.
- Free for your own assessments, including in production.
- Commercial service rights reserved. Offering it as a paid or hosted service to third parties needs a licence from Exploits Bay.
- Becomes open source. Each version converts to Apache 2.0 at its change date.
Or email info@exploitsbay.com
Include your GitHub handle and how you plan to use it. We’re especially keen to hear from assessors, compliance leads and anyone running it against varied tenants.
kev-check
Paste CVE identifiers from a scanner export and see which ones appear on CISA’s Known Exploited Vulnerabilities (KEV) catalogue.
KEV is a short, conservative list of vulnerabilities with reliable evidence of exploitation in the wild. That makes it the best place to start triage. It is a filter, not a to-do list: a KEV entry for software you don’t run isn’t your problem, and a CVE missing from KEV isn’t necessarily safe. Exposure and asset criticality still matter.
kev-check is free to use. Enter your email address and sign in with the one-time code sent to your inbox. There’s no account or password to create.
Your email address is used only to sign you in. See Privacy. KEV data is published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Want to see it run against your own tenant?
We’ll set you up to scan a non-production subscription and go through the gap report with you.