Show HN: Redthread – autonomous LLM pentesting with proof-of-concept exploits
Category: security
Tags: supply-chain-security, mcp, attestation, sigstore, llm-security
Score: 5.8/10 (Innovation: 7, Technical: 6, Documentation: 5, Utility: 5)
Redthread's atpp is a verification tool for signed ATPP badges claiming static scans of MCP servers, using DSSE envelopes, Ed25519 signatures, and Sigstore transparency logs. It provides CLI and MCP-based checks to gate MCP tool calls in Claude Code and Cursor, generate CycloneDX AIBOMs, and enforce custom policies. The project is notable for its rigorous supply-chain security approach applied to LLM tooling, though its practical utility is currently narrow pending broader MCP registry adoption.
Target audience: security engineers, devops, AI application developers
Repository: https://millenniums.ai/docs · Python
View on Hacker News