Reference

MCP server

@heyarka/mcp exposes the corpus, the shield pipeline, and the scorer as five MCP tools, so Claude, Cursor, or any other MCP client can red-team a trading agent conversationally. Every handler calls straight into @heyarka/core and @heyarka/shield, the same functions the CLI uses, not a reimplementation.

Setup

The server speaks stdio. Add it to your client’s MCP configuration:

claude_desktop_config.json

{
  "mcpServers": {
    "heyarka": {
      "command": "node",
      "args": ["packages/mcp/dist/bin.js"]
    }
  }
}

Run pnpm build first so dist/ exists. The server needs no API keys and makes no network calls.

The five tools

list_attack_vectors: Lists every vector in the corpus with its id, description, expected effect, and citation. Takes no arguments.
apply_attack_vector: Transforms a clean MarketContext into an attacked one using a named vector. Returns the attacked context so you can run your own agent on both and diff the orders.
shield_context: Runs the real sanitize → corroboration → point-in-time pipeline on a context and returns the cleaned result plus a full audit trail of what each layer changed.
check_risk_contract: Runs the deterministic, non-LLM veto check against a single proposed order, the same function the shield's final layer enforces.
score_results: Aggregates AttackResults you produced yourself into a full Scorecard with a letter grade. Does not run your agent for you.

What the server deliberately cannot do

It never runs your agent

There is no way to hand a live decide() function across the protocol, so the tools expose the parts of the harness that operate on data: applying vectors, shielding a context, checking a risk contract, and scoring results you produced. You run your agent; the server does the adversarial work around it.

This is also why score_results takes results as input rather than producing them. The server never fabricates a scorecard. it only aggregates real results you supply.

A typical loop

Inside an MCP client, the working pattern is:

Conversationally

1. list_attack_vectors
     → pick a vector id, e.g. "homoglyph-phantom-symbol"

2. apply_attack_vector { vectorId, context }
     → attacked context

3. run your own agent on the clean and attacked contexts

4. shield_context { context }
     → see what the agent would have been shown, hardened

5. score_results { agentName, results }
     → grade, injection susceptibility, per-family breakdown

All 16 vectors are available through step 2, and the scorer in step 5 is the same one behind arka score.