AgentIndex icon
AgentIndex
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompareGuides
Submit Tool
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompare
Home/
Security & Safety/
tcpk
tcpk logo

tcpk

Active·★ 23·MIT·Updated 2026-10-21

TCPK is a portable Windows thick-client and MSIX security audit tool designed to find, verify, and report vulnerabilities in desktop applications. It offers static and dynamic analysis, a PowerShell engine, a WinForms GUI, and an optional agentic AI workbench for local triage.

#Thick Client Pentesting#MSIX Security#PowerShell#Windows Security#Static Analysis#Dynamic Analysis#AI Triage
© 2026 AgentIndex.app|Built by a 10-year iOS Developer.
Best by use caseAboutContactAdvertisePrivacy PolicyTerms of UseQYSGitHubBuy me a coffee ☕

Browse by Category

MCP ServersCode AssistantWorkflow AutomationRAG / Knowledge BaseMulti-AgentBrowser AutomationLLM InfraDev ToolingObservability

Not affiliated with Anthropic, OpenAI or Microsoft.

Guides
#SBOM Generation
$ Install
$ git clone https://github.com/V33RU/tcpk.git && cd tcpk && .\TCPK.bat
↗ Visit site★ GitHub
01

Features

01Evidence-based verification: Proves high-value findings with IL decompilation and taint checking, moving beyond simple regex hits.
02Real CVSS v4.0 scoring: Scores each finding with a faithful port of the FIRST.org algorithm, providing accurate context-specific CVSS scores.
03Supply-chain CVE detection: Matches shipped components against live OSV and NVD-by-CPE, embedding version-accurate vulnerabilities in a CycloneDX SBOM.
04Local-first AI triage (optional): Pipes findings through a local Ollama model for AI review, keeping decompiled IL within the local environment by default.
05Engagement-ready reports: Generates comprehensive reports in HTML, multi-sheet Excel, JSON, SARIF, CycloneDX SBOM, and `intel.html` dashboard formats.
02

Compatibility

Windows 10/11
Platform
Verified via docs
PowerShell 5.1 | 7+
Runtime
Verified via docs
Ollama
AI Runtime
Verified via docs
03

Quick start

1
$ git clone https://github.com/V33RU/tcpk.git
2
$ cd tcpk
3
$ .\TCPK.bat
04

Use cases

↳Security auditing of Windows desktop applications: For identifying vulnerabilities in thick clients, MSIX packages, .NET, Electron, and native executables.
↳Compliance and vulnerability management: Generating comprehensive reports with CVSS v4.0 scores, CWE, MITRE ATT&CK, OWASP TASVS mappings, and SBOMs for regulatory compliance.
↳Threat intelligence gathering: Utilizing the `intel.html` dashboard and detailed findings to understand application security posture.
↳Automated static and dynamic analysis in pentesting workflows: Quickly performing initial assessments of thick client applications.
05

Alternatives

⚡Top VS:
VSReversecore_MCP★211→VSmcptrustchecker★172→VShackmyagent★86→

Comments

Log in to leave a comment

No comments yet. Be the first!

On this page
01Features02Compatibility03Quick start04Use cases05Alternatives
VS
agents-shipgate
★90
→
Reversecore_MCP logo
Reversecore_MCP★ 211
A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
VSCompare→
mcptrustchecker logo
mcptrustchecker★ 172
Security scanner for MCP (Model Context Protocol) servers — reads the real published npm/PyPI source, not just metadata, to catch tool poisoning, prompt injection, toxic flows & supply-chain risk. Offline, deterministic A–F Trust Score, SARIF + CI gates.
VSCompare→
hackmyagent logo
hackmyagent★ 86
Metasploit for AI agents: scan, attack, and fix AI agents and MCP servers. Open source security toolkit.
VSCompare→
agents-shipgate logo
agents-shipgate★ 90
The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, and SDK tool surfaces. Open-source CLI + GitHub Action.
VSCompare→
mcpsec logo
mcpsec★ 27
An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI) before your AI agents do.
VSCompare→
cc-audit logo
cc-audit★ 26
AI-free static security scanner for Claude Code artifacts (Skills, Hooks, MCP configs). Detects data exfiltration, prompt injection, and supply chain risks with deterministic, reproducible results.
VSCompare→
quark-engine logo
quark-engine★ 1.7k
Quark Agent - Your AI-powered Android APK Analyst
VSCompare→
reconbridge logo
reconbridge★ 29
通用逆向分析 KernelSU 模块：手机侧只做原子能力，智能全在 PC 侧（Claude Code + MCP）。仅限授权安全研究与教育用途。
VSCompare→
See all alternatives →
V33RU /
tcpk
↗

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed CVSS v4.0, CWE/ATT&CK mapping, SBOM, HTML/Excel reports. PowerShell engine, GUI, MCP server and agentic AI triage.

23MIT
Last commit2d ago
StatusActive
CategorySecurity & Safety
Links
Documentation↗Discussion↗Issues↗Releases↗
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit