ToolPain — MCP Security Harness on Vultr

ToolPain finds the MCP tools that hurt before they hurt you. Organizations are wiring Model Context Protocol servers into agents with little more than docs and hope. ToolPain is a containment-first security harness: paste a GitHub URL, and an agentic pipeline on Vultr proves at runtime what each tool actually does—files, network, processes—versus what it claims. Vultr is the substrate. A long-lived control-plane VM serves the web app and API, holds credentials, and proxies every LLM call. Per scan, the Vultr API creates (or claims from a warm pool) an ephemeral scanner VM from a baked snapshot. Vultr Serverless Inference—especially Qwen for codegen—reviews the repository and writes guarded setup, launch, and probe programs. The runner executes them inside Docker with a sinkhole and strace, then tears the scanner down. This is not a chatbot. The agent does real work: read the repo, generate bootstrap scripts across languages, repair build failures from feedback, discover tools from docs/static/runtime, research risk profiles, probe every tool under isolation, and emit an IT-facing report with a scan certificate and least-privilege allowlist. Safety is structural: model outputs pass AST/shell guards; Inference keys never leave the control plane; scanned servers never touch the host. Live at toolpain.com. Demos (clean / powerful / flagged) each start a real Vultr scan. Built for Vultr Agent Rush — Blast Radius Zero: plan → dispatch to isolated Vultr compute → verify executed results.