[{"id": "skill:DietrichGebert/ponytail/.openclaw/skills/ponytail-audit", "name": "ponytail-audit", "kind": "skill", "official": false, "desc": "Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.", "repo": "https://github.com/DietrichGebert/ponytail/tree/HEAD/.openclaw/skills/ponytail-audit", "install": ["npx skills add DietrichGebert/ponytail --skill ponytail-audit"], "stars": 190451, "pushed": "2026-10-29T11:59:31Z", "license": "MIT", "plat": "repo", "live": "Not checked (runs locally)"}, {"id": "skill:DietrichGebert/ponytail/.openclaw/skills/ponytail-debt", "name": "ponytail-debt", "kind": "skill", "official": false, "desc": "Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report.", "repo": "https://github.com/DietrichGebert/ponytail/tree/HEAD/.openclaw/skills/ponytail-debt", "install": ["npx skills add DietrichGebert/ponytail --skill ponytail-debt"], "stars": 190451, "pushed": "2026-10-29T11:59:31Z", "license": "MIT", "plat": "repo", "live": "Not checked (runs locally)"}, {"id": "skill:addyosmani/agent-skills/skills/security-and-hardening", "name": "security-and-hardening", "kind": "skill", "official": false, "desc": "Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions or session cookies, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply", "repo": "https://github.com/addyosmani/agent-skills/tree/HEAD/skills/security-and-hardening", "install": ["npx skills add addyosmani/agent-skills --skill security-and-hardening"], "stars": 117221, "pushed": "2026-11-14T04:33:56Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:paperclipai/paperclip/.agents/skills/deal-with-security-advisory", "name": "deal-with-security-advisory", "kind": "skill", "official": false, "desc": "Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.", "repo": "https://github.com/paperclipai/paperclip/tree/HEAD/.agents/skills/deal-with-security-advisory", "install": ["npx skills add paperclipai/paperclip --skill deal-with-security-advisory"], "stars": 113505, "pushed": "2026-11-13T09:51:38Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "skill:nexu-io/open-design/design-templates/html-ppt-knowledge-arch-blueprint", "name": "html-ppt-knowledge-arch-blueprint", "kind": "skill", "official": false, "desc": "OpenDesign's incident retro: the daemon-restart data bug, the root cause, the fix, and the systemic follow-ups. Built as a decision-grade product management deck for engineering, SRE, leadership.", "repo": "https://github.com/nexu-io/open-design/tree/HEAD/design-templates/html-ppt-knowledge-arch-blueprint", "install": ["npx skills add nexu-io/open-design --skill html-ppt-knowledge-arch-blueprint"], "stars": 107550, "pushed": "2026-11-14T01:09:21Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:nexu-io/open-design/design-templates/html-ppt-testing-safety-alert", "name": "html-ppt-testing-safety-alert", "kind": "skill", "official": false, "desc": "A hospital data-governance briefing: patient-data risk, the control framework, accountability, and the approval the board must give. Built as a decision-grade policy briefing deck for health-system board, regulators.", "repo": "https://github.com/nexu-io/open-design/tree/HEAD/design-templates/html-ppt-testing-safety-alert", "install": ["npx skills add nexu-io/open-design --skill html-ppt-testing-safety-alert"], "stars": 107550, "pushed": "2026-11-14T01:09:21Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:ComposioHQ/awesome-claude-skills/composio-skills/borneo-automation", "name": "borneo-automation", "kind": "skill", "official": false, "desc": "Automate Borneo tasks via Rube MCP (Composio). Always search tools first for current schemas.", "repo": "https://github.com/ComposioHQ/awesome-claude-skills/tree/HEAD/composio-skills/borneo-automation", "install": ["npx skills add ComposioHQ/awesome-claude-skills --skill borneo-automation"], "stars": 79451, "pushed": "2026-09-18T07:16:11Z", "license": null, "plat": "borneo", "live": "Not checked (runs locally)"}, {"id": "skill:ComposioHQ/awesome-claude-skills/composio-skills/control-d-automation", "name": "control-d-automation", "kind": "skill", "official": false, "desc": "Automate Control D tasks via Rube MCP (Composio). Always search tools first for current schemas.", "repo": "https://github.com/ComposioHQ/awesome-claude-skills/tree/HEAD/composio-skills/control-d-automation", "install": ["npx skills add ComposioHQ/awesome-claude-skills --skill control-d-automation"], "stars": 79451, "pushed": "2026-09-18T07:16:11Z", "license": null, "plat": "control d", "live": "Not checked (runs locally)"}, {"id": "skill:ComposioHQ/awesome-claude-skills/composio-skills/digicert-automation", "name": "digicert-automation", "kind": "skill", "official": false, "desc": "Automate Digicert tasks via Rube MCP (Composio). Always search tools first for current schemas.", "repo": "https://github.com/ComposioHQ/awesome-claude-skills/tree/HEAD/composio-skills/digicert-automation", "install": ["npx skills add ComposioHQ/awesome-claude-skills --skill digicert-automation"], "stars": 79451, "pushed": "2026-09-18T07:16:11Z", "license": null, "plat": "digicert", "live": "Not checked (runs locally)"}, {"id": "skill:code-yeongyu/oh-my-openagent/.agents/skills/security-research", "name": "security-research", "kind": "skill", "official": false, "desc": "Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 ", "repo": "https://github.com/code-yeongyu/oh-my-openagent/tree/HEAD/.agents/skills/security-research", "install": ["npx skills add code-yeongyu/oh-my-openagent --skill security-research"], "stars": 70897, "pushed": "2026-11-14T05:45:50Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-audit", "name": "accesslint-audit", "kind": "skill", "official": false, "desc": "Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (audit→edit→verify loop on a target). Prefers direct-CDP live-DOM auditing; falls back to a browser-MCP composition or HTML-string audits.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-audit", "install": ["npx skills add sickn33/agentic-awesome-skills --skill accesslint-audit"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-diff", "name": "accesslint-diff", "kind": "skill", "official": false, "desc": "Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [name] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-diff", "install": ["npx skills add sickn33/agentic-awesome-skills --skill accesslint-diff"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-scan", "name": "accesslint-scan", "kind": "skill", "official": false, "desc": "Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/accesslint-scan", "install": ["npx skills add sickn33/agentic-awesome-skills --skill accesslint-scan"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/api-security-testing", "name": "api-security-testing", "kind": "skill", "official": false, "desc": "API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/api-security-testing", "install": ["npx skills add sickn33/agentic-awesome-skills --skill api-security-testing"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/backend-security-coder", "name": "backend-security-coder", "kind": "skill", "official": false, "desc": "Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/backend-security-coder", "install": ["npx skills add sickn33/agentic-awesome-skills --skill backend-security-coder"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "backend security", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/burp-suite-testing", "name": "burp-suite-testing", "kind": "skill", "official": false, "desc": "Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/burp-suite-testing", "install": ["npx skills add sickn33/agentic-awesome-skills --skill burp-suite-testing"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "burp suite", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-privacy-compliance-engineering/skills/cc-skill-security-review", "name": "cc-skill-security-review", "kind": "skill", "official": false, "desc": "This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-privacy-compliance-engineering/skills/cc-skill-security-review", "install": ["npx skills add sickn33/agentic-awesome-skills --skill cc-skill-security-review"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/dependency-management-deps-audit", "name": "dependency-management-deps-audit", "kind": "skill", "official": false, "desc": "You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/dependency-management-deps-audit", "install": ["npx skills add sickn33/agentic-awesome-skills --skill dependency-management-deps-audit"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "dependency management", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/django-access-review", "name": "django-access-review", "kind": "skill", "official": false, "desc": "Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before proposing a verified fix.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/django-access-review", "install": ["npx skills add sickn33/agentic-awesome-skills --skill django-access-review"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "django security", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/fixing-accessibility", "name": "fixing-accessibility", "kind": "skill", "official": false, "desc": "Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast, and form errors. Use when adding interactive controls, forms, dialogs, or reviewing WCAG compliance.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/fixing-accessibility", "install": ["npx skills add sickn33/agentic-awesome-skills --skill fixing-accessibility"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/frontend-security-coder", "name": "frontend-security-coder", "kind": "skill", "official": false, "desc": "Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/frontend-security-coder", "install": ["npx skills add sickn33/agentic-awesome-skills --skill frontend-security-coder"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "frontend security", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-privacy-compliance-engineering/skills/fsi-compliance-checker", "name": "fsi-compliance-checker", "kind": "skill", "official": false, "desc": "Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0.1 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-privacy-compliance-engineering/skills/fsi-compliance-checker", "install": ["npx skills add sickn33/agentic-awesome-skills --skill fsi-compliance-checker"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-privacy-compliance-engineering/skills/pci-compliance", "name": "pci-compliance", "kind": "skill", "official": false, "desc": "Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-privacy-compliance-engineering/skills/pci-compliance", "install": ["npx skills add sickn33/agentic-awesome-skills --skill pci-compliance"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/sast-configuration", "name": "sast-configuration", "kind": "skill", "official": false, "desc": "Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/sast-configuration", "install": ["npx skills add sickn33/agentic-awesome-skills --skill sast-configuration"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/screen-reader-testing", "name": "screen-reader-testing", "kind": "skill", "official": false, "desc": "Practical guide to testing web applications with screen readers for comprehensive accessibility validation.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/screen-reader-testing", "install": ["npx skills add sickn33/agentic-awesome-skills --skill screen-reader-testing"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/security-auditor", "name": "security-auditor", "kind": "skill", "official": false, "desc": "Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/security-auditor", "install": ["npx skills add sickn33/agentic-awesome-skills --skill security-auditor"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/security-requirement-extraction", "name": "security-requirement-extraction", "kind": "skill", "official": false, "desc": "Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/security-requirement-extraction", "install": ["npx skills add sickn33/agentic-awesome-skills --skill security-requirement-extraction"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-agent-mcp-builder/skills/skill-security-audit", "name": "skill-security-audit", "kind": "skill", "official": false, "desc": "Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data flow, and irreversible actions.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-agent-mcp-builder/skills/skill-security-audit", "install": ["npx skills add sickn33/agentic-awesome-skills --skill skill-security-audit"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-secure-app-builder/skills/threat-modeling-expert", "name": "threat-modeling-expert", "kind": "skill", "official": false, "desc": "Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-secure-app-builder/skills/threat-modeling-expert", "install": ["npx skills add sickn33/agentic-awesome-skills --skill threat-modeling-expert"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/top-web-vulnerabilities", "name": "top-web-vulnerabilities", "kind": "skill", "official": false, "desc": "Provide an illustrative, overlapping reference for common web application vulnerability patterns organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/top-web-vulnerabilities", "install": ["npx skills add sickn33/agentic-awesome-skills --skill top-web-vulnerabilities"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/ui-a11y", "name": "ui-a11y", "kind": "skill", "official": false, "desc": "Audit a component or page for accessibility issues and fix them", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/ui-a11y", "install": ["npx skills add sickn33/agentic-awesome-skills --skill ui-a11y"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/vulnerability-scanner", "name": "vulnerability-scanner", "kind": "skill", "official": false, "desc": "Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/vulnerability-scanner", "install": ["npx skills add sickn33/agentic-awesome-skills --skill vulnerability-scanner"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-accessibility-inclusive-ux/skills/wcag-audit-patterns", "name": "wcag-audit-patterns", "kind": "skill", "official": false, "desc": "Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-accessibility-inclusive-ux/skills/wcag-audit-patterns", "install": ["npx skills add sickn33/agentic-awesome-skills --skill wcag-audit-patterns"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/web-security-testing", "name": "web-security-testing", "kind": "skill", "official": false, "desc": "Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/web-security-testing", "install": ["npx skills add sickn33/agentic-awesome-skills --skill web-security-testing"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:claude-security", "name": "claude-security", "kind": "claude-plugin", "official": null, "desc": "Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.", "repo": "https://github.com/anthropics/claude-plugins-official", "install": ["claude plugin install claude-security@claude-plugins-official"], "stars": 47064, "pushed": "2026-11-13T01:14:19Z", "license": "Apache-2.0", "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/security-scanning/skills/attack-tree-construction", "name": "attack-tree-construction", "kind": "skill", "official": false, "desc": "Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/security-scanning/skills/attack-tree-construction", "install": ["npx skills add wshobson/agents --skill attack-tree-construction"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/hr-legal-compliance/skills/gdpr-data-handling", "name": "gdpr-data-handling", "kind": "skill", "official": false, "desc": "Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/hr-legal-compliance/skills/gdpr-data-handling", "install": ["npx skills add wshobson/agents --skill gdpr-data-handling"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/incident-response/skills/incident-runbook-templates", "name": "incident-runbook-templates", "kind": "skill", "official": false, "desc": "Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion, replication lag, and disk space alerts; onboarding new on-call engineers who need step-by-step recovery guides written for a 3 AM brain; or standardizing escalation matrices across multiple engineering teams.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/incident-response/skills/incident-runbook-templates", "install": ["npx skills add wshobson/agents --skill incident-runbook-templates"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/incident-response/skills/postmortem-writing", "name": "postmortem-writing", "kind": "skill", "official": false, "desc": "Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem documents, or improving incident response processes.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/incident-response/skills/postmortem-writing", "install": ["npx skills add wshobson/agents --skill postmortem-writing"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/reverse-engineering/skills/protocol-reverse-engineering", "name": "protocol-reverse-engineering", "kind": "skill", "official": false, "desc": "Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/reverse-engineering/skills/protocol-reverse-engineering", "install": ["npx skills add wshobson/agents --skill protocol-reverse-engineering"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/security-scanning/skills/sast-configuration", "name": "sast-configuration", "kind": "skill", "official": false, "desc": "Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/security-scanning/skills/sast-configuration", "install": ["npx skills add wshobson/agents --skill sast-configuration"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/blockchain-web3/skills/solidity-security", "name": "solidity-security", "kind": "skill", "official": false, "desc": "Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/blockchain-web3/skills/solidity-security", "install": ["npx skills add wshobson/agents --skill solidity-security"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "solidity", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/security-scanning/skills/stride-analysis-patterns", "name": "stride-analysis-patterns", "kind": "skill", "official": false, "desc": "Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/security-scanning/skills/stride-analysis-patterns", "install": ["npx skills add wshobson/agents --skill stride-analysis-patterns"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/security-scanning/skills/threat-mitigation-mapping", "name": "threat-mitigation-mapping", "kind": "skill", "official": false, "desc": "Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/security-scanning/skills/threat-mitigation-mapping", "install": ["npx skills add wshobson/agents --skill threat-mitigation-mapping"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:github/awesome-copilot/skills/audit-integrity", "name": "audit-integrity", "kind": "skill", "official": false, "desc": "Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.", "repo": "https://github.com/github/awesome-copilot/tree/HEAD/skills/audit-integrity", "install": ["npx skills add github/awesome-copilot --skill audit-integrity"], "stars": 41140, "pushed": "2026-11-13T21:37:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:github/awesome-copilot/skills/data-breach-blast-radius", "name": "data-breach-blast-radius", "kind": "skill", "official": false, "desc": "Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: \"assess breach impact\", \"what data could be exposed\", \"calculate blast ra", "repo": "https://github.com/github/awesome-copilot/tree/HEAD/skills/data-breach-blast-radius", "install": ["npx skills add github/awesome-copilot --skill data-breach-blast-radius"], "stars": 41140, "pushed": "2026-11-13T21:37:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:github/awesome-copilot/skills/gdpr-compliant", "name": "gdpr-compliant", "kind": "skill", "official": false, "desc": "Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach", "repo": "https://github.com/github/awesome-copilot/tree/HEAD/skills/gdpr-compliant", "install": ["npx skills add github/awesome-copilot --skill gdpr-compliant"], "stars": 41140, "pushed": "2026-11-13T21:37:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/achieving-cmmc-level-2-compliance", "name": "achieving-cmmc-level-2-compliance", "kind": "skill", "official": false, "desc": "Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or resp", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/achieving-cmmc-level-2-compliance", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill achieving-cmmc-level-2-compliance"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cmmc", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-ethereum-smart-contract-vulnerabilities", "name": "analyzing-ethereum-smart-contract-vulnerabilities", "kind": "skill", "official": false, "desc": "Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-ethereum-smart-contract-vulnerabilities", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ethereum-smart-contract-vulnerabilities"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ethereum", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-soc-metrics-and-kpi-tracking", "name": "building-soc-metrics-and-kpi-tracking", "kind": "skill", "official": false, "desc": "Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-soc-metrics-and-kpi-tracking", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-soc-metrics-and-kpi-tracking"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "siem", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-soc-playbook-for-ransomware", "name": "building-soc-playbook-for-ransomware", "kind": "skill", "official": false, "desc": "Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-soc-playbook-for-ransomware", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-soc-playbook-for-ransomware"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "siem", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-actor-profile-from-osint", "name": "building-threat-actor-profile-from-osint", "kind": "skill", "official": false, "desc": "Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-actor-profile-from-osint", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-actor-profile-from-osint"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "maltego", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-feed-aggregation-with-misp", "name": "building-threat-feed-aggregation-with-misp", "kind": "skill", "official": false, "desc": "Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-feed-aggregation-with-misp", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-feed-aggregation-with-misp"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "misp", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-hunt-hypothesis-framework", "name": "building-threat-hunt-hypothesis-framework", "kind": "skill", "official": false, "desc": "Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-hunt-hypothesis-framework", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-hunt-hypothesis-framework"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "edr/siem", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-intelligence-enrichment-in-splunk", "name": "building-threat-intelligence-enrichment-in-splunk", "kind": "skill", "official": false, "desc": "Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-intelligence-enrichment-in-splunk", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-intelligence-enrichment-in-splunk"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "splunk", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-intelligence-feed-integration", "name": "building-threat-intelligence-feed-integration", "kind": "skill", "official": false, "desc": "Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-intelligence-feed-integration", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-intelligence-feed-integration"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "siem", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-threat-intelligence-platform", "name": "building-threat-intelligence-platform", "kind": "skill", "official": false, "desc": "Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-threat-intelligence-platform", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-threat-intelligence-platform"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "misp", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-vulnerability-aging-and-sla-tracking", "name": "building-vulnerability-aging-and-sla-tracking", "kind": "skill", "official": false, "desc": "Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-vulnerability-aging-and-sla-tracking", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-aging-and-sla-tracking"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "vulnerability management", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-vulnerability-dashboard-with-defectdojo", "name": "building-vulnerability-dashboard-with-defectdojo", "kind": "skill", "official": false, "desc": "Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-vulnerability-dashboard-with-defectdojo", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-dashboard-with-defectdojo"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "defectdojo", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-vulnerability-exception-tracking-system", "name": "building-vulnerability-exception-tracking-system", "kind": "skill", "official": false, "desc": "Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-vulnerability-exception-tracking-system", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-exception-tracking-system"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "vulnerability management", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/building-vulnerability-scanning-workflow", "name": "building-vulnerability-scanning-workflow", "kind": "skill", "official": false, "desc": "Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/building-vulnerability-scanning-workflow", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-scanning-workflow"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "nessus", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/bypassing-authentication-with-forced-browsing", "name": "bypassing-authentication-with-forced-browsing", "kind": "skill", "official": false, "desc": "Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/bypassing-authentication-with-forced-browsing", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill bypassing-authentication-with-forced-browsing"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/coercing-authentication-with-coercer-petitpotam", "name": "coercing-authentication-with-coercer-petitpotam", "kind": "skill", "official": false, "desc": "Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/coercing-authentication-with-coercer-petitpotam", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill coercing-authentication-with-coercer-petitpotam"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ad cs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/collecting-indicators-of-compromise", "name": "collecting-indicators-of-compromise", "kind": "skill", "official": false, "desc": "Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/collecting-indicators-of-compromise", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-indicators-of-compromise"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "iocs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/collecting-open-source-intelligence", "name": "collecting-open-source-intelligence", "kind": "skill", "official": false, "desc": "Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, Spider", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/collecting-open-source-intelligence", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/collecting-threat-intelligence-with-misp", "name": "collecting-threat-intelligence-with-misp", "kind": "skill", "official": false, "desc": "Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/collecting-threat-intelligence-with-misp", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-threat-intelligence-with-misp"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "misp", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/collecting-volatile-evidence-from-compromised-host", "name": "collecting-volatile-evidence-from-compromised-host", "kind": "skill", "official": false, "desc": "Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/collecting-volatile-evidence-from-compromised-host", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-volatile-evidence-from-compromised-host"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "forensic", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-api-security-testing", "name": "conducting-api-security-testing", "kind": "skill", "official": false, "desc": "Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability te", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-api-security-testing", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-api-security-testing"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-cloud-incident-response", "name": "conducting-cloud-incident-response", "kind": "skill", "official": false, "desc": "Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-cloud-incident-response", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-response"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-cloud-penetration-testing", "name": "conducting-cloud-penetration-testing", "kind": "skill", "official": false, "desc": "This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-cloud-penetration-testing", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-penetration-testing"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-cyber-risk-assessment-with-nist-800-30", "name": "conducting-cyber-risk-assessment-with-nist-800-30", "kind": "skill", "official": false, "desc": "Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk anal", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-cyber-risk-assessment-with-nist-800-30", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cyber-risk-assessment-with-nist-800-30"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "nist", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-domain-persistence-with-dcsync", "name": "conducting-domain-persistence-with-dcsync", "kind": "skill", "official": false, "desc": "Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-domain-persistence-with-dcsync", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-domain-persistence-with-dcsync"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ad", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-external-reconnaissance-with-osint", "name": "conducting-external-reconnaissance-with-osint", "kind": "skill", "official": false, "desc": "Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-external-reconnaissance-with-osint", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-external-reconnaissance-with-osint"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-active-directory-tiered-model", "name": "configuring-active-directory-tiered-model", "kind": "skill", "official": false, "desc": "Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, and authentication policy silos. Use when designing or hardening AD privileged-access architecture, segmenting Domain/Enterprise Admin accounts into tiers, or containing lateral movement and credential theft (pass-the-hash, Kerberoasting, golden tickets).", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-active-directory-tiered-model", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-active-directory-tiered-model"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-aws-verified-access-for-ztna", "name": "configuring-aws-verified-access-for-ztna", "kind": "skill", "official": false, "desc": "Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trust providers (IAM Identity Center, Okta/OIDC), device posture providers (CrowdStrike, Jamf), Cedar policy authoring, and Terraform deployment. Use when replacing VPN access with ZTNA, writing Cedar access policies, or deploying Verified Access instances, groups, and endpoints across AWS accounts.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-aws-verified-access-for-ztna", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-aws-verified-access-for-ztna"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-certificate-authority-with-openssl", "name": "configuring-certificate-authority-with-openssl", "kind": "skill", "official": false, "desc": "Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-certificate-authority-with-openssl", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-certificate-authority-with-openssl"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-host-based-intrusion-detection", "name": "configuring-host-based-intrusion-detection", "kind": "skill", "official": false, "desc": "Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-host-based-intrusion-detection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-host-based-intrusion-detection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-hsm-for-key-storage", "name": "configuring-hsm-for-key-storage", "kind": "skill", "official": false, "desc": "Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-hsm-for-key-storage", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-hsm-for-key-storage"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-identity-aware-proxy-with-google-iap", "name": "configuring-identity-aware-proxy-with-google-iap", "kind": "skill", "official": false, "desc": "Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session/reauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-identity-aware-proxy-with-google-iap", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-identity-aware-proxy-with-google-iap"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-ldap-security-hardening", "name": "configuring-ldap-security-hardening", "kind": "skill", "official": false, "desc": "Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel binding, and LDAP signing. Use when securing an LDAP or Active Directory environment against these attack classes or auditing directory service configurations for these vulnerabilities.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-ldap-security-hardening", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-ldap-security-hardening"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-microsegmentation-for-zero-trust", "name": "configuring-microsegmentation-for-zero-trust", "kind": "skill", "official": false, "desc": "Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures. Use when designing or implementing network microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-microsegmentation-for-zero-trust", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-microsegmentation-for-zero-trust"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-multi-factor-authentication-with-duo", "name": "configuring-multi-factor-authentication-with-duo", "kind": "skill", "official": false, "desc": "Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2 deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA for remote access, VPN, or privileged logins with Duo.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-multi-factor-authentication-with-duo", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-multi-factor-authentication-with-duo"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-network-segmentation-with-vlans", "name": "configuring-network-segmentation-with-vlans", "kind": "skill", "official": false, "desc": "Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, and to limit lateral movement paths. Use when segmenting an enterprise network into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC 2) for network isolation, or reducing blast radius from a security incident. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-network-segmentation-with-vlans", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-network-segmentation-with-vlans"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-oauth2-authorization-flow", "name": "configuring-oauth2-authorization-flow", "kind": "skill", "official": false, "desc": "Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-oauth2-authorization-flow", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-pfsense-firewall-rules", "name": "configuring-pfsense-firewall-rules", "kind": "skill", "official": false, "desc": "Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic between zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter or internal firewall, setting up port-forwarding NAT, configuring site-to-site or remote-access VPNs, or applying QoS/bandwidth policies. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-pfsense-firewall-rules", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-pfsense-firewall-rules"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-snort-ids-for-intrusion-detection", "name": "configuring-snort-ids-for-intrusion-detection", "kind": "skill", "official": false, "desc": "Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when deploying network-based intrusion detection at key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives, or integrating Snort alerts with a SIEM. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-snort-ids-for-intrusion-detection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-snort-ids-for-intrusion-detection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-suricata-for-network-monitoring", "name": "configuring-suricata-for-network-monitoring", "kind": "skill", "official": false, "desc": "Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-suricata-for-network-monitoring", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-suricata-for-network-monitoring"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-tls-1-3-for-secure-communications", "name": "configuring-tls-1-3-for-secure-communications", "kind": "skill", "official": false, "desc": "Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh. Use when deploying or hardening TLS 1.3 for secure communications, or when testing a server for common TLS misconfigurations and vulnerabilities.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-tls-1-3-for-secure-communications", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-tls-1-3-for-secure-communications"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-windows-defender-advanced-settings", "name": "configuring-windows-defender-advanced-settings", "kind": "skill", "official": false, "desc": "Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-windows-defender-advanced-settings", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-windows-defender-advanced-settings"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-windows-event-logging-for-detection", "name": "configuring-windows-event-logging-for-detection", "kind": "skill", "official": false, "desc": "Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-windows-event-logging-for-detection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-windows-event-logging-for-detection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/configuring-zscaler-private-access-for-ztna", "name": "configuring-zscaler-private-access-for-ztna", "kind": "skill", "official": false, "desc": "Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/configuring-zscaler-private-access-for-ztna", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-zscaler-private-access-for-ztna"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/containing-active-breach", "name": "containing-active-breach", "kind": "skill", "official": false, "desc": "Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/containing-active-breach", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill containing-active-breach"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/continuous-llm-red-teaming-with-promptfoo", "name": "continuous-llm-red-teaming-with-promptfoo", "kind": "skill", "official": false, "desc": "Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking security gate, or comparing model/prompt versions for compliance reporting.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/continuous-llm-red-teaming-with-promptfoo", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill continuous-llm-red-teaming-with-promptfoo"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/correlating-security-events-in-qradar", "name": "correlating-security-events-in-qradar", "kind": "skill", "official": false, "desc": "Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/correlating-security-events-in-qradar", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill correlating-security-events-in-qradar"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/correlating-threat-campaigns", "name": "correlating-threat-campaigns", "kind": "skill", "official": false, "desc": "Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/correlating-threat-campaigns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill correlating-threat-campaigns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/defending-llms-with-guardrails", "name": "defending-llms-with-guardrails", "kind": "skill", "official": false, "desc": "Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspect and constrain LLM prompts and responses. Use when adding a production runtime safety layer to an LLM, RAG, or agent application to block jailbreaks, prompt injection (OWASP LLM01), toxic content, or sensitive-data leakage before it reaches or leaves the model.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/defending-llms-with-guardrails", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill defending-llms-with-guardrails"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deobfuscating-javascript-malware", "name": "deobfuscating-javascript-malware", "kind": "skill", "official": false, "desc": "Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deobfuscating-javascript-malware", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deobfuscating-javascript-malware"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deobfuscating-powershell-obfuscated-malware", "name": "deobfuscating-powershell-obfuscated-malware", "kind": "skill", "official": false, "desc": "Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deobfuscating-powershell-obfuscated-malware", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deobfuscating-powershell-obfuscated-malware"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-active-directory-honeytokens", "name": "deploying-active-directory-honeytokens", "kind": "skill", "official": false, "desc": "Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-active-directory-honeytokens", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-cloud-deception-with-decoy-resources", "name": "deploying-cloud-deception-with-decoy-resources", "kind": "skill", "official": false, "desc": "Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a dec", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-cloud-deception-with-decoy-resources", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-cloud-deception-with-decoy-resources"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-cloudflare-access-for-zero-trust", "name": "deploying-cloudflare-access-for-zero-trust", "kind": "skill", "official": false, "desc": "Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-cloudflare-access-for-zero-trust", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-cloudflare-access-for-zero-trust"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-decoy-files-for-ransomware-detection", "name": "deploying-decoy-files-for-ransomware-detection", "kind": "skill", "official": false, "desc": "Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-decoy-files-for-ransomware-detection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-decoy-files-for-ransomware-detection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-edr-agent-with-crowdstrike", "name": "deploying-edr-agent-with-crowdstrike", "kind": "skill", "official": false, "desc": "Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-edr-agent-with-crowdstrike", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-edr-agent-with-crowdstrike"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-honeytokens-and-canarytokens", "name": "deploying-honeytokens-and-canarytokens", "kind": "skill", "official": false, "desc": "Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched. Use for high-fidelity intrusion detection in low-telemetry areas like file shares or credential stores, or to catch credential dumping and data-theft staging.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-honeytokens-and-canarytokens", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-honeytokens-and-canarytokens"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-osquery-for-endpoint-monitoring", "name": "deploying-osquery-for-endpoint-monitoring", "kind": "skill", "official": false, "desc": "Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-osquery-for-endpoint-monitoring", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-osquery-for-endpoint-monitoring"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-palo-alto-prisma-access-zero-trust", "name": "deploying-palo-alto-prisma-access-zero-trust", "kind": "skill", "official": false, "desc": "Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-palo-alto-prisma-access-zero-trust", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-palo-alto-prisma-access-zero-trust"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/deploying-ransomware-canary-files", "name": "deploying-ransomware-canary-files", "kind": "skill", "official": false, "desc": "Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/deploying-ransomware-canary-files", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-ransomware-canary-files"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-ai-model-prompt-injection-attacks", "name": "detecting-ai-model-prompt-injection-attacks", "kind": "skill", "official": false, "desc": "Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-ai-model-prompt-injection-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ai-model-prompt-injection-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-anomalies-in-industrial-control-systems", "name": "detecting-anomalies-in-industrial-control-systems", "kind": "skill", "official": false, "desc": "Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-anomalies-in-industrial-control-systems", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-anomalies-in-industrial-control-systems"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-anomalous-authentication-patterns", "name": "detecting-anomalous-authentication-patterns", "kind": "skill", "official": false, "desc": "Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-anomalous-authentication-patterns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-anomalous-authentication-patterns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-api-enumeration-attacks", "name": "detecting-api-enumeration-attacks", "kind": "skill", "official": false, "desc": "Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200/401/403 response patterns from API gateway and WAF logs. Use when investigating suspected object-level authorization abuse, building threat-hunting queries for API access-control bypass, or hardening API logging/rate-limiting against enumeration.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-api-enumeration-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-api-enumeration-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-arp-poisoning-in-network-traffic", "name": "detecting-arp-poisoning-in-network-traffic", "kind": "skill", "official": false, "desc": "Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. Use when investigating suspected man-in-the-middle interception or session hijacking on a local network segment, or when building layer-2 anomaly detection for a SOC.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-arp-poisoning-in-network-traffic", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-attacks-on-historian-servers", "name": "detecting-attacks-on-historian-servers", "kind": "skill", "official": false, "desc": "Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks. Use when monitoring historians bridging IT/OT zones for compromise, investigating historian-specific CVE exploitation, or validating historian data integrity after a suspected OT incident. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-attacks-on-historian-servers", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-attacks-on-historian-servers"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-attacks-on-scada-systems", "name": "detecting-attacks-on-scada-systems", "kind": "skill", "official": false, "desc": "This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control system communications. It leverages OT-specific intrusion detection systems, industrial protocol anomaly detection, and process data analytics to identify attacks that traditional IT security tools miss. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-attacks-on-scada-systems", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-attacks-on-scada-systems"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-aws-cloudtrail-anomalies", "name": "detecting-aws-cloudtrail-anomalies", "kind": "skill", "official": false, "desc": "Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-aws-cloudtrail-anomalies", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-aws-cloudtrail-anomalies"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-aws-guardduty-findings-automation", "name": "detecting-aws-guardduty-findings-automation", "kind": "skill", "official": false, "desc": "Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notifications. Use when designing automated remediation playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 data events, or when reducing mean time to respond to cloud threats.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-aws-guardduty-findings-automation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-aws-guardduty-findings-automation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-aws-iam-privilege-escalation", "name": "detecting-aws-iam-privilege-escalation", "kind": "skill", "official": false, "desc": "Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-aws-iam-privilege-escalation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-aws-iam-privilege-escalation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-azure-lateral-movement", "name": "detecting-azure-lateral-movement", "kind": "skill", "official": false, "desc": "Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-azure-lateral-movement", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-lateral-movement"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-azure-service-principal-abuse", "name": "detecting-azure-service-principal-abuse", "kind": "skill", "official": false, "desc": "Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, covering added credentials, privileged role assignment, admin consent bypass, and service principal enumeration. Use when investigating suspected privilege escalation or persistence via service principals, or building threat-hunting queries for Entra ID identity abuse.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-azure-service-principal-abuse", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-service-principal-abuse"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-azure-storage-account-misconfigurations", "name": "detecting-azure-storage-account-misconfigurations", "kind": "skill", "official": false, "desc": "Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-azure-storage-account-misconfigurations", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-storage-account-misconfigurations"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-beaconing-patterns-with-zeek", "name": "detecting-beaconing-patterns-with-zeek", "kind": "skill", "official": false, "desc": "Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-beaconing-patterns-with-zeek", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-beaconing-patterns-with-zeek"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-bluetooth-low-energy-attacks", "name": "detecting-bluetooth-low-energy-attacks", "kind": "skill", "official": false, "desc": "Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests invo", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-bluetooth-low-energy-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-bluetooth-low-energy-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-broken-object-property-level-authorization", "name": "detecting-broken-object-property-level-authorization", "kind": "skill", "official": false, "desc": "Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties. Use when reviewing API responses/requests for over-exposed or over-writable object fields, or building detection rules and test cases for property-level authorization gaps that object-level checks miss.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-broken-object-property-level-authorization", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-broken-object-property-level-authorization"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-business-email-compromise", "name": "detecting-business-email-compromise", "kind": "skill", "official": false, "desc": "Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links, using email gateway rules, behavioral analytics, and financial process controls. Use when investigating a suspected executive/vendor impersonation email or building detection rules for social-engineering fund-transfer fraud.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-business-email-compromise", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-business-email-compromise"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-business-email-compromise-with-ai", "name": "detecting-business-email-compromise-with-ai", "kind": "skill", "official": false, "desc": "Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-business-email-compromise-with-ai", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-business-email-compromise-with-ai"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-cloud-threats-with-guardduty", "name": "detecting-cloud-threats-with-guardduty", "kind": "skill", "official": false, "desc": "Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and building automated response with EventBridge and Lambda. Use when establishing threat detection for AWS accounts, investigating findings on compromised instances or credential abuse, or building automated incident-response playbooks. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-cloud-threats-with-guardduty", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-cloud-threats-with-guardduty"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-command-and-control-over-dns", "name": "detecting-command-and-control-over-dns", "kind": "skill", "official": false, "desc": "Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, detecting DNS beaconing, or building DNS anomaly rules for a SOC/SIEM. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-command-and-control-over-dns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-command-and-control-over-dns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-compromised-cloud-credentials", "name": "detecting-compromised-cloud-credentials", "kind": "skill", "official": false, "desc": "Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. Use when investigating alerts about cloud API activity from unfamiliar locations, responding to an exposed-credential notification, or scoping a credential compromise. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-compromised-cloud-credentials", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-compromised-cloud-credentials"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-credential-dumping-techniques", "name": "detecting-credential-dumping-techniques", "kind": "skill", "official": false, "desc": "Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-credential-dumping-techniques", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-credential-dumping-techniques"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-dcsync-attack-in-active-directory", "name": "detecting-dcsync-attack-in-active-directory", "kind": "skill", "official": false, "desc": "Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-dcsync-attack-in-active-directory", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dcsync-attack-in-active-directory"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-dependency-confusion", "name": "detecting-dependency-confusion", "kind": "skill", "official": false, "desc": "Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-dependency-confusion", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dependency-confusion"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-dll-sideloading-attacks", "name": "detecting-dll-sideloading-attacks", "kind": "skill", "official": false, "desc": "Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-dll-sideloading-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dll-sideloading-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-dnp3-protocol-anomalies", "name": "detecting-dnp3-protocol-anomalies", "kind": "skill", "official": false, "desc": "Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-dnp3-protocol-anomalies", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dnp3-protocol-anomalies"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "scada/ics", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-dns-exfiltration-with-dns-query-analysis", "name": "detecting-dns-exfiltration-with-dns-query-analysis", "kind": "skill", "official": false, "desc": "Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-dns-exfiltration-with-dns-query-analysis", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-dns-exfiltration-with-dns-query-analysis"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "dns", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-entra-offensive-tools-in-graph-logs", "name": "detecting-entra-offensive-tools-in-graph-logs", "kind": "skill", "official": false, "desc": "Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-entra-offensive-tools-in-graph-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "microsoft sentinel", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-evasion-techniques-in-endpoint-logs", "name": "detecting-evasion-techniques-in-endpoint-logs", "kind": "skill", "official": false, "desc": "Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-evasion-techniques-in-endpoint-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "endpoints", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-exfiltration-over-dns-with-zeek", "name": "detecting-exfiltration-over-dns-with-zeek", "kind": "skill", "official": false, "desc": "Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-exfiltration-over-dns-with-zeek", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-exfiltration-over-dns-with-zeek"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "dns", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-fileless-attacks-on-endpoints", "name": "detecting-fileless-attacks-on-endpoints", "kind": "skill", "official": false, "desc": "Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-fileless-attacks-on-endpoints", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-fileless-attacks-on-endpoints"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "endpoints", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-fileless-malware-techniques", "name": "detecting-fileless-malware-techniques", "kind": "skill", "official": false, "desc": "Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-fileless-malware-techniques", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-fileless-malware-techniques"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "endpoints", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-attacks-in-kerberos-logs", "name": "detecting-golden-ticket-attacks-in-kerberos-logs", "kind": "skill", "official": false, "desc": "Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-golden-ticket-attacks-in-kerberos-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-attacks-in-kerberos-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-forgery", "name": "detecting-golden-ticket-forgery", "kind": "skill", "official": false, "desc": "Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating suspected forged Kerberos tickets or krbtgt credential theft in Active Directory.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-golden-ticket-forgery", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-forgery"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-insider-data-exfiltration-via-dlp", "name": "detecting-insider-data-exfiltration-via-dlp", "kind": "skill", "official": false, "desc": "Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-insider-data-exfiltration-via-dlp", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-data-exfiltration-via-dlp"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-insider-threat-behaviors", "name": "detecting-insider-threat-behaviors", "kind": "skill", "official": false, "desc": "Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft. Use when proactively threat-hunting for malicious or negligent insider activity, or when investigating a departing or disgruntled employee for potential data theft.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-insider-threat-behaviors", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-threat-behaviors"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "endpoints", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-insider-threat-with-ueba", "name": "detecting-insider-threat-with-ueba", "kind": "skill", "official": false, "desc": "Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off manual hunt.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-insider-threat-with-ueba", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-threat-with-ueba"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "elasticsearch/opensearch", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-kerberoasting-attacks", "name": "detecting-kerberoasting-attacks", "kind": "skill", "official": false, "desc": "Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords. Use when hunting for MITRE T1558 credential access activity or investigating suspected service account password cracking attempts in Active Directory Kerberos logs.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-kerberoasting-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-kerberoasting-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows event logs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-in-network", "name": "detecting-lateral-movement-in-network", "kind": "skill", "official": false, "desc": "Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-lateral-movement-in-network", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-in-network"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "zeek", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-splunk", "name": "detecting-lateral-movement-with-splunk", "kind": "skill", "official": false, "desc": "Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-lateral-movement-with-splunk", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-splunk"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "splunk", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-zeek", "name": "detecting-lateral-movement-with-zeek", "kind": "skill", "official": false, "desc": "Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-lateral-movement-with-zeek", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-zeek"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "zeek", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-living-off-the-land-attacks", "name": "detecting-living-off-the-land-attacks", "kind": "skill", "official": false, "desc": "Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-living-off-the-land-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-living-off-the-land-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-living-off-the-land-with-lolbas", "name": "detecting-living-off-the-land-with-lolbas", "kind": "skill", "official": false, "desc": "Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-living-off-the-land-with-lolbas", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-living-off-the-land-with-lolbas"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "sysmon", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-malicious-npm-packages", "name": "detecting-malicious-npm-packages", "kind": "skill", "official": false, "desc": "Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-malicious-npm-packages", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-malicious-npm-packages"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-malicious-scheduled-tasks-with-sysmon", "name": "detecting-malicious-scheduled-tasks-with-sysmon", "kind": "skill", "official": false, "desc": "Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job ana", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-malicious-scheduled-tasks-with-sysmon", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-malicious-scheduled-tasks-with-sysmon"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "sysmon", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-mimikatz-execution-patterns", "name": "detecting-mimikatz-execution-patterns", "kind": "skill", "official": false, "desc": "Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-mimikatz-execution-patterns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mimikatz-execution-patterns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-misconfigured-azure-storage", "name": "detecting-misconfigured-azure-storage", "kind": "skill", "official": false, "desc": "Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-misconfigured-azure-storage", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-misconfigured-azure-storage"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-mobile-malware-behavior", "name": "detecting-mobile-malware-behavior", "kind": "skill", "official": false, "desc": "Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-mobile-malware-behavior", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mobile-malware-behavior"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "mobile apps", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-modbus-command-injection-attacks", "name": "detecting-modbus-command-injection-attacks", "kind": "skill", "official": false, "desc": "Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-modbus-command-injection-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-modbus-command-injection-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "modbus", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-modbus-protocol-anomalies", "name": "detecting-modbus-protocol-anomalies", "kind": "skill", "official": false, "desc": "Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-modbus-protocol-anomalies", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-modbus-protocol-anomalies"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "modbus", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-model-extraction-attacks", "name": "detecting-model-extraction-attacks", "kind": "skill", "official": false, "desc": "Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-model-extraction-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-model-extraction-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ai models", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-network-anomalies-with-zeek", "name": "detecting-network-anomalies-with-zeek", "kind": "skill", "official": false, "desc": "Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-network-anomalies-with-zeek", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-network-anomalies-with-zeek"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "zeek", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-network-scanning-with-ids-signatures", "name": "detecting-network-scanning-with-ids-signatures", "kind": "skill", "official": false, "desc": "Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-network-scanning-with-ids-signatures", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-network-scanning-with-ids-signatures"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "suricata", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-ntlm-relay-with-event-correlation", "name": "detecting-ntlm-relay-with-event-correlation", "kind": "skill", "official": false, "desc": "Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-ntlm-relay-with-event-correlation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ntlm-relay-with-event-correlation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows event logs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-oauth-token-theft", "name": "detecting-oauth-token-theft", "kind": "skill", "official": false, "desc": "Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-oauth-token-theft", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-oauth-token-theft"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "microsoft entra id", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-pass-the-hash-attacks", "name": "detecting-pass-the-hash-attacks", "kind": "skill", "official": false, "desc": "Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-pass-the-hash-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-pass-the-hash-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows event logs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-pass-the-ticket-attacks", "name": "detecting-pass-the-ticket-attacks", "kind": "skill", "official": false, "desc": "Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-pass-the-ticket-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-pass-the-ticket-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows event logs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-port-scanning-with-fail2ban", "name": "detecting-port-scanning-with-fail2ban", "kind": "skill", "official": false, "desc": "Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-port-scanning-with-fail2ban", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-port-scanning-with-fail2ban"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "fail2ban", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-privilege-escalation-attempts", "name": "detecting-privilege-escalation-attempts", "kind": "skill", "official": false, "desc": "Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-privilege-escalation-attempts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-attempts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows/linux", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-privilege-escalation-in-kubernetes-pods", "name": "detecting-privilege-escalation-in-kubernetes-pods", "kind": "skill", "official": false, "desc": "Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not ", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-in-kubernetes-pods"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "kubernetes", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-process-hollowing-technique", "name": "detecting-process-hollowing-technique", "kind": "skill", "official": false, "desc": "Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, explorer.exe, rundll32.exe) suspected of hosting injected code via NtUnmapViewOfSection.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-process-hollowing-technique", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-process-hollowing-technique"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "edr", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-process-injection-techniques", "name": "detecting-process-injection-techniques", "kind": "skill", "official": false, "desc": "Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-process-injection-techniques", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-process-injection-techniques"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-qr-code-phishing-with-email-security", "name": "detecting-qr-code-phishing-with-email-security", "kind": "skill", "official": false, "desc": "Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR/QR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use when configuring gateway rules against QR phishing or investigating suspicious emails containing QR codes.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-qr-code-phishing-with-email-security", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-qr-code-phishing-with-email-security"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-ransomware-encryption-behavior", "name": "detecting-ransomware-encryption-behavior", "kind": "skill", "official": false, "desc": "Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-ransomware-encryption-behavior", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-ransomware-precursors-in-network", "name": "detecting-ransomware-precursors-in-network", "kind": "skill", "official": false, "desc": "Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involv", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-ransomware-precursors-in-network", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-ransomware-precursors-in-network"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-rdp-brute-force-attacks", "name": "detecting-rdp-brute-force-attacks", "kind": "skill", "official": false, "desc": "Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-rdp-brute-force-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rdp-brute-force-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-rootkit-activity", "name": "detecting-rootkit-activity", "kind": "skill", "official": false, "desc": "Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility memory forensics, cross-view detection, and tools like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools (Task Manager, netstat, AV/EDR) show nothing abnormal but compromise is suspected. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-rootkit-activity", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rootkit-activity"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-s3-data-exfiltration-attempts", "name": "detecting-s3-data-exfiltration-attempts", "kind": "skill", "official": false, "desc": "Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-s3-data-exfiltration-attempts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-s3-data-exfiltration-attempts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-secure-boot-bypass", "name": "detecting-secure-boot-bypass", "kind": "skill", "official": false, "desc": "Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-secure-boot-bypass", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-secure-boot-bypass"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-serverless-function-injection", "name": "detecting-serverless-function-injection", "kind": "skill", "official": false, "desc": "Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API G", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-serverless-function-injection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-serverless-function-injection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-service-account-abuse", "name": "detecting-service-account-abuse", "kind": "skill", "official": false, "desc": "Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, Velociraptor) and Sigma detection rules. Use when hunting for service-account misuse or investigating a service account performing unexpected interactive logons.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-service-account-abuse", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-service-account-abuse"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-shadow-api-endpoints", "name": "detecting-shadow-api-endpoints", "kind": "skill", "official": false, "desc": "Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code repository mining for undocumented routes. Use when assessing API attack surface, auditing for forgotten test environments or deprecated API versions still running, or building an API registration governance policy.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-shadow-api-endpoints", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-shadow-api-endpoints"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-shadow-it-cloud-usage", "name": "detecting-shadow-it-cloud-usage", "kind": "skill", "official": false, "desc": "Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report with remediation recommendations.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-shadow-it-cloud-usage", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-shadow-it-cloud-usage"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-spearphishing-with-email-gateway", "name": "detecting-spearphishing-with-email-gateway", "kind": "skill", "official": false, "desc": "Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-spearphishing-with-email-gateway", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-spearphishing-with-email-gateway"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-sql-injection-via-waf-logs", "name": "detecting-sql-injection-via-waf-logs", "kind": "skill", "official": false, "desc": "Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-sql-injection-via-waf-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-sql-injection-via-waf-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-stuxnet-style-attacks", "name": "detecting-stuxnet-style-attacks", "kind": "skill", "official": false, "desc": "Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection. Use when hunting for IT-to-OT lateral movement or discrepancies between PLC program state and physical process behavior in ICS/SCADA environments. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-stuxnet-style-attacks", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-stuxnet-style-attacks"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-supply-chain-attacks-in-ci-cd", "name": "detecting-supply-chain-attacks-in-ci-cd", "kind": "skill", "official": false, "desc": "Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-supply-chain-attacks-in-ci-cd", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-supply-chain-attacks-in-ci-cd"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-suspicious-oauth-application-consent", "name": "detecting-suspicious-oauth-application-consent", "kind": "skill", "official": false, "desc": "Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-suspicious-oauth-application-consent", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-oauth-application-consent"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "microsoft entra id", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-suspicious-powershell-execution", "name": "detecting-suspicious-powershell-execution", "kind": "skill", "official": false, "desc": "Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-suspicious-powershell-execution", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-powershell-execution"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-t1003-credential-dumping-with-edr", "name": "detecting-t1003-credential-dumping-with-edr", "kind": "skill", "official": false, "desc": "Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-t1003-credential-dumping-with-edr", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-t1055-process-injection-with-sysmon", "name": "detecting-t1055-process-injection-with-sysmon", "kind": "skill", "official": false, "desc": "Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads. Use when hunting defense-evasion activity that hides code inside legitimate processes, investigating an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection detection.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-t1055-process-injection-with-sysmon", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1055-process-injection-with-sysmon"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-t1548-abuse-elevation-control-mechanism", "name": "detecting-t1548-abuse-elevation-control-mechanism", "kind": "skill", "official": false, "desc": "Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry changes, integrity-level transitions, and parent-child process relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation activity or validating elevation-abuse detection coverage.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1548-abuse-elevation-control-mechanism"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-typosquatting-packages", "name": "detecting-typosquatting-packages", "kind": "skill", "official": false, "desc": "Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated (\"slopsquatting\") dependency list, or when auditing a lockfile diff for a swapped package.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-typosquatting-packages", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-typosquatting-packages"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-typosquatting-packages-in-npm-pypi", "name": "detecting-typosquatting-packages-in-npm-pypi", "kind": "skill", "official": false, "desc": "Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated compariso", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-typosquatting-packages-in-npm-pypi", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-typosquatting-packages-in-npm-pypi"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/detecting-wmi-persistence", "name": "detecting-wmi-persistence", "kind": "skill", "official": false, "desc": "Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/detecting-wmi-persistence", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-wmi-persistence"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/emulating-cloud-attacks-with-stratus-red-team", "name": "emulating-cloud-attacks-with-stratus-red-team", "kind": "skill", "official": false, "desc": "Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle, then verify the telemetry they generate. Use to validate that cloud detections (CloudTrail, GuardDuty, Microsoft Sentinel, GCP SCC, Falco) actually fire, or to run a repeatable purple-team exercise generating realistic attacker telemetry.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/emulating-cloud-attacks-with-stratus-red-team", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill emulating-cloud-attacks-with-stratus-red-team"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/eradicating-malware-from-infected-systems", "name": "eradicating-malware-from-infected-systems", "kind": "skill", "official": false, "desc": "Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/eradicating-malware-from-infected-systems", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill eradicating-malware-from-infected-systems"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/executing-active-directory-attack-simulation", "name": "executing-active-directory-attack-simulation", "kind": "skill", "official": false, "desc": "Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation,", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/executing-active-directory-attack-simulation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill executing-active-directory-attack-simulation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:davila7/claude-code-templates/.claude-plugin/skills/owasp-security", "name": "owasp-security", "kind": "skill", "official": false, "desc": "Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like \"is this login flow secure?\", \"review this endpoint\", or ", "repo": "https://github.com/davila7/claude-code-templates/tree/HEAD/.claude-plugin/skills/owasp-security", "install": ["npx skills add davila7/claude-code-templates --skill owasp-security"], "stars": 33495, "pushed": "2026-11-14T03:16:32Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/ai-security", "name": "ai-security", "kind": "skill", "official": false, "desc": "Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITRE ATLAS and scores robustness with ai_threat_scanner.py.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/ai-security", "install": ["npx skills add alirezarezvani/claude-skills --skill ai-security"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "ai/ml systems", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/c-level-advisor/skills/ciso-advisor", "name": "ciso-advisor", "kind": "skill", "official": false, "desc": "Use for security leadership decisions: a security program, budget justification in dollars, SOC 2 vs ISO 27001 vs HIPAA roadmap, or board security reporting. Quantifies risk with risk_quantifier.py and tracks compliance with compliance_tracker.py.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/c-level-advisor/skills/ciso-advisor", "install": ["npx skills add alirezarezvani/claude-skills --skill ciso-advisor"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/cloud-security", "name": "cloud-security", "kind": "skill", "official": false, "desc": "Use when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs cloud_posture_check.py and maps findings to MITRE ATT&CK.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/cloud-security", "install": ["npx skills add alirezarezvani/claude-skills --skill cloud-security"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering/security-guidance/skills/security-guidance", "name": "security-guidance", "kind": "skill", "official": false, "desc": "Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserialization, eval or GitHub Actions injection. Warns once per file and rule; ENABLE_SECURITY_REMINDER=0 turns it off.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering/security-guidance/skills/security-guidance", "install": ["npx skills add alirezarezvani/claude-skills --skill security-guidance"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/security-pen-testing", "name": "security-pen-testing", "kind": "skill", "official": false, "desc": "Authorized penetration testing of an app or API: vulnerability scans, OWASP Top 10 checks, dependency audits and a pentest report. Use whenever the user asks if their app is secure or hackable, wants a security scan or a pentest report.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/security-pen-testing", "install": ["npx skills add alirezarezvani/claude-skills --skill security-pen-testing"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/senior-secops", "name": "senior-secops", "kind": "skill", "official": false, "desc": "Find and fix application security problems: security reviews, CVE remediation, hardening, secrets and auth, SOC 2, PCI-DSS, HIPAA and GDPR checks. Use whenever the user asks if their app is secure, needs to patch a vulnerable dependency or prepares for an audit.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/senior-secops", "install": ["npx skills add alirezarezvani/claude-skills --skill senior-secops"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/senior-security", "name": "senior-security", "kind": "skill", "official": false, "desc": "Check if a design or code is secure: STRIDE threat model, DREAD risk scores, leaked secret scan. Use whenever the user asks what could be attacked, how risky a feature is, or to find exposed keys.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/senior-security", "install": ["npx skills add alirezarezvani/claude-skills --skill senior-security"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:openai/skills/skills/.curated/security-best-practices", "name": "security-best-practices", "kind": "skill", "official": false, "desc": "Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.", "repo": "https://github.com/openai/skills/tree/HEAD/skills/.curated/security-best-practices", "install": ["npx skills add openai/skills --skill security-best-practices"], "stars": 28730, "pushed": "2026-10-28T17:31:41Z", "license": null, "plat": "code", "live": "Not checked (runs locally)"}, {"id": "skill:openai/skills/skills/.curated/security-ownership-map", "name": "security-ownership-map", "kind": "skill", "official": false, "desc": "Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or n", "repo": "https://github.com/openai/skills/tree/HEAD/skills/.curated/security-ownership-map", "install": ["npx skills add openai/skills --skill security-ownership-map"], "stars": 28730, "pushed": "2026-10-28T17:31:41Z", "license": null, "plat": "git", "live": "Not checked (runs locally)"}, {"id": "skill:nocobase/nocobase/packages/plugins/app-plugin-authorization/skills/nocobase-app-plugin-authorization", "name": "nocobase-app-plugin-authorization", "kind": "skill", "official": false, "desc": "Design and implement NocoBase 3 business permissions: job responsibilities, pages, business actions, fields, record scopes, relations, team inheritance, permission assignments, administration and inspection. Use when building a system or feature whose users have different access.", "repo": "https://github.com/nocobase/nocobase/tree/HEAD/packages/plugins/app-plugin-authorization/skills/nocobase-app-plugin-authorization", "install": ["npx skills add nocobase/nocobase --skill nocobase-app-plugin-authorization"], "stars": 24921, "pushed": "2026-11-14T05:16:46Z", "license": "NOASSERTION", "plat": "nocobase", "live": "Not checked (runs locally)"}, {"id": "skill:nocobase/nocobase/packages/plugins/app-plugin-authz-default-access/skills/nocobase-app-plugin-authz-default-access", "name": "nocobase-app-plugin-authz-default-access", "kind": "skill", "official": false, "desc": "Design, implement and verify default access for NocoBase 3 business operations, including named data scopes and production administration.", "repo": "https://github.com/nocobase/nocobase/tree/HEAD/packages/plugins/app-plugin-authz-default-access/skills/nocobase-app-plugin-authz-default-access", "install": ["npx skills add nocobase/nocobase --skill nocobase-app-plugin-authz-default-access"], "stars": 24921, "pushed": "2026-11-14T05:16:46Z", "license": "NOASSERTION", "plat": "nocobase", "live": "Not checked (runs locally)"}, {"id": "skill:nocobase/nocobase/packages/plugins/app-plugin-authz-restriction-rules/skills/nocobase-app-plugin-authz-restriction-rules", "name": "nocobase-app-plugin-authz-restriction-rules", "kind": "skill", "official": false, "desc": "Design, implement and verify restriction rules for NocoBase 3 business operations, including named data scopes and production administration.", "repo": "https://github.com/nocobase/nocobase/tree/HEAD/packages/plugins/app-plugin-authz-restriction-rules/skills/nocobase-app-plugin-authz-restriction-rules", "install": ["npx skills add nocobase/nocobase --skill nocobase-app-plugin-authz-restriction-rules"], "stars": 24921, "pushed": "2026-11-14T05:16:46Z", "license": "NOASSERTION", "plat": "nocobase", "live": "Not checked (runs locally)"}, {"id": "skill:nocobase/nocobase/packages/plugins/app-plugin-authz-sharing-rules/skills/nocobase-app-plugin-authz-sharing-rules", "name": "nocobase-app-plugin-authz-sharing-rules", "kind": "skill", "official": false, "desc": "Design, implement and verify sharing rules for NocoBase 3 business operations, including named data scopes and production administration.", "repo": "https://github.com/nocobase/nocobase/tree/HEAD/packages/plugins/app-plugin-authz-sharing-rules/skills/nocobase-app-plugin-authz-sharing-rules", "install": ["npx skills add nocobase/nocobase --skill nocobase-app-plugin-authz-sharing-rules"], "stars": 24921, "pushed": "2026-11-14T05:16:46Z", "license": "NOASSERTION", "plat": "nocobase", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/assuredworkloads-environment-assessor", "name": "assuredworkloads-environment-assessor", "kind": "skill", "official": false, "desc": "Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against sovereign data boundary and compliance standards (EU Data Boundary with Support, FedRAMP Moderate/High, DoD IL4/IL5, ITAR, CJIS, US/EU Regional Data Boundaries), and recommend the optimal Assured Workloads Framework. Use when asked to: \"assess my environment for compliance\", \"which Assured Workloads framework should I use?\", \"check if my folder is ready for EU sovereignty\", \"evaluate compli", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/assuredworkloads-environment-assessor", "install": ["npx skills add google/skills --skill assuredworkloads-environment-assessor"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/assuredworkloads-frameworks-navigator", "name": "assuredworkloads-frameworks-navigator", "kind": "skill", "official": false, "desc": "Acts as a Data Boundary Compliance Analyst that maps user compliance queries against Data Boundary Frameworks and cloud controls, validates matched resources, and recommends appropriate Frameworks or cloud controls. Use when mapping direct natural language workload requirements to Assured Workloads / Data Boundary Frameworks and cloud controls, browsing built-in Data Boundary frameworks, or identifying major requirement gaps. Don't use for non-Data-Boundary Compliance Manager posture assessments", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/assuredworkloads-frameworks-navigator", "install": ["npx skills add google/skills --skill assuredworkloads-frameworks-navigator"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/cloud-armor-crs-rule-upgrader", "name": "cloud-armor-crs-rule-upgrader", "kind": "skill", "official": false, "desc": "Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to native evaluatePreconfiguredWaf dictionary parameters, remaps signature IDs to v042200, drops retired signature IDs, and updates structured preconfiguredWafConfig fine-tuning exclusions. Evaluates operational risk (High Breaking Change, Medium Attention Required, Low Clean Upgrade) including Method Enforcement breaking c", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/cloud-armor-crs-rule-upgrader", "install": ["npx skills add google/skills --skill cloud-armor-crs-rule-upgrader"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "cloud armor", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/gke-platform-security", "name": "gke-platform-security", "kind": "skill", "official": false, "desc": "Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enab", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/gke-platform-security", "install": ["npx skills add google/skills --skill gke-platform-security"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google kubernetes engine (gke)", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/gke-workload-security", "name": "gke-workload-security", "kind": "skill", "official": false, "desc": "Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling) and pod securityContext, and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing workload security posture", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/gke-workload-security", "install": ["npx skills add google/skills --skill gke-workload-security"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google kubernetes engine (gke)", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/google-cloud-filestore-auditing", "name": "google-cloud-filestore-auditing", "kind": "skill", "official": false, "desc": "Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (overly permissive NFS export rules, 0.0.0.0/0 exposure, missing ROOT_SQUASH), and reliability compliance (Physical Zone Isolation PZI and Physical Zone Separation PZS). Use when assessing storage health posture, auditing NFS export permissions, identifying unprotected file shares, or validating zone failure domains. Don't use for Cloud Storage buckets", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-filestore-auditing", "install": ["npx skills add google/skills --skill google-cloud-filestore-auditing"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud filestore", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/google-cloud-scc-query", "name": "google-cloud-scc-query", "kind": "skill", "official": false, "desc": "Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google Cloud. Use when retrieving details for a security finding by its name, validating finding scope (e.g., verifying findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or THREAT), or fetching finding details for triage. Don't use to draft remediations, apply patches, or execute configurations.", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-scc-query", "install": ["npx skills add google/skills --skill google-cloud-scc-query"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/google-cloud-scc-remediation", "name": "google-cloud-scc-remediation", "kind": "skill", "official": false, "desc": "Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic Combinations. Use when asked to fix, remediate, or mitigate a Security Command Center finding or address attack paths. Don't use for general IAM policy querying without a Security Command Center finding. For runtime threat detections, this skill provides containment and investigation guidance rather than automated configuration fixes.", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-scc-remediation", "install": ["npx skills add google/skills --skill google-cloud-scc-remediation"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/google-cloud-solution-multi-agent-security", "name": "google-cloud-solution-multi-agent-security", "kind": "skill", "official": false, "desc": "Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGENT), or egress (AGENT_TO_ANYWHERE) patterns involving Model Armor, IAP, and Agent Registry. Don't use for general Cloud Load Balancing or basic VPC setup not related to Agent Gateways.", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-solution-multi-agent-security", "install": ["npx skills add google/skills --skill google-cloud-solution-multi-agent-security"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/google-cloud-waf-security", "name": "google-cloud-waf-security", "kind": "skill", "official": false, "desc": "Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and perimeter security, data security and encryption, security logging and threat detection, software supply chain hardening, AI security, data privacy, regulatory compliance, and cloud sovereignty. The recommendations are aligned with the Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework (WAF). Use when the user as", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-waf-security", "install": ["npx skills add google/skills --skill google-cloud-waf-security"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:eigent-ai/eigent/resources/example-skills/skill-security-auditor", "name": "skill-security-auditor", "kind": "skill", "official": false, "desc": "Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on \\\"security audit\\\", \\\"vulnerability scan\\\", \\\"code review for security\\\", \\\"find secrets\\\", \\\"check for vulnerabilit", "repo": "https://github.com/eigent-ai/eigent/tree/HEAD/resources/example-skills/skill-security-auditor", "install": ["npx skills add eigent-ai/eigent --skill skill-security-auditor"], "stars": 15816, "pushed": "2026-11-13T19:27:12Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Jeffallan/claude-skills/skills/secure-code-guardian", "name": "secure-code-guardian", "kind": "skill", "official": false, "desc": "Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-", "repo": "https://github.com/Jeffallan/claude-skills/tree/HEAD/skills/secure-code-guardian", "install": ["npx skills add Jeffallan/claude-skills --skill secure-code-guardian"], "stars": 12355, "pushed": "2026-11-11T08:34:48Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Jeffallan/claude-skills/skills/security-reviewer", "name": "security-reviewer", "kind": "skill", "official": false, "desc": "Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.", "repo": "https://github.com/Jeffallan/claude-skills/tree/HEAD/skills/security-reviewer", "install": ["npx skills add Jeffallan/claude-skills --skill security-reviewer"], "stars": 12355, "pushed": "2026-11-11T08:34:48Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:android/skills/security/android-intent-security", "name": "android-intent-security", "kind": "skill", "official": false, "desc": "Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in AndroidManifest.xml (activities, services, receivers) or source code handling incoming Intents (getIntent, getParcelableExtra) to prevent Intent Redirection and unauthorized access. Don't use for network security, TLS configuration, or general runtime permission request flows.", "repo": "https://github.com/android/skills/tree/HEAD/security/android-intent-security", "install": ["npx skills add android/skills --skill android-intent-security"], "stars": 10503, "pushed": "2026-11-11T06:04:32Z", "license": "Apache-2.0", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:android/skills/security/android-permissions-security", "name": "android-permissions-security", "kind": "skill", "official": false, "desc": "Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining custom permissions, securing Services, Receivers, and Providers, verifying caller signatures and UID using Binder, or implementing runtime permission flows.", "repo": "https://github.com/android/skills/tree/HEAD/security/android-permissions-security", "install": ["npx skills add android/skills --skill android-permissions-security"], "stars": 10503, "pushed": "2026-11-11T06:04:32Z", "license": "Apache-2.0", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:android/skills/play/play-policy-insights", "name": "play-policy-insights", "kind": "skill", "official": false, "desc": "Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store declarations to generate deterministic compliance reports, identifying undeclared data collection, architectural risks, and missing disclosures across Permissions and APIs Hygiene, User Account and Identity, and Data Safety and Privacy domains.", "repo": "https://github.com/android/skills/tree/HEAD/play/play-policy-insights", "install": ["npx skills add android/skills --skill play-policy-insights"], "stars": 10503, "pushed": "2026-11-11T06:04:32Z", "license": "Apache-2.0", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:anbeime/skill/skills/antinet-security-scan", "name": "antinet-security-scan", "kind": "skill", "official": false, "desc": "信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject 判定与详细合规扫描报告，一键守住零信任安全底线。", "repo": "https://github.com/anbeime/skill/tree/HEAD/skills/antinet-security-scan", "install": ["npx skills add anbeime/skill --skill antinet-security-scan"], "stars": 9543, "pushed": "2026-11-14T02:12:26Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:anbeime/skill/antinet-agentteams/skills/security-scan", "name": "security-scan", "kind": "skill", "official": false, "desc": "对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。", "repo": "https://github.com/anbeime/skill/tree/HEAD/antinet-agentteams/skills/security-scan", "install": ["npx skills add anbeime/skill --skill security-scan"], "stars": 9543, "pushed": "2026-11-14T02:12:26Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:AIPentest/CyberStrikeAI", "name": "CyberStrikeAI", "kind": "mcp", "official": null, "desc": "The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.", "repo": "https://github.com/AIPentest/CyberStrikeAI", "install": [], "stars": 8642, "pushed": null, "license": null, "plat": "cyberstrikeai", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/audit-augmentation", "name": "audit-augmentation", "kind": "skill", "official": false, "desc": "Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referenci", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/audit-augmentation", "install": ["npx skills add trailofbits/skills --skill audit-augmentation"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/crypto-protocol-diagram", "name": "crypto-protocol-diagram", "kind": "skill", "official": false, "desc": "Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow, extracting message flow from a spec or RFC, diagramming a ProVerif or Tamarin model, or drawing sequence diagrams for TLS, Noise, Signal, X3DH, Double Ratchet, FROST, DH, or ECDH protocols.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/crypto-protocol-diagram", "install": ["npx skills add trailofbits/skills --skill crypto-protocol-diagram"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "mermaid", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/cvss-scoring/skills/cvss-scoring", "name": "cvss-scoring", "kind": "skill", "official": false, "desc": "Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector, or estimating severity.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/cvss-scoring/skills/cvss-scoring", "install": ["npx skills add trailofbits/skills --skill cvss-scoring"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/dwarf-expert/skills/dwarf-expert", "name": "dwarf-expert", "kind": "skill", "official": false, "desc": "Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/dwarf-expert/skills/dwarf-expert", "install": ["npx skills add trailofbits/skills --skill dwarf-expert"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/firebase-apk-scanner/skills/firebase-apk-scanner", "name": "firebase-apk-scanner", "kind": "skill", "official": false, "desc": "Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/firebase-apk-scanner/skills/firebase-apk-scanner", "install": ["npx skills add trailofbits/skills --skill firebase-apk-scanner"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "firebase", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/fp-check/skills/fp-check", "name": "fp-check", "kind": "skill", "official": false, "desc": "Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/fp-check/skills/fp-check", "install": ["npx skills add trailofbits/skills --skill fp-check"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/genotoxic", "name": "genotoxic", "kind": "skill", "official": false, "desc": "Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/genotoxic", "install": ["npx skills add trailofbits/skills --skill genotoxic"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/graph-evolution", "name": "graph-evolution", "kind": "skill", "official": false, "desc": "Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/graph-evolution", "install": ["npx skills add trailofbits/skills --skill graph-evolution"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/mermaid-to-proverif", "name": "mermaid-to-proverif", "kind": "skill", "official": false, "desc": "Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol security properties (secrecy, authentication, forward secrecy), checking for replay attacks, or producing a .pv file from a sequence diagram.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/mermaid-to-proverif", "install": ["npx skills add trailofbits/skills --skill mermaid-to-proverif"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "mermaid", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/slicing-code-context", "name": "slicing-code-context", "kind": "skill", "official": false, "desc": "Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to constrained or locally hosted models without exposing the full repository.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/slicing-code-context", "install": ["npx skills add trailofbits/skills --skill slicing-code-context"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/taint-trace", "name": "taint-trace", "kind": "skill", "official": false, "desc": "Improves taint-analysis coverage and precision by using Trailmark graphs to repair native source, sink, sanitizer, propagation, and type models, then runs an existing taint analyzer. Use when analysis misses flows, cannot resolve framework bindings, or produces false positives from imprecise models.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/taint-trace", "install": ["npx skills add trailofbits/skills --skill taint-trace"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark", "name": "trailmark", "kind": "skill", "official": false, "desc": "Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumeratin", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark", "install": ["npx skills add trailofbits/skills --skill trailmark"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark-finding-triage", "name": "trailmark-finding-triage", "kind": "skill", "official": false, "desc": "Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-finding-triage", "install": ["npx skills add trailofbits/skills --skill trailmark-finding-triage"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark-review-gate", "name": "trailmark-review-gate", "kind": "skill", "official": false, "desc": "Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-review-gate", "install": ["npx skills add trailofbits/skills --skill trailmark-review-gate"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark-structural", "name": "trailmark-structural", "kind": "skill", "official": false, "desc": "Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-structural", "install": ["npx skills add trailofbits/skills --skill trailmark-structural"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark-summary", "name": "trailmark-summary", "kind": "skill", "official": false, "desc": "Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-summary", "install": ["npx skills add trailofbits/skills --skill trailmark-summary"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/trailmark-variant-neighborhood", "name": "trailmark-variant-neighborhood", "kind": "skill", "official": false, "desc": "Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-variant-neighborhood", "install": ["npx skills add trailofbits/skills --skill trailmark-variant-neighborhood"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/variant-analysis/skills/variant-analysis", "name": "variant-analysis", "kind": "skill", "official": false, "desc": "Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form (\"are there others like this?\", \"is this the same bug?\"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against ", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/variant-analysis/skills/variant-analysis", "install": ["npx skills add trailofbits/skills --skill variant-analysis"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/trailmark/skills/vector-forge", "name": "vector-forge", "kind": "skill", "official": false, "desc": "Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/after mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving t", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/vector-forge", "install": ["npx skills add trailofbits/skills --skill vector-forge"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards", "name": "vulnerability-triage-brocards", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"triage a vulnerability report\", \"assess a CVE\", \"evaluate a bug bounty submission\", \"decide if a finding is valid\", \"review a security finding\", \"dismiss a vulnerability\", \"should we fix this CVE\", \"prioritize a vulnerability report\", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or n", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/vulnerability-triage-brocards/skills/vulnerability-triage-brocards", "install": ["npx skills add trailofbits/skills --skill vulnerability-triage-brocards"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "trailmark", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof", "name": "wycheproof", "kind": "skill", "official": false, "desc": "Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/wycheproof", "install": ["npx skills add trailofbits/skills --skill wycheproof"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "project wycheproof", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/yara-authoring/skills/yara-rule-authoring", "name": "yara-rule-authoring", "kind": "skill", "official": false, "desc": "Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/yara-authoring/skills/yara-rule-authoring", "install": ["npx skills add trailofbits/skills --skill yara-rule-authoring"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "yara-x", "live": "Not checked (runs locally)"}, {"id": "skill:trailofbits/skills/plugins/zeroize-audit/skills/zeroize-audit", "name": "zeroize-audit", "kind": "skill", "official": false, "desc": "Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.", "repo": "https://github.com/trailofbits/skills/tree/HEAD/plugins/zeroize-audit/skills/zeroize-audit", "install": ["npx skills add trailofbits/skills --skill zeroize-audit"], "stars": 8179, "pushed": "2026-11-12T17:48:51Z", "license": "CC-BY-SA-4.0", "plat": "c/c++/rust", "live": "Not checked (runs locally)"}, {"id": "skill:tw93/Waza/plugins/waza/skills/health", "name": "health", "kind": "skill", "official": false, "desc": "Audits or prunes agent config, instruction drift, hooks or MCP, and AI maintainability. Use when Claude, Codex, or Pi setup looks wrong or guidance needs slimming. Not for application bugs or PR review.", "repo": "https://github.com/tw93/Waza/tree/HEAD/plugins/waza/skills/health", "install": ["npx skills add tw93/Waza --skill health"], "stars": 7585, "pushed": "2026-11-11T07:02:04Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:agency.ottobot/contractor-license-changes", "name": "Contractor Licence Changes", "kind": "mcp", "official": null, "desc": "Did this contractor's licence change? Observed lapses and reinstatements, not a snapshot.", "repo": "https://github.com/modelcontextprotocol/registry", "install": ["https://license-changes-mcp.ottobot2025.workers.dev/mcp"], "stars": 7467, "pushed": "2026-11-13T00:09:10Z", "license": "NOASSERTION", "plat": "", "live": "Live · 812 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:agency.ottobot/licensed-house-painters", "name": "Licensed House Painters", "kind": "mcp", "official": null, "desc": "Find licensed house painters in 11 US states, with dated license status from state boards.", "repo": "https://github.com/modelcontextprotocol/registry", "install": ["https://house-painters.ottobot.agency/mcp"], "stars": 7467, "pushed": "2026-11-13T00:09:10Z", "license": "NOASSERTION", "plat": "", "live": "Live · 921 ms · 3 tools (checked 2026-11-13)"}, {"id": "skill:wiltodelta/remove-ai-watermarks/.claude/skills/provider-oracles", "name": "provider-oracles", "kind": "skill", "official": false, "desc": "Run hash-bound Google, OpenAI, Microsoft, or Meta watermark-oracle checks for this repository. Use for provider verification, multi-account Gemini checks, SynthID Detector checks at synthid.com, isolated Playwright checks, or recording oracle evidence. Walk the existing plan automatically when a task needs a provider verdict.", "repo": "https://github.com/wiltodelta/remove-ai-watermarks/tree/HEAD/.claude/skills/provider-oracles", "install": ["npx skills add wiltodelta/remove-ai-watermarks --skill provider-oracles"], "stars": 6366, "pushed": "2026-11-13T05:44:58Z", "license": "Apache-2.0", "plat": "synthid", "live": "Not checked (runs locally)"}, {"id": "skill:wiltodelta/remove-ai-watermarks/skills/remove-ai-watermarks", "name": "remove-ai-watermarks", "kind": "skill", "official": false, "desc": "Removes and identifies AI watermarks and provenance marks in images, video, and text the user generated or edited. Covers Gemini sparkles, SynthID, Microsoft InvisMark, Meta Content Seal, C2PA, EXIF/XMP/IPTC metadata, and Sora/Veo/Seedance/Doubao/Dola/Hailuo/Vidu/Kling and Wan labels. Use when the user wants to strip or clean AI watermarks and generation labels, or asks whether a file was AI-generated or carries AI provenance, even if they do not name remove-ai-watermarks. Do not use for stock-a", "repo": "https://github.com/wiltodelta/remove-ai-watermarks/tree/HEAD/skills/remove-ai-watermarks", "install": ["npx skills add wiltodelta/remove-ai-watermarks --skill remove-ai-watermarks"], "stars": 6366, "pushed": "2026-11-13T05:44:58Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wiltodelta/remove-ai-watermarks/.claude/skills/signal-discovery", "name": "signal-discovery", "kind": "skill", "official": false, "desc": "Discover missing AI provenance and watermark coverage in the remove-ai-watermarks library from fresh or historical corpora, then validate detection and removal parity. Use for corpus gap mining, periodic signal audits, new-provider discovery, or deciding whether old retained data must be replayed. Do not use for ordinary per-file identification or removal.", "repo": "https://github.com/wiltodelta/remove-ai-watermarks/tree/HEAD/.claude/skills/signal-discovery", "install": ["npx skills add wiltodelta/remove-ai-watermarks --skill signal-discovery"], "stars": 6366, "pushed": "2026-11-13T05:44:58Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-api-misconfig", "name": "hunt-api-misconfig", "kind": "skill", "official": false, "desc": "Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, X", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-api-misconfig", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-api-misconfig"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-aspnet", "name": "hunt-aspnet", "kind": "skill", "official": false, "desc": "Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-aspnet", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-aspnet"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-ato", "name": "hunt-ato", "kind": "skill", "official": false, "desc": "Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) soci", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-ato", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-ato"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-auth-bypass", "name": "hunt-auth-bypass", "kind": "skill", "official": false, "desc": "Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-a", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-auth-bypass", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-auth-bypass"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-brute-force", "name": "hunt-brute-force", "kind": "skill", "official": false, "desc": "Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent s", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-brute-force", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-brute-force"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-business-logic", "name": "hunt-business-logic", "kind": "skill", "official": false, "desc": "Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstra", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-business-logic", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-business-logic"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-cache-poison", "name": "hunt-cache-poison", "kind": "skill", "official": false, "desc": "Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-cache-poison", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-cache-poison"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-captcha-bypass", "name": "hunt-captcha-bypass", "kind": "skill", "official": false, "desc": "Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-captcha-bypass", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-captcha-bypass"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-cicd", "name": "hunt-cicd", "kind": "skill", "official": false, "desc": "Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reacha", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-cicd", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-cicd"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-clickjacking", "name": "hunt-clickjacking", "kind": "skill", "official": false, "desc": "Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is ", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-clickjacking", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-clickjacking"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-cloud-misconfig", "name": "hunt-cloud-misconfig", "kind": "skill", "official": false, "desc": "Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-cloud-misconfig", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-cloud-misconfig"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-cors", "name": "hunt-cors", "kind": "skill", "official": false, "desc": "Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-cors", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-cors"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-csrf", "name": "hunt-csrf", "kind": "skill", "official": false, "desc": "Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-csrf", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-csrf"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-deserialization", "name": "hunt-deserialization", "kind": "skill", "official": false, "desc": "Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-deserialization", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-deserialization"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-dispatch", "name": "hunt-dispatch", "kind": "skill", "official": false, "desc": "Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-dispatch", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-dispatch"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-dom", "name": "hunt-dom", "kind": "skill", "official": false, "desc": "Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPr", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-dom", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-dom"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-exceptional-conditions", "name": "hunt-exceptional-conditions", "kind": "skill", "official": false, "desc": "Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions, or a language traceback. Use on any input-accepting endpoint (JSON APIs, forms, query params). Medium-High when the leak exposes internal structure that arms a deeper attack.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-exceptional-conditions", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-exceptional-conditions"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-file-upload", "name": "hunt-file-upload", "kind": "skill", "official": false, "desc": "Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php\\0.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-pi", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-file-upload", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-file-upload"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-fintech-graphql", "name": "hunt-fintech-graphql", "kind": "skill", "official": false, "desc": "Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio query IDOR, decimal-precision and rounding abuse, idempotency-key bypass enabling double-spend, KYC/PII field-level authorization gaps, and admin-override mutations reachable via mass assignment. Distinct from hunt-graphql, which owns generic GraphQL discovery and IDOR/mutation methodology — this skill owns the delta introduced when a GraphQL layer", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-fintech-graphql", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-fintech-graphql"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-forgot-password", "name": "hunt-forgot-password", "kind": "skill", "official": false, "desc": "Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link works from a different IP/browser (no binding), (5) no rate limit on the reset request endpoint. These are the standalone recovery-flow broken-auth primitives — distinct from reset-email host-header poiso", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-forgot-password", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-forgot-password"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-graphql", "name": "hunt-graphql", "kind": "skill", "official": false, "desc": "Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, broken-object-level-authz, auth-bypass via unscoped mutations, and PII exposure from missing field-level authz. Use when hunting graphql on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-graphql", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-graphql"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-grpc", "name": "hunt-grpc", "kind": "skill", "official": false, "desc": "Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or wh", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-grpc", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-grpc"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-host-header", "name": "hunt-host-header", "kind": "skill", "official": false, "desc": "Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and t", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-host-header", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-host-header"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-html-injection", "name": "hunt-html-injection", "kind": "skill", "official": false, "desc": "Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-html-injection", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-http-smuggling", "name": "hunt-http-smuggling", "kind": "skill", "official": false, "desc": "Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: tim", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-http-smuggling", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-http-smuggling"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-sqli", "name": "hunt-sqli", "kind": "skill", "official": false, "desc": "Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/Couc", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-sqli", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-sqli"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-ssrf", "name": "hunt-ssrf", "kind": "skill", "official": false, "desc": "Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generat", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-ssrf", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-ssrf"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-ssti", "name": "hunt-ssti", "kind": "skill", "official": false, "desc": "Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval revea", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-ssti", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-ssti"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-subdomain", "name": "hunt-subdomain", "kind": "skill", "official": false, "desc": "Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emp", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-subdomain", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-subdomain"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-tls-network", "name": "hunt-tls-network", "kind": "skill", "official": false, "desc": "Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-tls-network", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-tls-network"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-websocket", "name": "hunt-websocket", "kind": "skill", "official": false, "desc": "Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-websocket", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-websocket"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-xss", "name": "hunt-xss", "kind": "skill", "official": false, "desc": "Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-xss", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-xss"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-xxe", "name": "hunt-xxe", "kind": "skill", "official": false, "desc": "Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-xxe", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-xxe"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/meme-coin-audit", "name": "meme-coin-audit", "kind": "skill", "official": false, "desc": "Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/meme-coin-audit", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill meme-coin-audit"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/security-arsenal", "name": "security-arsenal", "kind": "skill", "official": false, "desc": "Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/security-arsenal", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill security-arsenal"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/vmware-vcenter-attack", "name": "vmware-vcenter-attack", "kind": "skill", "official": false, "desc": "VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the in", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/vmware-vcenter-attack", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill vmware-vcenter-attack"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/web2-recon", "name": "web2-recon", "kind": "skill", "official": false, "desc": "Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/web2-recon", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill web2-recon"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/web3-audit", "name": "web3-audit", "kind": "skill", "official": false, "desc": "Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/web3-audit", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill web3-audit"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/audit-flow", "name": "audit-flow", "kind": "skill", "official": false, "desc": "Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/audit-flow", "install": ["npx skills add zebbern/claude-code-guide --skill audit-flow"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "audit-flow", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/authentication-patterns", "name": "authentication-patterns", "kind": "skill", "official": false, "desc": "Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/authentication-patterns", "install": ["npx skills add zebbern/claude-code-guide --skill authentication-patterns"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "authentication-patterns", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/broken-authentication", "name": "broken-authentication", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for broken authentication vulnerabilities\", \"assess session management security\", \"perform credential stuffing tests\", \"evaluate password policies\", \"test for session fixation\", or \"identify authentication bypass flaws\". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/broken-authentication", "install": ["npx skills add zebbern/claude-code-guide --skill broken-authentication"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "broken-authentication", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/code-vuln-audit", "name": "code-vuln-audit", "kind": "skill", "official": false, "desc": "Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/code-vuln-audit", "install": ["npx skills add zebbern/claude-code-guide --skill code-vuln-audit"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "npm, pip", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/scanning-tools", "name": "scanning-tools", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"perform vulnerability scanning\", \"scan networks for open ports\", \"assess web application security\", \"scan wireless networks\", \"detect malware\", \"check cloud security\", or \"evaluate system compliance\". It provides comprehensive guidance on security scanning tools and methodologies.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/scanning-tools", "install": ["npx skills add zebbern/claude-code-guide --skill scanning-tools"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/secure-code-review", "name": "secure-code-review", "kind": "skill", "official": false, "desc": "Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/secure-code-review", "install": ["npx skills add zebbern/claude-code-guide --skill secure-code-review"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/sql-injection-testing", "name": "sql-injection-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for SQL injection vulnerabilities\", \"perform SQLi attacks\", \"bypass authentication using SQL injection\", \"extract database information through injection\", \"detect SQL injection flaws\", or \"exploit database query vulnerabilities\". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/sql-injection-testing", "install": ["npx skills add zebbern/claude-code-guide --skill sql-injection-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/top-web-vulnerabilities", "name": "top-web-vulnerabilities", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"identify web application vulnerabilities\", \"explain common security flaws\", \"understand vulnerability categories\", \"learn about injection attacks\", \"review access control weaknesses\", \"analyze API security issues\", \"assess security misconfigurations\", \"understand client-side vulnerabilities\", \"examine mobile and IoT security flaws\", or \"reference the OWASP-aligned vulnerability taxonomy\". Use this skill to provide comprehensive vulnerability defin", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/top-web-vulnerabilities", "install": ["npx skills add zebbern/claude-code-guide --skill top-web-vulnerabilities"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/xss-html-injection", "name": "xss-html-injection", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection vulnerabilities\", \"steal cookies via XSS\", or \"bypass content security policies\". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/xss-html-injection", "install": ["npx skills add zebbern/claude-code-guide --skill xss-html-injection"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:michael-denyer/pstack-claude/plugins/pstack/skills/create-formal-verification-skill", "name": "create-formal-verification-skill", "kind": "skill", "official": false, "desc": "Generate a project-local skill that formally verifies the code where a bug costs the most and tests reach the least, in any language, with whichever verification tool fits. Use for /create-formal-verification-skill, \\\"model-check this race\\\", \\\"prove this invariant\\\", or when concurrency, retries, state machines, parsers, or unsafe code need more than tests.", "repo": "https://github.com/michael-denyer/pstack-claude/tree/HEAD/plugins/pstack/skills/create-formal-verification-skill", "install": ["npx skills add michael-denyer/pstack-claude --skill create-formal-verification-skill"], "stars": 4298, "pushed": "2026-11-13T15:53:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:parcadei/Continuous-Claude-v3/.claude/skills/security", "name": "security", "kind": "skill", "official": false, "desc": "Security audit workflow - vulnerability scan → verification", "repo": "https://github.com/parcadei/Continuous-Claude-v3/tree/HEAD/.claude/skills/security", "install": ["npx skills add parcadei/Continuous-Claude-v3 --skill security"], "stars": 3949, "pushed": "2026-01-26T15:27:49Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:foryourhealth111-pixel/Vibe-Skills/bundled/skills/security-reviewer", "name": "security-reviewer", "kind": "skill", "official": false, "desc": "Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.", "repo": "https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/HEAD/bundled/skills/security-reviewer", "install": ["npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer"], "stars": 3816, "pushed": "2026-11-09T07:33:42Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:davepoon/buildwithclaude/plugins/all-skills/skills/launch-check", "name": "launch-check", "kind": "skill", "official": false, "desc": "Passive pre-launch report card for a live URL of an app or site built with AI (Lovable, Bolt, Replit, Cursor, v0, Claude). Scores security (secret keys visible in the page JavaScript, Supabase service_role keys, open Supabase or Firebase tables with --owner-check, security headers, HTTPS, cookies), phone design at 375 px, Google and AI search, and speed, then writes a \"fix this first\" list. Use when the user asks \"is my app safe to launch\", \"did I leak my API key\", \"is my Supabase open\", or want", "repo": "https://github.com/davepoon/buildwithclaude/tree/HEAD/plugins/all-skills/skills/launch-check", "install": ["npx skills add davepoon/buildwithclaude --skill launch-check"], "stars": 3743, "pushed": "2026-11-13T07:12:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:davepoon/buildwithclaude/plugins/agent-triforce/skills/security-audit", "name": "security-audit", "kind": "skill", "official": false, "desc": "Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.", "repo": "https://github.com/davepoon/buildwithclaude/tree/HEAD/plugins/agent-triforce/skills/security-audit", "install": ["npx skills add davepoon/buildwithclaude --skill security-audit"], "stars": 3743, "pushed": "2026-11-13T07:12:33Z", "license": "MIT", "plat": "centinela", "live": "Not checked (runs locally)"}, {"id": "skill:davepoon/buildwithclaude/plugins/all-skills/skills/verify-watermark-removal", "name": "verify-watermark-removal", "kind": "skill", "official": false, "desc": "Verify that a watermark-removal or \"humanizer\" step actually removed a statistical text watermark, by measuring a sample whose key the user holds. Use after any tool, script or service claims to have cleaned a text, or when the user asks whether such a tool works, which one to trust, or how to test one. Reports a detector score against fixed thresholds plus what the run cost in meaning, facts, verbatim overlap and length. This skill only measures and never removes a mark.", "repo": "https://github.com/davepoon/buildwithclaude/tree/HEAD/plugins/all-skills/skills/verify-watermark-removal", "install": ["npx skills add davepoon/buildwithclaude --skill verify-watermark-removal"], "stars": 3743, "pushed": "2026-11-13T07:12:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:snyk/agent-scan", "name": "agent-scan", "kind": "mcp", "official": null, "desc": "Security scanner for AI agents, MCP servers and agent skills.", "repo": "https://github.com/snyk/agent-scan", "install": [], "stars": 3241, "pushed": null, "license": null, "plat": "agent-scan", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/skills/.github/plugins/azure-skills/skills/azure-compliance", "name": "azure-compliance", "kind": "skill", "official": false, "desc": "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.", "repo": "https://github.com/microsoft/skills/tree/HEAD/.github/plugins/azure-skills/skills/azure-compliance", "install": ["npx skills add microsoft/skills --skill azure-compliance"], "stars": 3203, "pushed": "2026-11-13T22:48:25Z", "license": "MIT", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/skills/.github/plugins/azure-sdk-dotnet/skills/microsoft-azure-webjobs-extensions-authentication-events-dotnet", "name": "microsoft-azure-webjobs-extensions-authentication-events-dotnet", "kind": "skill", "official": false, "desc": "Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers for custom authentication extensions. Use for token enrichment, custom claims, attribute collection, and OTP customization in Entra ID. Triggers: \"Authentication Events\", \"WebJobsAuthenticationEventsTrigger\", \"OnTokenIssuanceStart\", \"OnAttributeCollectionStart\", \"custom claims\", \"token enrichment\", \"Entra custom extension\", \"authentication extension\".", "repo": "https://github.com/microsoft/skills/tree/HEAD/.github/plugins/azure-sdk-dotnet/skills/microsoft-azure-webjobs-extensions-authentication-events-dotnet", "install": ["npx skills add microsoft/skills --skill microsoft-azure-webjobs-extensions-authentication-events-dotnet"], "stars": 3203, "pushed": "2026-11-13T22:48:25Z", "license": "MIT", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/exposure-risk-quantification", "name": "exposure-risk-quantification", "kind": "skill", "official": false, "desc": "FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/exposure-risk-quantification", "install": ["npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/identity-provider-recon", "name": "identity-provider-recon", "kind": "skill", "official": false, "desc": "Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provena", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/identity-provider-recon", "install": ["npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden", "name": "warden", "kind": "skill", "official": false, "desc": "Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security.", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-audit", "name": "warden-audit", "kind": "skill", "official": false, "desc": "Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for \"security audit\", \"check for vulnerabilities\", \"security review\", or \"are we secure\".", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-audit", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-audit"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-harden", "name": "warden-harden", "kind": "skill", "official": false, "desc": "Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to \"harden this\", \"add security to this service\", \"what security do I need\", or \"secure this before launch\".", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-harden", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-harden"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-iam", "name": "warden-iam", "kind": "skill", "official": false, "desc": "Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to \"set up IAM\", \"create roles\", \"service accounts\", or \"access control\".", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-iam", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-iam"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-recon", "name": "warden-recon", "kind": "skill", "official": false, "desc": "Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when asked about \"security posture\", \"how secure is this\", or \"security assessment\".", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-recon", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-recon"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-scan", "name": "warden-scan", "kind": "skill", "official": false, "desc": "Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured JSON report. Use when asked to \"scan for vulnerabilities\", \"run a security scan\", \"check for CVEs\", or \"audit dependencies\".", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-scan", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-scan"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jeremylongshore/tons-of-skills-marketplace/plugins/ai-agency/tonone/skills/warden-threat", "name": "warden-threat", "kind": "skill", "official": false, "desc": "Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to \"threat model this\", \"what could go wrong security-wise\", \"map our attack surface\", or before designing any security-sensitive feature.", "repo": "https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/HEAD/plugins/ai-agency/tonone/skills/warden-threat", "install": ["npx skills add jeremylongshore/tons-of-skills-marketplace --skill warden-threat"], "stars": 2919, "pushed": "2026-11-14T05:32:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rohitg00/awesome-claude-code-toolkit/skills/security-hardening", "name": "security-hardening", "kind": "skill", "official": false, "desc": "Application security covering input validation, auth, headers, secrets management, and dependency auditing", "repo": "https://github.com/rohitg00/awesome-claude-code-toolkit/tree/HEAD/skills/security-hardening", "install": ["npx skills add rohitg00/awesome-claude-code-toolkit --skill security-hardening"], "stars": 2838, "pushed": "2026-05-12T07:18:34Z", "license": "Apache-2.0", "plat": "application", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/test_skills/malicious/eicar-test", "name": "eicar-test", "kind": "skill", "official": false, "desc": "Test skill containing EICAR test file for malware detection", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/test_skills/malicious/eicar-test", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill eicar-test"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ai-ml-security", "name": "ai-ml-security", "kind": "skill", "official": false, "desc": "AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ai-ml-security", "install": ["npx skills add yaklang/hack-skills --skill ai-ml-security"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "ai/ml", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/clickjacking", "name": "clickjacking", "kind": "skill", "official": false, "desc": "Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/clickjacking", "install": ["npx skills add yaklang/hack-skills --skill clickjacking"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/cmdi-command-injection", "name": "cmdi-command-injection", "kind": "skill", "official": false, "desc": "Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/cmdi-command-injection", "install": ["npx skills add yaklang/hack-skills --skill cmdi-command-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/code-obfuscation-deobfuscation", "name": "code-obfuscation-deobfuscation", "kind": "skill", "official": false, "desc": "Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/code-obfuscation-deobfuscation", "install": ["npx skills add yaklang/hack-skills --skill code-obfuscation-deobfuscation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/container-escape-techniques", "name": "container-escape-techniques", "kind": "skill", "official": false, "desc": "Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/container-escape-techniques", "install": ["npx skills add yaklang/hack-skills --skill container-escape-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/cors-cross-origin-misconfiguration", "name": "cors-cross-origin-misconfiguration", "kind": "skill", "official": false, "desc": "CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/cors-cross-origin-misconfiguration", "install": ["npx skills add yaklang/hack-skills --skill cors-cross-origin-misconfiguration"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/crlf-injection", "name": "crlf-injection", "kind": "skill", "official": false, "desc": "CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/crlf-injection", "install": ["npx skills add yaklang/hack-skills --skill crlf-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/csp-bypass-advanced", "name": "csp-bypass-advanced", "kind": "skill", "official": false, "desc": "Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/csp-bypass-advanced", "install": ["npx skills add yaklang/hack-skills --skill csp-bypass-advanced"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/csrf-cross-site-request-forgery", "name": "csrf-cross-site-request-forgery", "kind": "skill", "official": false, "desc": "CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/csrf-cross-site-request-forgery", "install": ["npx skills add yaklang/hack-skills --skill csrf-cross-site-request-forgery"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/csv-formula-injection", "name": "csv-formula-injection", "kind": "skill", "official": false, "desc": "CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/csv-formula-injection", "install": ["npx skills add yaklang/hack-skills --skill csv-formula-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/dangling-markup-injection", "name": "dangling-markup-injection", "kind": "skill", "official": false, "desc": "Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/dangling-markup-injection", "install": ["npx skills add yaklang/hack-skills --skill dangling-markup-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/defi-attack-patterns", "name": "defi-attack-patterns", "kind": "skill", "official": false, "desc": "DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/defi-attack-patterns", "install": ["npx skills add yaklang/hack-skills --skill defi-attack-patterns"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/dependency-confusion", "name": "dependency-confusion", "kind": "skill", "official": false, "desc": "Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/dependency-confusion", "install": ["npx skills add yaklang/hack-skills --skill dependency-confusion"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/deserialization-insecure", "name": "deserialization-insecure", "kind": "skill", "official": false, "desc": "Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/deserialization-insecure", "install": ["npx skills add yaklang/hack-skills --skill deserialization-insecure"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/dns-rebinding-attacks", "name": "dns-rebinding-attacks", "kind": "skill", "official": false, "desc": "DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/dns-rebinding-attacks", "install": ["npx skills add yaklang/hack-skills --skill dns-rebinding-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/email-header-injection", "name": "email-header-injection", "kind": "skill", "official": false, "desc": "Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/email-header-injection", "install": ["npx skills add yaklang/hack-skills --skill email-header-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/expression-language-injection", "name": "expression-language-injection", "kind": "skill", "official": false, "desc": "Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/expression-language-injection", "install": ["npx skills add yaklang/hack-skills --skill expression-language-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/file-access-vuln", "name": "file-access-vuln", "kind": "skill", "official": false, "desc": "Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/file-access-vuln", "install": ["npx skills add yaklang/hack-skills --skill file-access-vuln"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/format-string-exploitation", "name": "format-string-exploitation", "kind": "skill", "official": false, "desc": "Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/format-string-exploitation", "install": ["npx skills add yaklang/hack-skills --skill format-string-exploitation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ghost-bits-cast-attack", "name": "ghost-bits-cast-attack", "kind": "skill", "official": false, "desc": "Java \"Ghost Bits\" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many \"patched\" CVEs t", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ghost-bits-cast-attack", "install": ["npx skills add yaklang/hack-skills --skill ghost-bits-cast-attack"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/graphql-and-hidden-parameters", "name": "graphql-and-hidden-parameters", "kind": "skill", "official": false, "desc": "GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/graphql-and-hidden-parameters", "install": ["npx skills add yaklang/hack-skills --skill graphql-and-hidden-parameters"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/hash-attack-techniques", "name": "hash-attack-techniques", "kind": "skill", "official": false, "desc": "Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/hash-attack-techniques", "install": ["npx skills add yaklang/hack-skills --skill hash-attack-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/heap-exploitation", "name": "heap-exploitation", "kind": "skill", "official": false, "desc": "Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/heap-exploitation", "install": ["npx skills add yaklang/hack-skills --skill heap-exploitation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/http-host-header-attacks", "name": "http-host-header-attacks", "kind": "skill", "official": false, "desc": "HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/http-host-header-attacks", "install": ["npx skills add yaklang/hack-skills --skill http-host-header-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/http-parameter-pollution", "name": "http-parameter-pollution", "kind": "skill", "official": false, "desc": "HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/http-parameter-pollution", "install": ["npx skills add yaklang/hack-skills --skill http-parameter-pollution"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/http2-specific-attacks", "name": "http2-specific-attacks", "kind": "skill", "official": false, "desc": "HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/http2-specific-attacks", "install": ["npx skills add yaklang/hack-skills --skill http2-specific-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/idor-broken-object-authorization", "name": "idor-broken-object-authorization", "kind": "skill", "official": false, "desc": "IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/idor-broken-object-authorization", "install": ["npx skills add yaklang/hack-skills --skill idor-broken-object-authorization"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/injection-checking", "name": "injection-checking", "kind": "skill", "official": false, "desc": "Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/injection-checking", "install": ["npx skills add yaklang/hack-skills --skill injection-checking"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/insecure-source-code-management", "name": "insecure-source-code-management", "kind": "skill", "official": false, "desc": "Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/insecure-source-code-management", "install": ["npx skills add yaklang/hack-skills --skill insecure-source-code-management"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ios-pentesting-tricks", "name": "ios-pentesting-tricks", "kind": "skill", "official": false, "desc": "iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ios-pentesting-tricks", "install": ["npx skills add yaklang/hack-skills --skill ios-pentesting-tricks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/jndi-injection", "name": "jndi-injection", "kind": "skill", "official": false, "desc": "JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/jndi-injection", "install": ["npx skills add yaklang/hack-skills --skill jndi-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/jwt-oauth-token-attacks", "name": "jwt-oauth-token-attacks", "kind": "skill", "official": false, "desc": "JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/jwt-oauth-token-attacks", "install": ["npx skills add yaklang/hack-skills --skill jwt-oauth-token-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/kernel-exploitation", "name": "kernel-exploitation", "kind": "skill", "official": false, "desc": "Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/kernel-exploitation", "install": ["npx skills add yaklang/hack-skills --skill kernel-exploitation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/kubernetes-pentesting", "name": "kubernetes-pentesting", "kind": "skill", "official": false, "desc": "Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/kubernetes-pentesting", "install": ["npx skills add yaklang/hack-skills --skill kubernetes-pentesting"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/lattice-crypto-attacks", "name": "lattice-crypto-attacks", "kind": "skill", "official": false, "desc": "Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or applying LLL/BKZ reduction to cryptographic constructions.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/lattice-crypto-attacks", "install": ["npx skills add yaklang/hack-skills --skill lattice-crypto-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/linux-lateral-movement", "name": "linux-lateral-movement", "kind": "skill", "official": false, "desc": "Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/linux-lateral-movement", "install": ["npx skills add yaklang/hack-skills --skill linux-lateral-movement"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/linux-privilege-escalation", "name": "linux-privilege-escalation", "kind": "skill", "official": false, "desc": "Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/linux-privilege-escalation", "install": ["npx skills add yaklang/hack-skills --skill linux-privilege-escalation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/linux-security-bypass", "name": "linux-security-bypass", "kind": "skill", "official": false, "desc": "Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/linux-security-bypass", "install": ["npx skills add yaklang/hack-skills --skill linux-security-bypass"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/llm-prompt-injection", "name": "llm-prompt-injection", "kind": "skill", "official": false, "desc": "LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/llm-prompt-injection", "install": ["npx skills add yaklang/hack-skills --skill llm-prompt-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/macos-process-injection", "name": "macos-process-injection", "kind": "skill", "official": false, "desc": "macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/macos-process-injection", "install": ["npx skills add yaklang/hack-skills --skill macos-process-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/macos-security-bypass", "name": "macos-security-bypass", "kind": "skill", "official": false, "desc": "macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/macos-security-bypass", "install": ["npx skills add yaklang/hack-skills --skill macos-security-bypass"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/memory-forensics-volatility", "name": "memory-forensics-volatility", "kind": "skill", "official": false, "desc": "Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/memory-forensics-volatility", "install": ["npx skills add yaklang/hack-skills --skill memory-forensics-volatility"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/mobile-ssl-pinning-bypass", "name": "mobile-ssl-pinning-bypass", "kind": "skill", "official": false, "desc": "Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI hash pinning on Android and iOS, including React Native, Flutter, and Xamarin frameworks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/mobile-ssl-pinning-bypass", "install": ["npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/network-protocol-attacks", "name": "network-protocol-attacks", "kind": "skill", "official": false, "desc": "Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/network-protocol-attacks", "install": ["npx skills add yaklang/hack-skills --skill network-protocol-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/nosql-injection", "name": "nosql-injection", "kind": "skill", "official": false, "desc": "NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/nosql-injection", "install": ["npx skills add yaklang/hack-skills --skill nosql-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ntlm-relay-coercion", "name": "ntlm-relay-coercion", "kind": "skill", "official": false, "desc": "NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ntlm-relay-coercion", "install": ["npx skills add yaklang/hack-skills --skill ntlm-relay-coercion"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/oauth-oidc-misconfiguration", "name": "oauth-oidc-misconfiguration", "kind": "skill", "official": false, "desc": "OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/oauth-oidc-misconfiguration", "install": ["npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/open-redirect", "name": "open-redirect", "kind": "skill", "official": false, "desc": "Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/open-redirect", "install": ["npx skills add yaklang/hack-skills --skill open-redirect"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/path-traversal-lfi", "name": "path-traversal-lfi", "kind": "skill", "official": false, "desc": "Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/path-traversal-lfi", "install": ["npx skills add yaklang/hack-skills --skill path-traversal-lfi"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/360guard-skillvetter-upgrade-version", "name": "360Guard", "kind": "skill", "official": false, "desc": "360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks and automated scanning scripts. Supports static analysis, behavior detection, dependency auditing.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/360guard-skillvetter-upgrade-version", "install": ["npx skills add LeoYeAI/agent-master-skills --skill 360Guard"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "360guard", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/access-lifecycle", "name": "access-lifecycle", "kind": "skill", "official": false, "desc": "Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering an auditor's access-control request for SOC 2, ISO 27001, PCI DSS, HIPAA or NIST 800-53, or checking whether a finished review campaign will hold up. Diffs the HR roster against account exports, tests the campaign for coverage, self-review, unremoved revokes and rubber-stamping, and maps every exception to the controls it breaks.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/access-lifecycle", "install": ["npx skills add LeoYeAI/agent-master-skills --skill access-lifecycle"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/acl-rule-analysis", "name": "acl-rule-analysis", "kind": "skill", "official": false, "desc": "Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly permissive rule identification, unused rule discovery, redundant rule flagging, and rule ordering optimization. Covers ACLs (Cisco/JunOS/EOS) and firewall policies (PAN-OS/FortiGate/CheckPoint).", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/acl-rule-analysis", "install": ["npx skills add LeoYeAI/agent-master-skills --skill acl-rule-analysis"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "cisco, junos", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-self-assessment", "name": "Agent Compliance & Security Assessment", "kind": "skill", "official": false, "desc": "Comprehensive compliance and security self-assessment for AI agents. 14-check framework producing a structured threat model + compliance report with RED/AMBER/GREEN ratings across security, governance, EU AI Act readiness, oversight quality, and NIST alignment domains. Includes automation bias detection, audit trail reasoning checks, extraterritorial scope assessment, and Zero Trust posture evaluation. Designed for the August 2026 EU AI Act deadline.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-self-assessment", "install": ["npx skills add LeoYeAI/agent-master-skills --skill Agent Compliance & Security Assessment"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/compliance", "name": "agent-bom-compliance", "kind": "skill", "official": false, "desc": "AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: \"compliance report\", \"NIST\", \"SOC 2\", \"ISO 27001\", \"OWASP\", \"EU AI Act\", \"AISVS\", \"generate SBOM\", \"policy check\".", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/compliance", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-compliance"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "ai compliance", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/enforce", "name": "agent-bom-enforce", "kind": "skill", "official": false, "desc": "Enforce security policies on MCP tool calls and block dangerous operations at runtime. Use when: \"block risky calls\", \"apply policy\", \"proxy\", \"runtime protection\", \"policy enforcement\", \"intercept MCP calls\".", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/enforce", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-enforce"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "mcp tool calls", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/registry", "name": "agent-bom-registry", "kind": "skill", "official": false, "desc": "MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans. Use when the user mentions MCP server trust, registry lookup, marketplace check, or skill trust assessment.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/registry", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-registry"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/runtime", "name": "agent-bom-runtime", "kind": "skill", "official": false, "desc": "AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use when the user mentions runtime monitoring, context graphs, lateral movement analysis, audit log correlation, or vulnerability analytics.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/runtime", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-runtime"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "ai runtime", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/scan", "name": "agent-bom-scan", "kind": "skill", "official": false, "desc": "Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans filesystems, and generates SBOMs. Use when: \"check package\", \"scan image\", \"verify\", \"is this safe\", \"scan dependencies\", \"CVE lookup\", \"blast radius\".", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/scan", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-scan"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "agentic infrastructure", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/scan-infra", "name": "agent-bom-scan-infra", "kind": "skill", "official": false, "desc": "Scan infrastructure-as-code, cloud configurations, and find secrets. Use when: \"check terraform\", \"scan kubernetes\", \"IaC\", \"find secrets\", \"scan dockerfile\", \"cloud security\", \"misconfigurations\".", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/scan-infra", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-scan-infra"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "infrastructure-as-code", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-decision-receipts", "name": "agent-decision-receipts", "kind": "skill", "official": false, "desc": "Use when an autonomous agent takes a side-effecting action (deploy, delete, pay, grant access) that may need proving later, or for EU AI Act Art. 12 record-keeping. Builds a tamper-evident signed receipt with build_action_manifest.py and verifies it.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-decision-receipts", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-decision-receipts"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "autonomous agents", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-security-hardening", "name": "agent-security-hardening", "kind": "skill", "official": false, "desc": "Security hardening patterns for production AI agents. Covers prompt injection defense (7 rules), data boundary enforcement, read-only defaults for external integrations, WAL protocol for data integrity, health check scripts, integrity gates, rule escalation ladder, and session memory security. Use when hardening agent deployments against adversarial inputs, data leaks, or operational failures. NOT for network security, infrastructure hardening, or penetration testing.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-security-hardening", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-security-hardening"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/ai-act-readiness", "name": "ai-act-readiness", "kind": "skill", "official": false, "desc": "Use for /compliance-os:ai-act-readiness, or EU AI Act readiness questions during AI-system intake or before EU deployment.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/ai-act-readiness", "install": ["npx skills add LeoYeAI/agent-master-skills --skill ai-act-readiness"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "eu ai act", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-runtime-security", "name": "openclaw-security-hardening", "kind": "skill", "official": false, "desc": "Complete OpenClaw Agent Security Hardening - Protects against data leaks (storage security) and prompt injection (runtime security). Use for initial setup, security audits, and ongoing maintenance. Covers file permissions, sensitive data isolation, Git protection, and command execution safety.", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-runtime-security", "install": ["npx skills add LeoYeAI/agent-master-skills --skill openclaw-security-hardening"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "openclaw", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:CYB3RMX/Qu1cksc0pe", "name": "Qu1cksc0pe", "kind": "mcp", "official": null, "desc": "All-in-One malware analysis tool.", "repo": "https://github.com/CYB3RMX/Qu1cksc0pe", "install": [], "stars": 2103, "pushed": null, "license": null, "plat": "malware", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/accessibility-compliance-accessibility-audit", "name": "accessibility-compliance-accessibility-audit", "kind": "skill", "official": false, "desc": "Audit applications for WCAG compliance, inclusive design, and assistive technology compatibility, then identify barriers and provide remediation guidance. Use when running an accessibility audit or fixing accessibility issues.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/accessibility-compliance-accessibility-audit", "install": ["npx skills add rmyndharis/antigravity-skills --skill accessibility-compliance-accessibility-audit"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/firmware-analyst", "name": "firmware-analyst", "kind": "skill", "official": false, "desc": "Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering. Masters firmware extraction, analysis, and vulnerability research for routers, IoT devices, automotive systems, and industrial controllers. Use for firmware security audits, IoT penetration testing, or embedded systems research.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/firmware-analyst", "install": ["npx skills add rmyndharis/antigravity-skills --skill firmware-analyst"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/frontend-mobile-security-xss-scan", "name": "frontend-mobile-security-xss-scan", "kind": "skill", "official": false, "desc": "Detect and remediate XSS risks in React, Vue, Angular, and browser JavaScript. Use when inspecting injection sinks, untrusted markup, sanitization, or frontend security checks.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/frontend-mobile-security-xss-scan", "install": ["npx skills add rmyndharis/antigravity-skills --skill frontend-mobile-security-xss-scan"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/frontend-security-coder", "name": "frontend-security-coder", "kind": "skill", "official": false, "desc": "Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use for frontend security implementations or client-side security code reviews.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/frontend-security-coder", "install": ["npx skills add rmyndharis/antigravity-skills --skill frontend-security-coder"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/security-auditor", "name": "security-auditor", "kind": "skill", "official": false, "desc": "Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use for security audits, DevSecOps, or compliance implementation.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/security-auditor", "install": ["npx skills add rmyndharis/antigravity-skills --skill security-auditor"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/security-compliance-compliance-check", "name": "security-compliance-compliance-check", "kind": "skill", "official": false, "desc": "Check software systems against regulatory requirements such as GDPR, HIPAA, SOC 2, and PCI-DSS, performing compliance audits and providing implementation guidance. Use when assessing or improving regulatory compliance.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/security-compliance-compliance-check", "install": ["npx skills add rmyndharis/antigravity-skills --skill security-compliance-compliance-check"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/security-scanning-security-dependencies", "name": "security-scanning-security-dependencies", "kind": "skill", "official": false, "desc": "Scan project dependencies across ecosystems for vulnerabilities, generate SBOMs, assess supply chain risk, and recommend remediation. Use when auditing dependency security or producing an SBOM.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/security-scanning-security-dependencies", "install": ["npx skills add rmyndharis/antigravity-skills --skill security-scanning-security-dependencies"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/security-scanning-security-hardening", "name": "security-scanning-security-hardening", "kind": "skill", "official": false, "desc": "Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/security-scanning-security-hardening", "install": ["npx skills add rmyndharis/antigravity-skills --skill security-scanning-security-hardening"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/security-scanning-security-sast", "name": "security-scanning-security-sast", "kind": "skill", "official": false, "desc": "Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/security-scanning-security-sast", "install": ["npx skills add rmyndharis/antigravity-skills --skill security-scanning-security-sast"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/threat-modeling-expert", "name": "threat-modeling-expert", "kind": "skill", "official": false, "desc": "Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture reviews, threat identification, and secure-by-design planning.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/threat-modeling-expert", "install": ["npx skills add rmyndharis/antigravity-skills --skill threat-modeling-expert"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:OpenOSINT/OpenOSINT/skills/exposure", "name": "exposure", "kind": "skill", "official": false, "desc": "Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or \"how exposed is this domain\". No API key needed.", "repo": "https://github.com/OpenOSINT/OpenOSINT/tree/HEAD/skills/exposure", "install": ["npx skills add OpenOSINT/OpenOSINT --skill exposure"], "stars": 1930, "pushed": "2026-11-12T11:00:39Z", "license": "MIT", "plat": "openosint", "live": "Not checked (runs locally)"}, {"id": "skill:OpenOSINT/OpenOSINT/skills/osint", "name": "osint", "kind": "skill", "official": false, "desc": "Passive open-source reconnaissance and external exposure checks for a domain, IP address or organization, using OpenOSINT (DNS, RDAP, WHOIS, email authentication, TLS, security headers, news mentions, search dorks). Use when the user asks to investigate, profile, recon or \"look up\" a domain, IP or company, or to check what a domain exposes to the internet. No API keys needed for the default flow.", "repo": "https://github.com/OpenOSINT/OpenOSINT/tree/HEAD/skills/osint", "install": ["npx skills add OpenOSINT/OpenOSINT --skill osint"], "stars": 1930, "pushed": "2026-11-12T11:00:39Z", "license": "MIT", "plat": "openosint", "live": "Not checked (runs locally)"}, {"id": "skill:tjboudreaux/cc-thinking-skills/skills/thinking-red-team", "name": "thinking-red-team", "kind": "skill", "official": false, "desc": "For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.", "repo": "https://github.com/tjboudreaux/cc-thinking-skills/tree/HEAD/skills/thinking-red-team", "install": ["npx skills add tjboudreaux/cc-thinking-skills --skill thinking-red-team"], "stars": 1738, "pushed": "2026-08-07T18:53:22Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:six2dez/burp-ai-agent", "name": "burp-ai-agent", "kind": "mcp", "official": null, "desc": "Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more", "repo": "https://github.com/six2dez/burp-ai-agent", "install": [], "stars": 1590, "pushed": null, "license": null, "plat": "burp suite", "live": "Not checked (runs locally)"}, {"id": "skill:CloudAI-X/claude-workflow-v2/skills/security-patterns", "name": "security-patterns", "kind": "skill", "official": false, "desc": "Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.", "repo": "https://github.com/CloudAI-X/claude-workflow-v2/tree/HEAD/skills/security-patterns", "install": ["npx skills add CloudAI-X/claude-workflow-v2 --skill security-patterns"], "stars": 1424, "pushed": "2026-10-06T12:14:28Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:affaan-m/agentshield", "name": "agentshield", "kind": "mcp", "official": null, "desc": "AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️", "repo": "https://github.com/affaan-m/agentshield", "install": [], "stars": 1406, "pushed": null, "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:0sec-labs/0security", "name": "0security", "kind": "mcp", "official": null, "desc": "Open-source cybersecurity harness for building continuous security agents that find, prove, fix and monitor vulnerabilities across code, binaries, dependencies, infrastructure and AI agents. Open source. Web UI, CLI, CI and MCP.", "repo": "https://github.com/0sec-labs/0security", "install": [], "stars": 1356, "pushed": null, "license": null, "plat": "ci/cd", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:danielgallen/mcp-server", "name": "mcp-server", "kind": "mcp", "official": null, "desc": "MCP Server for Burp", "repo": "https://github.com/danielgallen/mcp-server", "install": [], "stars": 1271, "pushed": null, "license": null, "plat": "burp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.safedep/vet-mcp", "name": "SafeDep Vet MCP", "kind": "mcp", "official": null, "desc": "Protect your AI agents and IDEs from malicious open-source packages.", "repo": "https://github.com/safedep/vet", "install": ["oci:ghcr.io/safedep/vet:v1.20.0"], "stars": 1126, "pushed": "2026-11-13T06:29:28Z", "license": "Apache-2.0", "plat": "safedep", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:cisco-ai-defense/mcp-scanner", "name": "mcp-scanner", "kind": "mcp", "official": null, "desc": "Scan MCP servers for potential threats & security findings.", "repo": "https://github.com/cisco-ai-defense/mcp-scanner", "install": [], "stars": 1118, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.hashgraph-online/hol-guard", "name": "HOL Guard", "kind": "mcp", "official": null, "desc": "Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.", "repo": "https://github.com/hashgraph-online/hol-guard", "install": ["pypi:hol-guard"], "stars": 1097, "pushed": "2026-11-13T08:57:17Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:RuoJi6/audit-skills/skills/audit-skills", "name": "audit-skills", "kind": "skill", "official": false, "desc": "当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用。仅用于授权代码审计和防御性安全验证。", "repo": "https://github.com/RuoJi6/audit-skills/tree/HEAD/skills/audit-skills", "install": ["npx skills add RuoJi6/audit-skills --skill audit-skills"], "stars": 1046, "pushed": "2026-06-16T03:50:50Z", "license": null, "plat": "java/.net/php", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Pantheon-Security/medusa", "name": "medusa", "kind": "mcp", "official": null, "desc": "AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,00", "repo": "https://github.com/Pantheon-Security/medusa", "install": [], "stars": 1018, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:microsoft/wassette", "name": "wassette", "kind": "mcp", "official": null, "desc": "Wassette: A security-oriented runtime that runs WebAssembly Components via MCP", "repo": "https://github.com/microsoft/wassette", "install": [], "stars": 977, "pushed": null, "license": null, "plat": "webassembly", "live": "Not checked (runs locally)"}, {"id": "skill:laolaoshiren/claude-code-skills-zh/skills/dep-auditor", "name": "dep-auditor", "kind": "skill", "official": false, "desc": "审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报告时使用", "repo": "https://github.com/laolaoshiren/claude-code-skills-zh/tree/HEAD/skills/dep-auditor", "install": ["npx skills add laolaoshiren/claude-code-skills-zh --skill dep-auditor"], "stars": 909, "pushed": "2026-11-11T00:00:34Z", "license": "MIT", "plat": "node.js, python, go", "live": "Not checked (runs locally)"}, {"id": "skill:laolaoshiren/claude-code-skills-zh/skills/security-audit", "name": "security-audit", "kind": "skill", "official": false, "desc": "代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践", "repo": "https://github.com/laolaoshiren/claude-code-skills-zh/tree/HEAD/skills/security-audit", "install": ["npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit"], "stars": 909, "pushed": "2026-11-11T00:00:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:asamassekou10/ship-safe", "name": "ship-safe", "kind": "mcp", "official": null, "desc": "The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.", "repo": "https://github.com/asamassekou10/ship-safe", "install": [], "stars": 872, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:slowmist/MCP-Security-Checklist", "name": "MCP-Security-Checklist", "kind": "mcp", "official": null, "desc": "A comprehensive security checklist for MCP-based AI tools. Built by SlowMist to safeguard LLM plugin ecosystems.", "repo": "https://github.com/slowmist/MCP-Security-Checklist", "install": [], "stars": 834, "pushed": null, "license": null, "plat": "mcp-based ai tools", "live": "Not checked (runs locally)"}, {"id": "skill:decebals/claude-code-java/skills/security-audit", "name": "security-audit", "kind": "skill", "official": false, "desc": "Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.", "repo": "https://github.com/decebals/claude-code-java/tree/HEAD/skills/security-audit", "install": ["npx skills add decebals/claude-code-java --skill security-audit"], "stars": 773, "pushed": "2026-10-29T22:35:52Z", "license": "MIT", "plat": "java", "live": "Not checked (runs locally)"}, {"id": "skill:staruhub/ClaudeSkills/skills/Geek-skills-security-audit", "name": "security-audit", "kind": "skill", "official": false, "desc": "全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 - Docker镜像和Kubernetes配置审计，(6) CI/CD安全检查。触发关键词：\"安全检查\"、\"漏洞扫描\"、\"代码审计\"、\"security audit\"、\"vulnerability scan\"、\"SAST\"、\"dependency check\"、\"CVE检测\"等。不用于：修复单个已定位的bug、编写新的安全功能代码、对无授权的第三方系统做扫描或渗透测试。", "repo": "https://github.com/staruhub/ClaudeSkills/tree/HEAD/skills/Geek-skills-security-audit", "install": ["npx skills add staruhub/ClaudeSkills --skill security-audit"], "stars": 737, "pushed": "2026-08-13T09:26:52Z", "license": "MIT", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "skill:marckohlbrugge/37signals-skills/skills/rails-security-multitenancy", "name": "rails-security-multitenancy", "kind": "skill", "official": false, "desc": "Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.", "repo": "https://github.com/marckohlbrugge/37signals-skills/tree/HEAD/skills/rails-security-multitenancy", "install": ["npx skills add marckohlbrugge/37signals-skills --skill rails-security-multitenancy"], "stars": 732, "pushed": "2026-06-09T20:50:05Z", "license": null, "plat": "ruby on rails", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:hevnsnt/CVEngine", "name": "CVEngine", "kind": "mcp", "official": null, "desc": "AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.", "repo": "https://github.com/hevnsnt/CVEngine", "install": [], "stars": 722, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:suleimanodetoro/skills/skills/review-security", "name": "review-security", "kind": "skill", "official": false, "desc": "Perform a read-only, evidence-based security review of web, API, backend, React, React Native, mobile, dependency, CI/CD, and infrastructure changes. Use when asked for a security review, secure code review, vulnerability assessment, AppSec review, threat review, authentication review, authorization review, tenant-isolation review, secret scan triage, dependency-risk review, mobile security review, OWASP review, ASVS review, MASVS review, or pre-release security audit. Reports only reachable, ma", "repo": "https://github.com/suleimanodetoro/skills/tree/HEAD/skills/review-security", "install": ["npx skills add suleimanodetoro/skills --skill review-security"], "stars": 710, "pushed": "2026-07-30T00:36:45Z", "license": "MIT", "plat": "security", "live": "Not checked (runs locally)"}, {"id": "skill:suleimanodetoro/skills/skills/secure-software", "name": "secure-software", "kind": "skill", "official": false, "desc": "Threat-model, design, implement, and verify security controls in web, API, backend, React, and React Native software. Use when building authentication, session management, authorization, sensitive-data handling, secrets, cryptography integration, input validation, file upload, outbound requests, audit logging, error handling, dependency or CI/CD protections, mobile storage and links, or when remediating a confirmed vulnerability. Triggers on secure this feature, threat model, authentication, aut", "repo": "https://github.com/suleimanodetoro/skills/tree/HEAD/skills/secure-software", "install": ["npx skills add suleimanodetoro/skills --skill secure-software"], "stars": 710, "pushed": "2026-07-30T00:36:45Z", "license": "MIT", "plat": "software", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:arcjet/arcjet-js", "name": "arcjet-js", "kind": "mcp", "official": null, "desc": "Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.", "repo": "https://github.com/arcjet/arcjet-js", "install": [], "stars": 701, "pushed": null, "license": null, "plat": "javascript", "live": "Not checked (runs locally)"}, {"id": "skill:wlzh/skills/vps-security-hardening", "name": "vps-security-hardening", "kind": "skill", "official": false, "desc": "VPS 安全加固自动化 Skill。通过 SSH 登录 VPS 并执行完整的安全策略配置。 触发场景： - \"加固VPS安全\"、\"VPS安全配置\"、\"新VPS初始化\" - \"配置SSH安全\"、\"修改SSH端口\"、\"禁用root密码登录\" - \"VPS安全加固\"、\"服务器安全设置\"、\"hardening\" 功能（7招安全加固）： 1. 创建 sudo 用户，禁用 root 密码登录 2. 修改 SSH 端口（支持 Ubuntu 不同版本） 3. Fail2ban 自动安装配置 4. SSH 密钥登录支持 5. SSH 登录通知（可选） 6. UFW 防火墙配置 7. Docker 安全提醒 Author: github.com/wlzh Version: 1.0.0", "repo": "https://github.com/wlzh/skills/tree/HEAD/vps-security-hardening", "install": ["npx skills add wlzh/skills --skill vps-security-hardening"], "stars": 697, "pushed": "2026-10-27T09:53:19Z", "license": "MIT", "plat": "vps", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:solongate/agent-security", "name": "agent-security", "kind": "mcp", "official": null, "desc": "Local-first, open-source security gateway for AI coding agents. Enforce tool-call policies, detect secrets, and audit actions on-device.", "repo": "https://github.com/solongate/agent-security", "install": [], "stars": 688, "pushed": null, "license": null, "plat": "ai coding agents", "live": "Not checked (runs locally)"}, {"id": "skill:EricTechPro/super-board/skills/pr-security-review", "name": "pr-security-review", "kind": "skill", "official": false, "desc": "Security review of one PR's diff against its base branch — high-confidence, exploitable vulnerabilities only (injection, auth bypass, crypto and secrets, code execution, data exposure), each false-positive-filtered by a parallel sub-task. The super-qa Tester lane runs it on every PR; each finding fails QA and goes back to Build. Use when the user says \"pr security review\", \"/pr-security-review\", or wants a security pass on a branch or PR diff. Not Claude Code's built-in /security-review; for a d", "repo": "https://github.com/EricTechPro/super-board/tree/HEAD/skills/pr-security-review", "install": ["npx skills add EricTechPro/super-board --skill pr-security-review"], "stars": 677, "pushed": "2026-10-29T20:57:37Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:wgpsec/cloudsword", "name": "cloudsword", "kind": "mcp", "official": null, "desc": "一款帮助云租户发现和测试云上风险、增强云上防护能力的综合性开源工具", "repo": "https://github.com/wgpsec/cloudsword", "install": [], "stars": 630, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:7onez/cti-expert", "name": "cti-expert", "kind": "mcp", "official": null, "desc": "CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.", "repo": "https://github.com/7onez/cti-expert", "install": [], "stars": 624, "pushed": null, "license": null, "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/02-vulnerability-scanner", "name": "02-vulnerability-scanner", "kind": "skill", "official": false, "desc": "Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/02-vulnerability-scanner", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 02-vulnerability-scanner"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "vulnerability", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/12-log-analysis", "name": "12-log-analysis", "kind": "skill", "official": false, "desc": "Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/12-log-analysis", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 12-log-analysis"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/13-crypto-analysis", "name": "13-crypto-analysis", "kind": "skill", "official": false, "desc": "SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/13-crypto-analysis", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 13-crypto-analysis"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/15-blue-team-defense", "name": "15-blue-team-defense", "kind": "skill", "official": false, "desc": "System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/15-blue-team-defense", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 15-blue-team-defense"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/16-ai-llm-security", "name": "16-ai-llm-security", "kind": "skill", "official": false, "desc": "LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/16-ai-llm-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 16-ai-llm-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/17-mobile-security", "name": "17-mobile-security", "kind": "skill", "official": false, "desc": "Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/17-mobile-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 17-mobile-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/18-ot-ics-security", "name": "18-ot-ics-security", "kind": "skill", "official": false, "desc": "Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP), PLC/HMI exposure, IEC 62443 alignment, and MITRE ATT&CK for ICS, for authorized and safety-conscious assessments", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/18-ot-ics-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 18-ot-ics-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/19-grc-compliance", "name": "19-grc-compliance", "kind": "skill", "official": false, "desc": "Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/19-grc-compliance", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 19-grc-compliance"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/20-supply-chain-security", "name": "20-supply-chain-security", "kind": "skill", "official": false, "desc": "Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/20-supply-chain-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 20-supply-chain-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/21-threat-intelligence", "name": "21-threat-intelligence", "kind": "skill", "official": false, "desc": "Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/21-threat-intelligence", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 21-threat-intelligence"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/22-purple-team", "name": "22-purple-team", "kind": "skill", "official": false, "desc": "Collaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconfliction, and MTTD/coverage reporting", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/22-purple-team", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 22-purple-team"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:riseandignite/mcp-shield", "name": "mcp-shield", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers", "repo": "https://github.com/riseandignite/mcp-shield", "install": [], "stars": 556, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:shinthink/blitzstrike", "name": "blitzstrike", "kind": "mcp", "official": null, "desc": "Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.", "repo": "https://github.com/shinthink/blitzstrike", "install": [], "stars": 518, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:firebase/agent-skills/skills/firebase-security-rules-auditor", "name": "firebase-security-rules-auditor", "kind": "skill", "official": false, "desc": "Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.", "repo": "https://github.com/firebase/agent-skills/tree/HEAD/skills/firebase-security-rules-auditor", "install": ["npx skills add firebase/agent-skills --skill firebase-security-rules-auditor"], "stars": 513, "pushed": "2026-11-09T18:52:44Z", "license": "Apache-2.0", "plat": "firebase", "live": "Not checked (runs locally)"}, {"id": "skill:firebase/agent-skills/skills/firestore-rules-creation", "name": "firestore-rules-creation", "kind": "skill", "official": false, "desc": "Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.", "repo": "https://github.com/firebase/agent-skills/tree/HEAD/skills/firestore-rules-creation", "install": ["npx skills add firebase/agent-skills --skill firestore-rules-creation"], "stars": 513, "pushed": "2026-11-09T18:52:44Z", "license": "Apache-2.0", "plat": "firebase", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.salemalem/npmscan", "name": "NPMScan", "kind": "mcp", "official": null, "desc": "Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups", "repo": "https://github.com/salemalem/npmscan-mcp-plugin", "install": ["https://npmscan.com/api/mcp"], "stars": 503, "pushed": "2026-11-08T21:40:03Z", "license": "MIT", "plat": "npmscan", "live": "Live · 5176 ms · 23 tools · free to try: `search_packages` answered without a key (checked 2026-11-13)"}, {"id": "mcp:gh:Aletheore/Aletheore", "name": "Aletheore", "kind": "mcp", "official": null, "desc": "Open source (AGPL-3.0) evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.", "repo": "https://github.com/Aletheore/Aletheore", "install": [], "stars": 480, "pushed": null, "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "skill:udaysharmadev/Gravitas/plugins/gravitas-security", "name": "gravitas-security", "kind": "skill", "official": false, "desc": "Deep security review mode for GRAVITAS. Adds threat modeling, OWASP Top 10 checks, injection prevention patterns, auth/session security, and security-specific test requirements. Load for any auth, input handling, database, or API work.", "repo": "https://github.com/udaysharmadev/Gravitas/tree/HEAD/plugins/gravitas-security", "install": ["npx skills add udaysharmadev/Gravitas --skill gravitas-security"], "stars": 473, "pushed": "2026-11-03T14:09:22Z", "license": "MIT", "plat": "gravitas-security", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:adithyan-ak/AgentHound", "name": "AgentHound", "kind": "mcp", "official": null, "desc": "Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.", "repo": "https://github.com/adithyan-ak/AgentHound", "install": [], "stars": 464, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Community-Access/accessibility-agents", "name": "Accessibility Agents", "kind": "mcp", "official": null, "desc": "WCAG 2.2 scanners for web pages, Office, PDF, ePub and Markdown: contrast, axe, veraPDF and more.", "repo": "https://github.com/Community-Access/accessibility-agents", "install": ["npm:@community-access/accessibility-agents-mcp"], "stars": 445, "pushed": "2026-11-13T00:43:15Z", "license": "MIT", "plat": "web pages, office, pdf, epub and markdow", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/proxy", "name": "ghost-proxy", "kind": "skill", "official": false, "desc": "Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by method/path/status/host, and inspecting full raw HTTP entries for security analysis. Use when the user asks to \"start the proxy\", \"capture traffic\", \"intercept requests\", \"inspect HTTP traffic\", \"search captured requests\", or \"view ", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/proxy", "install": ["npx skills add ghostsecurity/skills --skill ghost-proxy"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "mitm proxy", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/report", "name": "ghost-report", "kind": "skill", "official": false, "desc": "Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/report", "install": ["npx skills add ghostsecurity/skills --skill ghost-report"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "ghost security", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/scan-code", "name": "ghost-scan-code", "kind": "skill", "official": false, "desc": "Ghost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for issues like SQL injection, XSS, BOLA, BFLA, SSRF, and other OWASP categories. Supports applications (backend, frontend, mobile) and libraries (prototype pollution, unsafe deserialization, ReDoS, path traversal, zip slip). Use when the user asks for a code security audit, SAST scan, vulnerability scan of source code, or wants to find security flaws in a codebase or librar", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/scan-code", "install": ["npx skills add ghostsecurity/skills --skill ghost-scan-code"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "ghost security", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/scan-deps", "name": "ghost-scan-deps", "kind": "skill", "official": false, "desc": "Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.mod, or Gemfile.lock.", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/scan-deps", "install": ["npx skills add ghostsecurity/skills --skill ghost-scan-deps"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "ghost security", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/scan-secrets", "name": "ghost-scan-secrets", "kind": "skill", "official": false, "desc": "Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for credentials, find hardcoded API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/scan-secrets", "install": ["npx skills add ghostsecurity/skills --skill ghost-scan-secrets"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "ghost security", "live": "Not checked (runs locally)"}, {"id": "skill:ghostsecurity/skills/plugins/ghost/skills/validate", "name": "ghost-validate", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"validate a finding\", \"check if a vulnerability is real\", \"triage a security finding\", \"confirm a vulnerability\", \"determine if a finding is a true positive or false positive\", or provides a security finding for review. It validates security vulnerability findings by tracing data flows, verifying exploit conditions, analyzing security controls, and optionally testing attack vectors against a live application.", "repo": "https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost/skills/validate", "install": ["npx skills add ghostsecurity/skills --skill ghost-validate"], "stars": 443, "pushed": "2026-09-28T13:49:25Z", "license": "Apache-2.0", "plat": "ghost security", "live": "Not checked (runs locally)"}, {"id": "skill:agamm/claude-code-owasp/.claude/skills/owasp-security", "name": "owasp-security", "kind": "skill", "official": false, "desc": "Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security issues, implementing authentication, authorization, sessions, or cryptography, handling untrusted input, files, or URLs, hardening config, dependencies, or CI, or building LLM and AI agent features.", "repo": "https://github.com/agamm/claude-code-owasp/tree/HEAD/.claude/skills/owasp-security", "install": ["npx skills add agamm/claude-code-owasp --skill owasp-security"], "stars": 442, "pushed": "2026-11-03T19:29:21Z", "license": "MIT", "plat": "owasp", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Vigil-SOC/vigil", "name": "vigil", "kind": "mcp", "official": null, "desc": "Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote. ", "repo": "https://github.com/Vigil-SOC/vigil", "install": [], "stars": 437, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Ta0ing/MCP-SecurityTools", "name": "MCP-SecurityTools", "kind": "mcp", "official": null, "desc": "MCP-SecurityTools 是一个专注于收录和更新网络安全领域 MCP 的开源项目，旨在汇总、整理和优化各类与 MCP 相关的安全工具、技术及实战经验。", "repo": "https://github.com/Ta0ing/MCP-SecurityTools", "install": [], "stars": 413, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:waynesutton/builder-skills/skills/sec-check", "name": "sec-check", "kind": "skill", "official": false, "desc": "Security check and audit for Convex apps and any app with a React, Vite, Next.js, or Expo frontend, built from real incidents across shipped repos. Runs a secret scanner plus a per function surface ledger, then gates every candidate finding on a real attacker path before it gets a severity. Covers leaked keys, client prefixed secrets, public functions with no auth, caller identity taken from args, paid AI and AI Gateway spend, unsigned webhooks, open uploads, unsafe HTML, prompt injection into a", "repo": "https://github.com/waynesutton/builder-skills/tree/HEAD/skills/sec-check", "install": ["npx skills add waynesutton/builder-skills --skill sec-check"], "stars": 404, "pushed": "2026-11-09T10:42:03Z", "license": "Apache-2.0", "plat": "convex", "live": "Not checked (runs locally)"}, {"id": "skill:Eyadkelleh/awesome-skills-security/skills/security-patterns", "name": "security-patterns", "kind": "skill", "official": false, "desc": "Sensitive data patterns for security testing: API keys, credit cards, emails, SSNs, phone numbers, IPs, and more. Use for data discovery and validation.", "repo": "https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-patterns", "install": ["npx skills add Eyadkelleh/awesome-skills-security --skill security-patterns"], "stars": 401, "pushed": "2026-06-08T08:31:04Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Eyadkelleh/awesome-skills-security/skills/security-webshells", "name": "security-webshells", "kind": "skill", "official": false, "desc": "Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing.", "repo": "https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-webshells", "install": ["npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells"], "stars": 401, "pushed": "2026-06-08T08:31:04Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.bx33661/wireshark-mcp", "name": "io.github.bx33661/wireshark-mcp", "kind": "mcp", "official": null, "desc": "Professional network analysis with tshark. Security audits, deep-dives, and threat detection.", "repo": "https://github.com/bx33661/Wireshark-MCP", "install": ["pypi:wireshark-mcp"], "stars": 398, "pushed": "2026-11-01T23:45:51Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:MorDavid/BloodHound-MCP-AI", "name": "BloodHound-MCP-AI", "kind": "mcp", "official": null, "desc": "BloodHound-MCP-AI is integration that connects BloodHound with AI through Model Context Protocol, allowing security professionals to analyze Active Directory attack paths using natural language instead of complex Cypher queries.", "repo": "https://github.com/MorDavid/BloodHound-MCP-AI", "install": [], "stars": 385, "pushed": null, "license": null, "plat": "bloodhound", "live": "Not checked (runs locally)"}, {"id": "skill:superagents-lab/xcode27-skills/audit-xcode-security-settings", "name": "audit-xcode-security-settings", "kind": "skill", "official": false, "desc": "Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode project, audit security settings, enable hardening, review security posture of build configuration, set up security-focused static analysis, enable static analysis, improve warning coverage, harden diagnostics, or catch more bugs at compile time in C/C++/Objective-C/Swift. SKIP: network security (TLS", "repo": "https://github.com/superagents-lab/xcode27-skills/tree/HEAD/audit-xcode-security-settings", "install": ["npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings"], "stars": 366, "pushed": "2026-06-09T08:44:33Z", "license": null, "plat": "xcode", "live": "Not checked (runs locally)"}, {"id": "skill:superagents-lab/xcode27-skills/c-bounds-safety", "name": "c-bounds-safety", "kind": "skill", "official": false, "desc": "Guide for the C -fbounds-safety language extension. Covers the language model, pointer annotations, adopting bounds-safety in existing C code, compiler build settings and modes, and runtime debugging of bounds violations.", "repo": "https://github.com/superagents-lab/xcode27-skills/tree/HEAD/c-bounds-safety", "install": ["npx skills add superagents-lab/xcode27-skills --skill c-bounds-safety"], "stars": 366, "pushed": "2026-06-09T08:44:33Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:justxor/claude-code-pro-course/plugin-example/skills/review", "name": "review", "kind": "skill", "official": false, "desc": "Ревью изменений с фокусом на безопасность по стандартам команды. Используй перед мерджем или по просьбе проверить безопасность.", "repo": "https://github.com/justxor/claude-code-pro-course/tree/HEAD/plugin-example/skills/review", "install": ["npx skills add justxor/claude-code-pro-course --skill review"], "stars": 352, "pushed": "2026-10-01T12:10:20Z", "license": "MIT", "plat": "review", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:mrhlaingbwardev/agentic-hacking-skills", "name": "agentic-hacking-skills", "kind": "mcp", "official": null, "desc": "AI-Powered Web Security & Automation - Official bonus skills, agents & MCP configs for the 'Agentic Hacking' ebook (28 SKILL.md templates)", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills", "install": [], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/disclosure-communication", "name": "disclosure-communication", "kind": "skill", "official": false, "desc": "Use when writing or sending a vulnerability, exposure, or leaked-credential report to a vendor, PSIRT, bug bounty triage, CERT, or a decision-maker. Applies persuasion and communication psychology to get the finding accepted and to obtain a bounty, credit, or certificate. Ethical, non-coercive, professional.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/disclosure-communication", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill disclosure-communication"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "disclosure", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/leak-triage-and-validation", "name": "leak-triage-and-validation", "kind": "skill", "official": false, "desc": "Use when a leak or dump contains many tokens, keys, secrets, or repos and you must filter the valuable ones, verify validity, assess capability and real value, prioritize by ROI, profile the owner, and decide what to report. Verify-only, metadata-only, runs on the VPS.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/leak-triage-and-validation", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill leak-triage-and-validation"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "leak triage", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/supply-chain", "name": "supply-chain", "kind": "skill", "official": false, "desc": "Use when user says \"supply chain\", \"dependency\", \"npm\", \"pip\", \"pypi\", \"gem\", \"maven\", \"nuget\", \"docker\", \"package\", \"poison\", \"typosquat\", \"dependency confusion\", \"man-in-the-middle\", \"registry\", \"upstream\". Supply chain attacks including dependency confusion, typosquatting, package poisoning, CI/CD hijacking, and upstream compromise.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/supply-chain", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill supply-chain"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "supply chain", "live": "Not checked (runs locally)"}, {"id": "skill:tanviet12/vbsec/skills/antigravity/vbs-scan-security", "name": "vbs-scan-security", "kind": "skill", "official": false, "desc": "Use when scanning code for security vulnerabilities. Use when user says \"scan security\", \"kiểm tra bảo mật\", \"security audit\", \"review security\", or invokes `/vbs-scan-security`. For large scans (>20 main-language files OR >30 total OR >14 days) processes chunks sequentially. Outputs bilingual reports (vi/en). Optional `--auto-fix` (agentic patch + verify loop) and `--sca` (live CVE lookup via OSV.dev).", "repo": "https://github.com/tanviet12/vbsec/tree/HEAD/skills/antigravity/vbs-scan-security", "install": ["npx skills add tanviet12/vbsec --skill vbs-scan-security"], "stars": 330, "pushed": "2026-09-28T06:10:49Z", "license": "MIT", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "skill:tanviet12/vbsec/skills/vbs-scan-security", "name": "vbs-scan-security", "kind": "skill", "official": false, "desc": "Use when scanning code for security vulnerabilities. Use when user says \"scan security\", \"kiểm tra bảo mật\", \"security audit\", \"review security\", or invokes `/vbs-scan-security`. Auto-delegates to sub-agents for large scans (>20 main-language files OR >30 total OR >14 days). Outputs bilingual reports (vi/en). Optional `--auto-fix` (agentic patch + verify loop) and `--sca` (live CVE lookup via OSV.dev).", "repo": "https://github.com/tanviet12/vbsec/tree/HEAD/skills/vbs-scan-security", "install": ["npx skills add tanviet12/vbsec --skill vbs-scan-security"], "stars": 330, "pushed": "2026-09-28T06:10:49Z", "license": "MIT", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/web-security-advanced", "name": "web-security", "kind": "skill", "official": false, "desc": "SECURE BY DEFAULT. When building login, API routes, file uploads, database queries, payments, user content, admin panels, webhooks, forms, password reset, OAuth, or any web feature — auto-detect what the user is building and inject the correct security patterns BEFORE it ships. Prevents env leaks, XSS, SQLi, IDOR, CSRF, SSRF, path traversal, mass assignment. Frameworks: Next.js, React, Express, Remix, SvelteKit.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/web-security-advanced", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill web-security"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Cy-S3c/BurpMCP-Ultra", "name": "BurpMCP-Ultra", "kind": "mcp", "official": null, "desc": "AI-powered MCP server for Burp Suite Professional — 149 tools across proxy, scanner, inline fuzzer, race conditions, guided injection, JWT/IDOR attacks, recon & OOB, with a real-time dashboard and hardened localhost security. Drive Burp from Claude Code or any MCP client.", "repo": "https://github.com/Cy-S3c/BurpMCP-Ultra", "install": [], "stars": 307, "pushed": null, "license": null, "plat": "burp suite professional", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:HarmonicSecurity/claudit-sec", "name": "claudit-sec", "kind": "mcp", "official": null, "desc": "Security audit tool for Claude Desktop and Claude Code on macOS — single-command visibility into MCP servers, extensions, plugins, connectors, scheduled tasks, and permissions.", "repo": "https://github.com/HarmonicSecurity/claudit-sec", "install": [], "stars": 305, "pushed": null, "license": null, "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "skill:akitaonrails/my-skills/security-audit", "name": "security-audit", "kind": "skill", "official": false, "desc": "Threat-model and audit a codebase, commit range, or pull request for exploitable vulnerabilities, prompt and data injection, authentication or authorization bypass, tenant-data exposure, privilege escalation, malicious code/backdoors, unsafe execution, secrets leakage, supply-chain and CI compromise, insecure persistence, and denial of service. Use for dedicated security reviews, release gates, suspicious contributions, or requests to verify that a project protects users and their data.", "repo": "https://github.com/akitaonrails/my-skills/tree/HEAD/security-audit", "install": ["npx skills add akitaonrails/my-skills --skill security-audit"], "stars": 304, "pushed": "2026-10-31T23:46:39Z", "license": null, "plat": "security-audit", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:sspsec/Scan-Spring-GO", "name": "Scan-Spring-GO", "kind": "mcp", "official": null, "desc": "Spring 全家桶漏洞扫描工具 | 17 个漏洞模块 + MCP 服务端（AI 自动化渗透）| Go 实现", "repo": "https://github.com/sspsec/Scan-Spring-GO", "install": [], "stars": 302, "pushed": null, "license": null, "plat": "spring", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CrowdStrike/falcon-mcp", "name": "CrowdStrike Falcon MCP Server", "kind": "mcp", "official": null, "desc": "Connects AI agents with CrowdStrike Falcon for security analysis and automation.", "repo": "https://github.com/CrowdStrike/falcon-mcp", "install": ["pypi:falcon-mcp"], "stars": 281, "pushed": "2026-11-03T22:04:09Z", "license": "MIT", "plat": "crowdstrike falcon", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.codespar/mcp-jumio", "name": "io.github.codespar/mcp-jumio", "kind": "mcp", "official": null, "desc": "MCP server for Jumio — global identity verification + KYX: documents, liveness, AML screening", "repo": "https://github.com/codespar/mcp-dev-latam", "install": ["npm:@codespar/mcp-jumio"], "stars": 279, "pushed": "2026-09-27T07:38:07Z", "license": "MIT", "plat": "jumio", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.codespar/mcp-konduto", "name": "io.github.codespar/mcp-konduto", "kind": "mcp", "official": null, "desc": "MCP server for Konduto — Brazilian fraud prevention: order risk scoring, device intel, lists", "repo": "https://github.com/codespar/mcp-dev-latam", "install": ["npm:@codespar/mcp-konduto"], "stars": 279, "pushed": "2026-09-27T07:38:07Z", "license": "MIT", "plat": "konduto", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:w0h1v/mcp-maigret", "name": "mcp-maigret", "kind": "mcp", "official": null, "desc": "MCP server that lets AI agents run maigret, an OSINT tool that searches a username across thousands of sites", "repo": "https://github.com/w0h1v/mcp-maigret", "install": [], "stars": 273, "pushed": null, "license": null, "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:OSINT-Experts-Society/Consensus-OSINT", "name": "Consensus-OSINT", "kind": "mcp", "official": null, "desc": "🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.", "repo": "https://github.com/OSINT-Experts-Society/Consensus-OSINT", "install": [], "stars": 270, "pushed": null, "license": null, "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:JameZUK/Arkana", "name": "Arkana", "kind": "mcp", "official": null, "desc": "Arkana - Your entire malware analysis lab, behind one AI prompt. 250+ MCP tools for binary analysis with Claude Code or other MCP", "repo": "https://github.com/JameZUK/Arkana", "install": [], "stars": 261, "pushed": null, "license": null, "plat": "malware analysis", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dengyier/OpenWorkProof", "name": "OpenWorkProof", "kind": "mcp", "official": null, "desc": "Verifiable agent evidence; opt-in Codex guard and reference SOC alert review.", "repo": "https://github.com/dengyier/OpenWorkProof", "install": ["pypi:openworkproof"], "stars": 261, "pushed": "2026-11-10T07:02:38Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dengyier/OpenWorkProof-Rust", "name": "OpenWorkProof Rust (Apple Silicon)", "kind": "mcp", "official": null, "desc": "Six local Rust tools for evidence digests, signature checks, keys and schemas on Apple Silicon.", "repo": "https://github.com/dengyier/OpenWorkProof", "install": ["mcpb:https://github.com/dengyier/OpenWorkProof/releases/download/rust-v0.1.0/openworkproof-rust-macos-arm64.mcpb"], "stars": 261, "pushed": "2026-11-10T07:02:38Z", "license": "Apache-2.0", "plat": "apple silicon", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:MCP-Defender/MCP-Defender", "name": "MCP-Defender", "kind": "mcp", "official": null, "desc": "Desktop app that automatically scans and blocks malicious MCP traffic in AI apps like Cursor, Claude, VS Code and Windsurf.", "repo": "https://github.com/MCP-Defender/MCP-Defender", "install": [], "stars": 255, "pushed": null, "license": null, "plat": "ai apps", "live": "Not checked (runs locally)"}, {"id": "skill:kklimuk/docx-cli/.claude/skills/security-review", "name": "security-review", "kind": "skill", "official": false, "desc": "Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'pentest the code', 'OWASP check', or any variation of wanting a security assessment.", "repo": "https://github.com/kklimuk/docx-cli/tree/HEAD/.claude/skills/security-review", "install": ["npx skills add kklimuk/docx-cli --skill security-review"], "stars": 248, "pushed": "2026-11-12T19:05:16Z", "license": "MIT", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:gbrigandi/mcp-server-wazuh", "name": "mcp-server-wazuh", "kind": "mcp", "official": null, "desc": "MCP Server for Wazuh SIEM", "repo": "https://github.com/gbrigandi/mcp-server-wazuh", "install": [], "stars": 240, "pushed": null, "license": null, "plat": "wazuh", "live": "Not checked (runs locally)"}, {"id": "skill:johnku2011/boilerplates-with-ai-skills/shared/workflows/bwai-delivery/skills/bwai-security-gate", "name": "bwai-security-gate", "kind": "skill", "official": false, "desc": "Run the SkillSpector safety gate on this project's installed skills before merge or release.", "repo": "https://github.com/johnku2011/boilerplates-with-ai-skills/tree/HEAD/shared/workflows/bwai-delivery/skills/bwai-security-gate", "install": ["npx skills add johnku2011/boilerplates-with-ai-skills --skill bwai-security-gate"], "stars": 239, "pushed": "2026-08-24T15:57:37Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:johnku2011/boilerplates-with-ai-skills/shared/skills/project-security", "name": "project-security", "kind": "skill", "official": false, "desc": "Use when reviewing security-sensitive code paths — check auth, secrets, input validation, dependency risk, and data exposure before shipping.", "repo": "https://github.com/johnku2011/boilerplates-with-ai-skills/tree/HEAD/shared/skills/project-security", "install": ["npx skills add johnku2011/boilerplates-with-ai-skills --skill project-security"], "stars": 239, "pushed": "2026-08-24T15:57:37Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:openqa-cn/codexqa/skills/codexqa-defect-analyzer", "name": "codexqa-defect-analyzer", "kind": "skill", "official": false, "desc": "AI defect detection and code-risk scanning for engineering projects. Use when the user asks for AI defect detection, code-risk scan, review a diff/MR/PR/commit (incremental), baseline-scan a repository (full), OR upload/paste code snippets for adhoc defect detection. Combines two detection dimensions — (1) deterministic SAST/lint/secrets/SCA and (2) one-round Agent LLM Detection by the invoking agent's embedded model (no separate LLM API key) — then dedupes and merges them into the final report.", "repo": "https://github.com/openqa-cn/codexqa/tree/HEAD/skills/codexqa-defect-analyzer", "install": ["npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer"], "stars": 238, "pushed": "2026-11-06T11:55:53Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:dhruvjainin/absolute/skills/absolute-audit", "name": "absolute-audit", "kind": "skill", "official": false, "desc": "Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on \"absolute audit\", \"security audit\", \"are we vulnerable\", \"scan for CVEs\", \"check for secrets/injection\", \"harden this\".", "repo": "https://github.com/dhruvjainin/absolute/tree/HEAD/skills/absolute-audit", "install": ["npx skills add dhruvjainin/absolute --skill absolute-audit"], "stars": 223, "pushed": "2026-10-26T12:48:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sjkim1127/reversecore-mcp", "name": "Reversecore MCP", "kind": "mcp", "official": null, "desc": "Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.", "repo": "https://github.com/sjkim1127/Reversecore_MCP", "install": ["pypi:reversecore-mcp", "oci:ghcr.io/sjkim1127/reversecore_mcp:3.1.0"], "stars": 221, "pushed": "2026-11-13T03:19:31Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:GaaraZhu/gate", "name": "gate", "kind": "mcp", "official": null, "desc": "A deterministic privacy boundary between your data and AI.", "repo": "https://github.com/GaaraZhu/gate", "install": [], "stars": 214, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:thomast1906/github-copilot-agent-skills/.github/skills/api-security-review", "name": "api-security-review", "kind": "skill", "official": false, "desc": "Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.", "repo": "https://github.com/thomast1906/github-copilot-agent-skills/tree/HEAD/.github/skills/api-security-review", "install": ["npx skills add thomast1906/github-copilot-agent-skills --skill api-security-review"], "stars": 206, "pushed": "2026-10-22T11:59:53Z", "license": null, "plat": "azure api management", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.thomasxm/crowdsentinel-mcp-server", "name": "io.github.thomasxm/crowdsentinel-mcp-server", "kind": "mcp", "official": null, "desc": "AI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics", "repo": "https://github.com/thomasxm/CrowdSentinels-AI-MCP", "install": ["pypi:crowdsentinel-mcp-server"], "stars": 204, "pushed": "2026-07-19T21:09:49Z", "license": "GPL-3.0", "plat": "elasticsearch/opensearch", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:MCP-Manager/MCP-Security-Checklists", "name": "MCP-Security-Checklists", "kind": "mcp", "official": null, "desc": "", "repo": "https://github.com/MCP-Manager/MCP-Security-Checklists", "install": [], "stars": 200, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:mrphrazer/ghidra-headless-mcp", "name": "ghidra-headless-mcp", "kind": "mcp", "official": null, "desc": "Headless Ghidra MCP server — giving AI agents deep reverse-engineering capabilities.", "repo": "https://github.com/mrphrazer/ghidra-headless-mcp", "install": [], "stars": 198, "pushed": null, "license": null, "plat": "ghidra", "live": "Not checked (runs locally)"}, {"id": "skill:rodrigohighermind/highermind-code-skills/hm-security", "name": "hm-security", "kind": "skill", "official": false, "desc": "Auditoria de segurança profunda (L1/L2/L3). Use antes de deploy externo, após adicionar auth/dados sensíveis/fluxo financeiro, ou periodicamente como manutenção. Cobre 14 domínios — CIS Docker, OWASP Top 10, OWASP API Top 10, ASVS AuthN/Session, dados/compliance (LGPD/GDPR/PCI), supply chain, AI/LLM (prompt injection, tool calling, multi-tenant LLM), file upload, business logic, secrets scan com 20+ patterns, Supabase/PostgREST RLS regime absoluto. Barra Tempest / Trail of Bits / Cure53.", "repo": "https://github.com/rodrigohighermind/highermind-code-skills/tree/HEAD/hm-security", "install": ["npx skills add rodrigohighermind/highermind-code-skills --skill hm-security"], "stars": 197, "pushed": "2026-06-14T22:39:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:TabooHarmony/roblox-brain/skills/core/roblox-security", "name": "roblox-security", "kind": "skill", "official": false, "desc": "Use when auditing or hardening Roblox code against exploits: authority, remotes, economy, purchases, and DataStore flows.", "repo": "https://github.com/TabooHarmony/roblox-brain/tree/HEAD/skills/core/roblox-security", "install": ["npx skills add TabooHarmony/roblox-brain --skill roblox-security"], "stars": 186, "pushed": "2026-10-15T04:23:10Z", "license": "MIT", "plat": "roblox", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-solidity-audit-mcp", "name": "web3-solidity-audit-mcp", "kind": "skill", "official": false, "desc": "MCP server integrating Slither + Aderyn + SWC patterns into Claude Code for smart contract auditing. Use when analyzing Solidity files, running DeFi-specific detectors, or generating invariants. 10 MCP tools, 86 SWC detectors, DeFi preset pack, CI/CD workflow.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-solidity-audit-mcp", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-solidity-audit-mcp"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "solidity", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MustacheCase/zanadir", "name": "zanadir", "kind": "mcp", "official": null, "desc": "Find what a repository's CI is missing, and which security checks cannot fail the build.", "repo": "https://github.com/MustacheCase/zanadir", "install": ["oci:docker.io/mustachecase/zanadir:0.31.0"], "stars": 185, "pushed": "2026-11-13T12:32:54Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:mcp-shark/mcp-shark", "name": "mcp-shark", "kind": "mcp", "official": null, "desc": "Wireshark-like forensic analysis for Model Context Protocol communications  Capture, inspect, and investigate all HTTP requests and responses between your IDE and MCP servers", "repo": "https://github.com/mcp-shark/mcp-shark", "install": [], "stars": 180, "pushed": null, "license": null, "plat": "wireshark", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:johnhalloran321/mcpSafetyScanner", "name": "mcpSafetyScanner", "kind": "mcp", "official": null, "desc": "MCPSafetyScanner - Automated MCP safety auditing and remediation using Agents. More info: https://www.arxiv.org/abs/2504.03767", "repo": "https://github.com/johnhalloran321/mcpSafetyScanner", "install": [], "stars": 178, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Claude-Reverser/IDA-instances-MCP", "name": "IDA-instances-MCP", "kind": "mcp", "official": null, "desc": "Custom build of ida-pro-mcp - stability-hardened MCP server for hosting headless IDA Pro instances", "repo": "https://github.com/Claude-Reverser/IDA-instances-MCP", "install": [], "stars": 175, "pushed": null, "license": null, "plat": "ida pro", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:depalmar/ai-dfir-toolkit", "name": "ai-dfir-toolkit", "kind": "mcp", "official": null, "desc": "A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.", "repo": "https://github.com/depalmar/ai-dfir-toolkit", "install": [], "stars": 168, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:supercorp-ai/supercov/plugins/supercov/skills/supercov-security", "name": "supercov-security", "kind": "skill", "official": false, "desc": "Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Use when the user asks for a security scan or audit, whether code is secure, or to find vulnerabilities, injection, hardcoded secrets or other insecure code.", "repo": "https://github.com/supercorp-ai/supercov/tree/HEAD/plugins/supercov/skills/supercov-security", "install": ["npx skills add supercorp-ai/supercov --skill supercov-security"], "stars": 167, "pushed": "2026-11-13T09:43:04Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.BurtTheCoder/virustotal", "name": "io.github.BurtTheCoder/virustotal", "kind": "mcp", "official": null, "desc": "MCP server for querying VirusTotal API with comprehensive security analysis tools.", "repo": "https://github.com/BurtTheCoder/mcp-virustotal", "install": ["npm:@burtthecoder/mcp-virustotal"], "stars": 155, "pushed": "2026-11-06T14:55:03Z", "license": "MIT", "plat": "virustotal", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.w0h1v/virustotal", "name": "io.github.w0h1v/virustotal", "kind": "mcp", "official": null, "desc": "MCP server for querying VirusTotal API with comprehensive security analysis tools.", "repo": "https://github.com/w0h1v/mcp-virustotal", "install": ["npm:@burtthecoder/mcp-virustotal"], "stars": 155, "pushed": "2026-11-06T14:55:03Z", "license": "MIT", "plat": "virustotal", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/source-audit", "name": "source-audit", "kind": "skill", "official": false, "desc": "白盒代码审计与反编译产物审计专项。当拿到源码/反编译产物/代码片段，需要从输入点追到危险函数、或做鉴权/逻辑审计时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/source-audit", "install": ["npx skills add zhaji2333/CkSKILLS --skill source-audit"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-auth-access", "name": "web-auth-access", "kind": "skill", "official": false, "desc": "认证/会话/JWT/验证码/越权(IDOR)/前端权限绕过专项。当出现注册登录、找回密码、验证码、OAuth、JWT、2FA、角色参数、id 可替换、路由守卫时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-auth-access", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-auth-access"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-deser-xxe", "name": "web-deser-xxe", "kind": "skill", "official": false, "desc": "反序列化/XXE/原型污染/JNDI/XSLT/EL/沙箱脚本注入专项。当出现 XML/SOAP/序列化对象/JSON 深合并/yaml.load/不可信反序列化入口时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-deser-xxe", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-deser-xxe"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-file-path", "name": "web-file-path", "kind": "skill", "official": false, "desc": "文件上传/下载/导入导出/预览/路径穿越/任意读写/处理引擎专项。当出现头像附件上传、报表导出、文档导入、PDF/Office/图片预览、压缩包、在线解压时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-file-path", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-file-path"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-injection", "name": "web-injection", "kind": "skill", "official": false, "desc": "SQL/NoSQL/命令/SSTI/表达式注入与参数 fuzz 专项。当参数拼接查询、排序筛选、JSON 查询可控、模板渲染、命令执行点、搜索/导出/自动补全接口出现时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-injection", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-injection"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-logic-race", "name": "web-logic-race", "kind": "skill", "official": false, "desc": "业务逻辑与并发竞态专项。当出现支付/下单/退款/提现/优惠券/积分/库存/审批/会员/抽奖/邀请等业务功能，或状态可跳变、金额参数可控、可重放时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-logic-race", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-logic-race"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-waf-bypass", "name": "web-waf-bypass", "kind": "skill", "official": false, "desc": "WAF/过滤/检测绕过与失败升级专项。当 payload 被 403/拦截、需要多编码/变形/协议层绕过、或需要构造规避检测的制品时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-waf-bypass", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-waf-bypass"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/web-xss-frontend", "name": "web-xss-frontend", "kind": "skill", "official": false, "desc": "XSS（反射/存储/DOM/跳转型）/CSRF/Clickjacking/Markdown 渲染专项。当出现评论昵称富文本、搜索回显、跳转页、postMessage、前端 DOM 操作、AI 输出渲染时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/web-xss-frontend", "install": ["npx skills add zhaji2333/CkSKILLS --skill web-xss-frontend"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mar-antaya/my-claude-skills/dependency-auditor", "name": "dependency-auditor", "kind": "skill", "official": false, "desc": "Dependency Auditor", "repo": "https://github.com/mar-antaya/my-claude-skills/tree/HEAD/dependency-auditor", "install": ["npx skills add mar-antaya/my-claude-skills --skill dependency-auditor"], "stars": 151, "pushed": "2026-03-16T00:33:41Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mar-antaya/my-claude-skills/skill-security-auditor", "name": "skill-security-auditor", "kind": "skill", "official": false, "desc": "Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7", "repo": "https://github.com/mar-antaya/my-claude-skills/tree/HEAD/skill-security-auditor", "install": ["npx skills add mar-antaya/my-claude-skills --skill skill-security-auditor"], "stars": 151, "pushed": "2026-03-16T00:33:41Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:sazabi/cve.now", "name": "cve.now", "kind": "mcp", "official": null, "desc": "A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs and issues only.", "repo": "https://github.com/sazabi/cve.now", "install": [], "stars": 150, "pushed": null, "license": null, "plat": "cve", "live": "Not checked (runs locally)"}, {"id": "skill:selmakcby/claude-agents-skills/my-project-demo/.claude/skills/security-review", "name": "security-review", "kind": "skill", "official": false, "desc": "AI-powered security vulnerability detection. Use PROACTIVELY after writing code that handles user input, authentication, API endpoints, payments, or sensitive data. Flags OWASP Top 10 issues with diff-aware scanning.", "repo": "https://github.com/selmakcby/claude-agents-skills/tree/HEAD/my-project-demo/.claude/skills/security-review", "install": ["npx skills add selmakcby/claude-agents-skills --skill security-review"], "stars": 149, "pushed": "2026-04-21T16:50:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:aliyun/alibabacloud-ecs-troubleshoot-skills/skills/alibabacloud-ecs-sec-kernel", "name": "alibabacloud-ecs-sec-kernel", "kind": "skill", "official": false, "desc": "Linux 内核态 CVE 漏洞检测与 PoC 验证工具，专为 AI Agent 设计。 88 个内核 CVE 检测器（2003-2026），覆盖 Netfilter/eBPF/TLS/io_uring/xfrm 等子系统的本地提权（LPE）漏洞。 采用 CTF 挑战模式客观验证漏洞可利用性：nobody 用户通过内核漏洞写入/读取 root 文件即为提权成功。 PoC 二进制从源码动态编译（--compile-poc），无需预置二进制文件。需要 root 权限（sudo）运行。 与 sec-userspace（用户态入侵检测）互补，共同构成完整的 ECS 安全评估方案。 务必在检测内核漏洞时使用此技能。每当需要验证 CVE 或执行 PoC 验证时，优先调用此技能。 当用户提到内核安全、CVE 检测、漏洞利用验证、提权漏洞时，主动触发。", "repo": "https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skills/tree/HEAD/skills/alibabacloud-ecs-sec-kernel", "install": ["npx skills add aliyun/alibabacloud-ecs-troubleshoot-skills --skill alibabacloud-ecs-sec-kernel"], "stars": 147, "pushed": "2026-11-05T09:47:59Z", "license": "Apache-2.0", "plat": "alibaba cloud ecs", "live": "Not checked (runs locally)"}, {"id": "skill:aliyun/alibabacloud-ecs-troubleshoot-skills/skills/alibabacloud-ecs-sec-userspace", "name": "alibabacloud-ecs-sec-userspace", "kind": "skill", "official": false, "desc": "Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。 与 sec-kernel（内核态 CVE 漏洞检测）互补，共同构成完整的 ECS 安全评估方案。 当用户询问服务器安全、入侵检测、系统审计、恶意软件检测、安全事件响应时使用。 每当需要判断服务器是否被入侵、检查后门木马、分析安全事件时，优先使用此技能。 务必在发现安全异常时主动调用此技能，即使用户没有明确要求安全检查。", "repo": "https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skills/tree/HEAD/skills/alibabacloud-ecs-sec-userspace", "install": ["npx skills add aliyun/alibabacloud-ecs-troubleshoot-skills --skill alibabacloud-ecs-sec-userspace"], "stars": 147, "pushed": "2026-11-05T09:47:59Z", "license": "Apache-2.0", "plat": "alibaba cloud ecs", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Fazmin/cve-intel", "name": "cve-intel", "kind": "mcp", "official": null, "desc": "Local security intelligence for CVE triage and remediation, with built-in SBOM functionality. 46 data sources and 42 tools, risk scores, fix plans for what you run, and an MCP server for AI agents - all built in native Rust. Private by default.", "repo": "https://github.com/Fazmin/cve-intel", "install": [], "stars": 147, "pushed": null, "license": null, "plat": "cve-intel", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:kapilduraphe/mcp-watch", "name": "mcp-watch", "kind": "mcp", "official": null, "desc": "A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP server implementations.", "repo": "https://github.com/kapilduraphe/mcp-watch", "install": [], "stars": 140, "pushed": null, "license": null, "plat": "mcp server", "live": "Not checked (runs locally)"}, {"id": "skill:instructa/agent-skills/skills/security/package-security-check", "name": "package-security-check", "kind": "skill", "official": false, "desc": "Run a reusable JavaScript supply-chain security baseline with pnpm-first hardening, release-age gating, lifecycle-script controls, exotic dependency checks, CI install checks, and optional incident IOC profiles.", "repo": "https://github.com/instructa/agent-skills/tree/HEAD/skills/security/package-security-check", "install": ["npx skills add instructa/agent-skills --skill package-security-check"], "stars": 140, "pushed": "2026-11-06T17:20:07Z", "license": null, "plat": "javascript", "live": "Not checked (runs locally)"}, {"id": "skill:instructa/agent-skills/skills/security/secleak-check", "name": "secleak-check", "kind": "skill", "official": false, "desc": "Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks, or run secleak-check before release.", "repo": "https://github.com/instructa/agent-skills/tree/HEAD/skills/security/secleak-check", "install": ["npx skills add instructa/agent-skills --skill secleak-check"], "stars": 140, "pushed": "2026-11-06T17:20:07Z", "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:makalin/SecureMCP", "name": "SecureMCP", "kind": "mcp", "official": null, "desc": "SecureMCP is a security auditing tool designed to detect vulnerabilities and misconfigurations in applications using the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction). It proactively identifies threats like OAuth token leakage, prompt injection vulnerabilities, rogue M", "repo": "https://github.com/makalin/SecureMCP", "install": [], "stars": 140, "pushed": null, "license": null, "plat": "model context protocol", "live": "Not checked (runs locally)"}, {"id": "skill:sugarforever/01coder-agent-skills/skills/nextjs-security-scan", "name": "Next.js Security Scan", "kind": "skill", "official": false, "desc": "Comprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and Next.js-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.", "repo": "https://github.com/sugarforever/01coder-agent-skills/tree/HEAD/skills/nextjs-security-scan", "install": ["npx skills add sugarforever/01coder-agent-skills --skill Next.js Security Scan"], "stars": 139, "pushed": "2026-10-19T23:56:46Z", "license": "MIT", "plat": "next.js", "live": "Not checked (runs locally)"}, {"id": "skill:sugarforever/01coder-agent-skills/skills/python-security-scan", "name": "Python Security Scan", "kind": "skill", "official": false, "desc": "Comprehensive security vulnerability scanner for Python projects including Flask, Django, and FastAPI applications. Detects OWASP Top 10 vulnerabilities, injection flaws, insecure deserialization, authentication issues, hardcoded secrets, and framework-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.", "repo": "https://github.com/sugarforever/01coder-agent-skills/tree/HEAD/skills/python-security-scan", "install": ["npx skills add sugarforever/01coder-agent-skills --skill Python Security Scan"], "stars": 139, "pushed": "2026-10-19T23:56:46Z", "license": "MIT", "plat": "python", "live": "Not checked (runs locally)"}, {"id": "skill:goSprinto/compliance-skills/pii-detector", "name": "pii-detector", "kind": "skill", "official": false, "desc": "Proactive PII add-on — augments the main response with PII guidance. Auto-trigger on any form, schema, migration, model, API route, GraphQL resolver, auth flow, or data design discussion. Also fires on: middleware, webhooks, workers, seed/fixture/factory files, delete/export/purge/anonymize functions, cron jobs, HTTP clients, controllers, services, resolvers. Trigger phrases: \"build a form\", \"collect X data\", \"what fields should I include\", \"how should I design the schema\", \"POC / lead / contact", "repo": "https://github.com/goSprinto/compliance-skills/tree/HEAD/pii-detector", "install": ["npx skills add goSprinto/compliance-skills --skill pii-detector"], "stars": 134, "pushed": "2026-05-26T08:04:09Z", "license": "MIT", "plat": "pii", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:OWASP/www-project-mcp-top-10", "name": "www-project-mcp-top-10", "kind": "mcp", "official": null, "desc": "OWASP MCP Top10", "repo": "https://github.com/OWASP/www-project-mcp-top-10", "install": [], "stars": 133, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:jMerta/codex-skills/review-security-privacy", "name": "review-security-privacy", "kind": "skill", "official": false, "desc": "Use when the user asks for a pre-PR or diff security and privacy review, especially for authentication, authorization, tenant isolation, public endpoints, webhooks, payments, secrets, logs, personal data, files, exports, or observability access. Reports only reachable regressions introduced or materially changed by the diff.", "repo": "https://github.com/jMerta/codex-skills/tree/HEAD/review-security-privacy", "install": ["npx skills add jMerta/codex-skills --skill review-security-privacy"], "stars": 132, "pushed": "2026-08-18T12:07:12Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "skill:Git-FED/MuseAi-Skills-Guide/skills/privacy-boundary-review", "name": "privacy-boundary-review", "kind": "skill", "official": false, "desc": "Pause before actions that connect accounts, move data, or create external side effects.", "repo": "https://github.com/Git-FED/MuseAi-Skills-Guide/tree/HEAD/skills/privacy-boundary-review", "install": ["npx skills add Git-FED/MuseAi-Skills-Guide --skill privacy-boundary-review"], "stars": 127, "pushed": "2026-11-12T02:25:18Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sinewaveai/agent-security-scanner-mcp", "name": "io.github.sinewaveai/agent-security-scanner-mcp", "kind": "mcp", "official": null, "desc": "Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.", "repo": "https://github.com/sinewaveai/agent-security-scanner-mcp", "install": ["npm:agent-security-scanner-mcp"], "stars": 123, "pushed": "2026-10-18T02:41:04Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.arthurpanhku/dvalincode", "name": "io.github.arthurpanhku/dvalincode", "kind": "mcp", "official": null, "desc": "Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.", "repo": "https://github.com/arthurpanhku/dvalincode", "install": ["npm:dvalincode"], "stars": 120, "pushed": "2026-11-11T08:30:08Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Zacarx/JavaSinkTracer_MCP", "name": "JavaSinkTracer_MCP", "kind": "mcp", "official": null, "desc": "基于函数级污点分析的 Java 源代码漏洞审计工具JavaSinkTracer，通过 Model Context Protocol (MCP) 为 AI 助手提供安全分析能力。", "repo": "https://github.com/Zacarx/JavaSinkTracer_MCP", "install": [], "stars": 119, "pushed": null, "license": null, "plat": "java", "live": "Not checked (runs locally)"}, {"id": "skill:DarkNavySecurity/web3-skills/client-auditor", "name": "client-auditor", "kind": "skill", "official": false, "desc": "Use when auditing, reviewing, or finding vulnerabilities in a blockchain node, execution client, consensus client, or any Go/Rust/C++ codebase with P2P networking, consensus logic, RPC handlers, or bridge components.", "repo": "https://github.com/DarkNavySecurity/web3-skills/tree/HEAD/client-auditor", "install": ["npx skills add DarkNavySecurity/web3-skills --skill client-auditor"], "stars": 115, "pushed": "2026-07-21T11:47:17Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:DarkNavySecurity/web3-skills/contract-auditor", "name": "contract-auditor", "kind": "skill", "official": false, "desc": "Use when auditing Solidity contracts for security vulnerabilities. Trigger on \"audit\", \"check this contract\", \"review for security\", or \"/contract-auditor\".", "repo": "https://github.com/DarkNavySecurity/web3-skills/tree/HEAD/contract-auditor", "install": ["npx skills add DarkNavySecurity/web3-skills --skill contract-auditor"], "stars": 115, "pushed": "2026-07-21T11:47:17Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crafter-station/skills/skills/supply-chain-audit", "name": "supply-chain-audit", "kind": "skill", "official": false, "desc": "Read-only audit of a developer machine for npm/PyPI supply-chain compromise. Checks for known IOCs from the 2025-2026 wave — Shai-Hulud 2.0 (Nov 2025), Mini Shai-Hulud / TeamPCP (May 2026), Axios DPRK (Mar 2026), Shai-Hulud 3.0 / keyv-cacheable (Aug 2026), and any future campaigns added to the IOC pack. Scans persistence artifacts (LaunchAgent / systemd unit / Windows Run key / gh-token-monitor / .claude and .vscode droppers), payload files (router_init.js, setup_bun.js, bun_environment.js, Math", "repo": "https://github.com/crafter-station/skills/tree/HEAD/skills/supply-chain-audit", "install": ["npx skills add crafter-station/skills --skill supply-chain-audit"], "stars": 115, "pushed": "2026-09-07T23:16:56Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:SylphAI-Inc/adal-cli", "name": "adal-cli", "kind": "mcp", "official": null, "desc": "The automation-first agent harness. Every coding agent can build — AdaL does GTM directly from your codebase.", "repo": "https://github.com/SylphAI-Inc/adal-cli", "install": [], "stars": 111, "pushed": null, "license": null, "plat": "cve-search", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:UnitOneAI/SecuritySkills", "name": "SecuritySkills", "kind": "mcp", "official": null, "desc": "Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Codex CLI, OpenClaw, Kiro.", "repo": "https://github.com/UnitOneAI/SecuritySkills", "install": [], "stars": 110, "pushed": null, "license": null, "plat": "claude code, gemini cli, cursor, codex c", "live": "Not checked (runs locally)"}, {"id": "skill:starslingdev/skills/skills/ci-secure", "name": "ci-secure", "kind": "skill", "official": false, "desc": "Scans a repo's GitHub Actions workflows for the ten critical CI/CD attack vectors — template injection, fork code executed with privileges (pwn requests), cache poisoning, impostor action SHAs, secrets dumps, GITHUB_ENV hijack, write-token untrusted triggers, credentials in caches/artifacts, unverified remote code execution (curl|bash and mutable fetch-and-run), and dependency install scripts running in a job that holds secrets — reports every finding with a plain-English attacker scenario, plus", "repo": "https://github.com/starslingdev/skills/tree/HEAD/skills/ci-secure", "install": ["npx skills add starslingdev/skills --skill ci-secure"], "stars": 108, "pushed": "2026-11-14T05:35:56Z", "license": "MIT", "plat": "github actions", "live": "Not checked (runs locally)"}, {"id": "skill:starslingdev/skills/maintainers/skills-registry-security", "name": "skills-registry-security", "kind": "skill", "official": false, "desc": "Checks the third-party security audit status of a skill published to a skills registry (skills.sh) across every cached surface, decides whether a failing finding is real or points at content already removed, and drives a stale badge to green unattended. Runs a real install to capture what users see, reads the per-provider finding codes the JSON API omits, and greps each flagged literal against the repository and shipped tree; emits a next-action verdict, checks whether an install can even fire t", "repo": "https://github.com/starslingdev/skills/tree/HEAD/maintainers/skills-registry-security", "install": ["npx skills add starslingdev/skills --skill skills-registry-security"], "stars": 108, "pushed": "2026-11-14T05:35:56Z", "license": "MIT", "plat": "skills.sh", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:tenuo-ai/tenuo", "name": "tenuo", "kind": "mcp", "official": null, "desc": "Task-scoped authorization for AI agents. Cryptographic warrants constrain tools and arguments, prevent privilege escalation at every delegation hop, and produce signed evidence of what was allowed or denied.", "repo": "https://github.com/tenuo-ai/tenuo", "install": [], "stars": 107, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.danoszz/penthera", "name": "Penthera", "kind": "mcp", "official": null, "desc": "Offline, rule-based security checks for your repo, dependencies, AI agent config and local app.", "repo": "https://github.com/danoszz/penthera", "install": ["npm:penthera"], "stars": 106, "pushed": "2026-11-12T15:29:24Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:danoszz/penthera/plugin/skills/penthera", "name": "penthera", "kind": "skill", "official": false, "desc": "Offline cyber security agent for the user's own apps and AI coding tools, run locally with the Penthera CLI; open R&D, measured in public. Sets it up in one command (\"set up penthera in this repo\"). Scans the user's own live URL and repo (TLS, headers, auth, OpenAPI, secrets incl. AI keys, opt-in injection); checks npm and Python dependencies offline (\"is this dependency safe?\", \"what changed in my deps?\", \"install X safely\", \"any AGPL in our deps?\"); blocks secrets and risky agent config before", "repo": "https://github.com/danoszz/penthera/tree/HEAD/plugin/skills/penthera", "install": ["npx skills add danoszz/penthera --skill penthera"], "stars": 106, "pushed": "2026-11-12T15:29:24Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Sentinel-One/purple-mcp", "name": "purple-mcp", "kind": "mcp", "official": null, "desc": "Access SentinelOne's Purple AI and security services through the Model Context Protocol (MCP) - query alerts, vulnerabilities, misconfigurations, and inventory", "repo": "https://github.com/Sentinel-One/purple-mcp", "install": [], "stars": 104, "pushed": null, "license": null, "plat": "sentinelone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.svayatta/agent-custody", "name": "agent-custody", "kind": "mcp", "official": null, "desc": "MCP gateway that checks each agent tool call against a signed grant and policy, and signs a receipt", "repo": "https://github.com/svayatta/agent-custody", "install": ["npm:@agent-custody/receipts"], "stars": 103, "pushed": "2026-11-12T19:50:56Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:AsyrafHussin/agent-skills/skills/laravel-owasp-security", "name": "laravel-owasp-security", "kind": "skill", "official": false, "desc": "OWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities (\"run OWASP audit\", \"security review\", \"check my app security\") or writing secure Laravel code involving auth, payments, file uploads, or API design. Triggers on security-related tasks, payment handling, authentication, or any request to audit a Laravel codebase.", "repo": "https://github.com/AsyrafHussin/agent-skills/tree/HEAD/skills/laravel-owasp-security", "install": ["npx skills add AsyrafHussin/agent-skills --skill laravel-owasp-security"], "stars": 103, "pushed": "2026-08-27T12:29:22Z", "license": "MIT", "plat": "laravel", "live": "Not checked (runs locally)"}, {"id": "skill:resemble-ai/detect-skill", "name": "resemble-detect", "kind": "skill", "official": false, "desc": "Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, analyze media intelligence, and tell people from AI agents on a website (Agent Detection) using direct Resemble AI API calls", "repo": "https://github.com/resemble-ai/detect-skill", "install": ["npx skills add resemble-ai/detect-skill --skill resemble-detect"], "stars": 103, "pushed": "2026-09-23T22:30:31Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:DorianChn/shanchuanzhi-agent-canary", "name": "shanchuanzhi-agent-canary", "kind": "mcp", "official": null, "desc": "Agent Canary 3.0: open-source MCP, SDK, and CLI security toolkit with a guarded execution gateway, decoy signals, local tests, and public acceptance evidence.", "repo": "https://github.com/DorianChn/shanchuanzhi-agent-canary", "install": [], "stars": 103, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.xposedornot/xposedornot", "name": "XposedOrNot Breach Intelligence", "kind": "mcp", "official": null, "desc": "Real-time data-breach lookup and analytics for emails and domains from XposedOrNot.", "repo": "https://github.com/XposedOrNot/XposedOrNot-API", "install": ["https://api.xposedornot.com/mcp"], "stars": 102, "pushed": "2026-11-11T03:43:24Z", "license": "MIT", "plat": "emails", "live": "Live · 1999 ms · 6 tools · free to try: `get_recent_breaches` answered without a key (checked 2026-11-13)"}, {"id": "skill:spatie/guidelines-skills/resources/boost/skills/spatie-security", "name": "spatie-security", "kind": "skill", "official": false, "desc": "Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.", "repo": "https://github.com/spatie/guidelines-skills/tree/HEAD/resources/boost/skills/spatie-security", "install": ["npx skills add spatie/guidelines-skills --skill spatie-security"], "stars": 100, "pushed": "2026-10-22T15:01:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.26zl/cybersec-toolkit", "name": "io.github.26zl/cybersec-toolkit", "kind": "mcp", "official": null, "desc": "MCP server that catalogs 670+ security tools and runs installed ones under a scope and audit policy.", "repo": "https://github.com/26zl/cybersec-toolkit", "install": ["oci:ghcr.io/26zl/cybersec-toolkit:1.5.0"], "stars": 95, "pushed": "2026-11-12T19:04:09Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Pantheon-Security/notebooklm-mcp-secure", "name": "io.github.Pantheon-Security/notebooklm-mcp-secure", "kind": "mcp", "official": null, "desc": "Security-hardened NotebookLM MCP with post-quantum encryption", "repo": "https://github.com/Pantheon-Security/notebooklm-mcp-secure", "install": ["npm:@pan-sec/notebooklm-mcp"], "stars": 88, "pushed": "2026-09-03T06:15:38Z", "license": "MIT", "plat": "notebooklm", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.trustabl/agent-reliability-analyzer", "name": "Trustabl", "kind": "mcp", "official": null, "desc": "Find and fix reliability and safety gaps in agent code, across nine agent SDKs.", "repo": "https://github.com/trustabl/agent-reliability-analyzer", "install": ["oci:ghcr.io/trustabl/agent-reliability-analyzer:0.1.16"], "stars": 88, "pushed": "2026-11-12T15:29:01Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.execbro/execbro", "name": "ExecBro", "kind": "mcp", "official": null, "desc": "Catches what reading the code misses: AI agents check running React Native apps", "repo": "https://github.com/igorzheludkov/execbro", "install": ["npm:execbro"], "stars": 81, "pushed": "2026-11-10T13:26:21Z", "license": "NOASSERTION", "plat": "react native", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/abnormal-mcp", "name": "Abnormal Security MCP", "kind": "mcp", "official": null, "desc": "Abnormal Security email threats, cases, and reporting in your terminal and your AI agents.", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/abnormal-v0.1.13/abnormal-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "abnormal security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/dnsfilter-mcp", "name": "DNSFilter MCP", "kind": "mcp", "official": null, "desc": "DNSFilter for MSPs: why a site is blocked, preview-first allows, unblock requests, agent drift.", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/dnsfilter-v0.1.6/dnsfilter-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "dnsfilter", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/domain-cert-tracker-mcp", "name": "Domain and Certificate Tracker MCP", "kind": "mcp", "official": null, "desc": "Every client's domains and certificates in one inventory: what expires, unlocks or changes.", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/domain-cert-tracker-v0.1.4/domain-cert-tracker-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/eset-protect-mcp", "name": "ESET MCP", "kind": "mcp", "official": null, "desc": "Every ESET Connect endpoint, plus per-customer health, exposure and QBR reports from a local mirror", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/eset-protect-v0.1.5/eset-protect-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "eset", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/fortinet-mcp", "name": "Fortinet MCP", "kind": "mcp", "official": null, "desc": "Audit every client FortiGate for firmware, SSL-VPN exposure, admin accounts and license expiry.", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/fortinet-v0.1.10/fortinet-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "fortinet", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/huntress-mcp", "name": "Huntress MCP", "kind": "mcp", "official": null, "desc": "Every Huntress endpoint, plus a local SQLite mirror that delivers fleet-wide incident, coverage", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/huntress-v0.1.17/huntress-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "huntress", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/proofpoint-mcp", "name": "Proofpoint MCP", "kind": "mcp", "official": null, "desc": "Proofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/proofpoint-v0.1.11/proofpoint-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "proofpoint", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/runzero-mcp", "name": "runZero MCP", "kind": "mcp", "official": null, "desc": "Every runZero query, plus a local SQLite copy of your whole attack surface that diffs over time", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/runzero-v0.1.13/runzero-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "runzero", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/sentinelone-mcp", "name": "SentinelOne MCP", "kind": "mcp", "official": null, "desc": "Every SentinelOne v2.1 management endpoint, plus an offline SQLite store and cross-entity analytics", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/sentinelone-v0.2.10/sentinelone-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "sentinelone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/sonicwall-mcp", "name": "SonicWall MCP", "kind": "mcp", "official": null, "desc": "Cyber-insurance posture for a whole SonicWall fleet: firmware, advisories, MFA, SSL-VPN exposure", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/sonicwall-v0.1.9/sonicwall-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "sonicwall", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/sophos-central-mcp", "name": "Sophos Central MCP", "kind": "mcp", "official": null, "desc": "The Sophos Central partner, organization and tenant APIs, routed to the right tenant and region", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/sophos-central-v0.1.9/sophos-central-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "sophos central", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/threatdown-mcp", "name": "ThreatDown MCP", "kind": "mcp", "official": null, "desc": "Every ThreatDown OneView API, plus fleet-wide stale-endpoint, health and seat reports across all", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/threatdown-v0.1.9/threatdown-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "threatdown", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/threatlocker-mcp", "name": "ThreatLocker MCP", "kind": "mcp", "official": null, "desc": "Every ThreatLocker Portal API feature, plus the write operations the read-only tools lack and a", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/threatlocker-v0.3.17/threatlocker-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "threatlocker", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Servosity/watchguard-mcp", "name": "WatchGuard MCP", "kind": "mcp", "official": null, "desc": "WatchGuard Cloud Firebox, Endpoint Security, ThreatSync, NDR and AuthPoint APIs for every customer", "repo": "https://github.com/servosity/msp-skills", "install": ["mcpb:https://github.com/Servosity/msp-skills/releases/download/watchguard-v0.1.9/watchguard-mcp.mcpb"], "stars": 79, "pushed": "2026-11-12T12:02:14Z", "license": "NOASSERTION", "plat": "watchguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.gebalamariusz/cloud-audit", "name": "cloud-audit", "kind": "mcp", "official": null, "desc": "AWS security scanner with attack chain detection, IAM privilege escalation, and fixes", "repo": "https://github.com/gebalamariusz/cloud-audit", "install": ["pypi:cloud-audit"], "stars": 75, "pushed": "2026-10-14T16:51:25Z", "license": "MIT", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dtkmn/mcp-zap-server", "name": "MCP ZAP Server", "kind": "mcp", "official": null, "desc": "Safe, self-hosted ZAP operator for guided AI security scans and reports.", "repo": "https://github.com/dtkmn/mcp-zap-server", "install": ["oci:ghcr.io/dtkmn/mcp-zap-server:v0.17.1", "oci:docker.io/dtkmn/mcp-zap-server:v0.17.1"], "stars": 70, "pushed": "2026-11-13T01:54:21Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.offense-research/offense", "name": "Offense", "kind": "mcp", "official": null, "desc": "Security tools for coding agents: dependency advisory audits and evidence for remediation.", "repo": "https://github.com/offense-research/offense", "install": ["https://offense.sh/mcp"], "stars": 70, "pushed": "2026-11-04T20:07:45Z", "license": "Apache-2.0", "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.trustabl/agent-network-access-probe", "name": "Trustabl Probe", "kind": "mcp", "official": null, "desc": "Drafts a network allow list for agent tools and runs them in a network-blocked sandbox.", "repo": "https://github.com/trustabl/agent-network-access-probe", "install": ["npm:@trustabl/agent-network-access-probe", "mcpb:https://github.com/trustabl/agent-network-access-probe/releases/download/v0.5.0/trustabl-agent-network-access-probe-0.5.0.mcpb"], "stars": 65, "pushed": "2026-11-12T15:45:29Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/autotask-mcp", "name": "Autotask", "kind": "mcp", "official": null, "desc": "MCP server for Kaseya Autotask PSA — companies, tickets, projects, time entries, and more.", "repo": "https://github.com/WYRE-AI/autotask-mcp", "install": ["oci:ghcr.io/wyre-ai/autotask-mcp:v2.40.0"], "stars": 63, "pushed": "2026-11-12T16:59:45Z", "license": "Apache-2.0", "plat": "kaseya autotask psa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.snyk/mcp", "name": "io.snyk/mcp", "kind": "mcp", "official": null, "desc": "Easily find and fix security issues in your applications leveraging Snyk platform capabilities.", "repo": "https://github.com/snyk/studio-mcp", "install": ["npm:snyk"], "stars": 62, "pushed": "2026-11-04T17:40:35Z", "license": "Apache-2.0", "plat": "snyk", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Mapika/portview", "name": "portview", "kind": "mcp", "official": null, "desc": "See what's on your ports, the processes behind them, and diagnose conflicts and leaks.", "repo": "https://github.com/Mapika/portview", "install": ["cargo:portview"], "stars": 61, "pushed": "2026-11-09T09:15:19Z", "license": "MIT", "plat": "portview", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kastelldev/kastell", "name": "io.github.kastelldev/kastell", "kind": "mcp", "official": null, "desc": "Server security audit (413 checks), hardening, and fleet management across 4 cloud providers.", "repo": "https://github.com/kastelldev/kastell", "install": ["npm:kastell"], "stars": 59, "pushed": "2026-10-06T00:17:38Z", "license": "Apache-2.0", "plat": "kastell", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:zscaler", "name": "zscaler", "kind": "claude-plugin", "official": null, "desc": "Manage Zscaler cloud security platform including ZPA (private access), ZIA (internet access), ZDX (digital experience), ZCC (client connector), EASM (attack surface), and Z-Insights (analytics). Create and manage policies, troubleshoot connectivity, audit security configurations, and investigate incidents across the full Zscaler ecosystem.", "repo": "https://github.com/zscaler/zscaler-mcp-server.git", "install": ["claude plugin install zscaler@claude-plugins-official"], "stars": 55, "pushed": "2026-10-27T16:02:00Z", "license": "MIT", "plat": "zscaler", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Synvoya/codeinspectus", "name": "CodeInspectus", "kind": "mcp", "official": null, "desc": "Local-first MCP security scanner and CLI for AI-generated applications.", "repo": "https://github.com/Synvoya/codeinspectus", "install": ["npm:codeinspectus"], "stars": 51, "pushed": "2026-11-05T12:15:52Z", "license": "Apache-2.0", "plat": "codeinspectus", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ratomirjovanovic/pandaward", "name": "PandaWard", "kind": "mcp", "official": null, "desc": "Local, evidence-based application security assessment with an evidence ledger and retests.", "repo": "https://github.com/ratomirjovanovic/pandaward", "install": ["mcpb:https://github.com/ratomirjovanovic/pandaward/releases/download/v0.2.15/pandaward-mcp.mcpb"], "stars": 50, "pushed": "2026-11-11T20:33:48Z", "license": "AGPL-3.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Prismer-AI/signet-mcp-tools", "name": "Signet MCP Tools", "kind": "mcp", "official": null, "desc": "MCP server exposing Signet cryptographic signing, verification, and content hash tools over stdio.", "repo": "https://github.com/Prismer-AI/signet", "install": ["npm:@signet-auth/mcp-tools"], "stars": 40, "pushed": "2026-11-10T11:05:27Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.VirusTotal/virustotal-mcp", "name": "VirusTotal", "kind": "mcp", "official": null, "desc": "Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.", "repo": "https://github.com/VirusTotal/virustotal-mcp", "install": ["pypi:vt-mcp", "https://ai.virustotal.com/mcp"], "stars": 39, "pushed": "2026-11-04T06:37:19Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Copenhagen0x/solana-security-mcp", "name": "Solana Security Standard", "kind": "mcp", "official": null, "desc": "Scan Solana/Anchor code against the Solana Security Standard and serve the ruleset to MCP clients.", "repo": "https://github.com/Copenhagen0x/solana-security-standard", "install": ["npm:@jelleo/solana-security-mcp"], "stars": 38, "pushed": "2026-09-16T09:33:51Z", "license": "MIT", "plat": "solana", "live": "Not checked (runs locally)"}, {"id": "mcp:com.contrastcyber/api", "name": "ContrastAPI", "kind": "mcp", "official": null, "desc": "Monitor CVEs, packages, domains and IPs. CVE/EPSS/KEV, SBOM, DNS/TLS, IP lookups. No key, x402.", "repo": "https://github.com/UPinar/contrastapi", "install": ["https://api.contrastcyber.com/mcp/"], "stars": 37, "pushed": "2026-11-02T02:09:21Z", "license": "MIT", "plat": "", "live": "Live · 2459 ms · 55 tools · free to try: `asn_lookup` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.aks129/healthclaw-guardrails", "name": "io.github.aks129/healthclaw-guardrails", "kind": "mcp", "official": null, "desc": "Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation", "repo": "https://github.com/aks129/HealthClawGuardrails", "install": ["https://mcp-server-production-5112.up.railway.app/mcp"], "stars": 34, "pushed": "2026-11-13T01:24:48Z", "license": "MIT", "plat": "fhir", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.doublegate/cyberchef-mcp", "name": "io.github.doublegate/cyberchef-mcp", "kind": "mcp", "official": null, "desc": "CyberChef's 504 data-transformation operations as MCP tools: encryption, encoding, forensics.", "repo": "https://github.com/doublegate/CyberChef-MCP", "install": ["oci:ghcr.io/doublegate/cyberchef-mcp_v4:4.2.0", "npm:cyberchef-mcp"], "stars": 34, "pushed": "2026-11-13T00:28:49Z", "license": "GPL-3.0", "plat": "cyberchef", "live": "Not checked (runs locally)"}, {"id": "mcp:com.mcparmory/pagerduty", "name": "com.mcparmory/pagerduty", "kind": "mcp", "official": null, "desc": "Manage incidents, on-call schedules, escalation policies, and alert notifications", "repo": "https://github.com/mcparmory/registry", "install": ["pypi:mcparmory-pagerduty", "oci:ghcr.io/mcparmory/pagerduty:1.0.2"], "stars": 32, "pushed": "2026-05-12T12:55:57Z", "license": "NOASSERTION", "plat": "pagerduty", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:crowdsec", "name": "crowdsec", "kind": "claude-plugin", "official": null, "desc": "Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.", "repo": "https://github.com/crowdsecurity/crowdsec-skill.git", "install": ["claude plugin install crowdsec@claude-plugins-official"], "stars": 30, "pushed": "2026-10-28T08:46:10Z", "license": "MIT", "plat": "crowdsec", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.draugr/draugr", "name": "Draugr", "kind": "mcp", "official": null, "desc": "Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.", "repo": "https://github.com/draugr-dev/draugr", "install": ["mcpb:https://github.com/draugr-dev/draugr/releases/download/v0.178.0/draugr-0.178.0.mcpb"], "stars": 29, "pushed": "2026-11-13T06:39:45Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.aidongise-cell/prism-scanner", "name": "Prism Scanner", "kind": "mcp", "official": null, "desc": "Security scanner for AI Agent skills, plugins, and MCP servers with A-F grading.", "repo": "https://github.com/aidongise-cell/prism-scanner", "install": ["pypi:prism-scanner"], "stars": 28, "pushed": "2026-04-07T03:44:50Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.avivgerz-hue/vibe-shield", "name": "vibe-shield — security scanner for AI-generated code", "kind": "mcp", "official": null, "desc": "Scans AI-written code for leaked secrets, unguarded routes and missing RLS.", "repo": "https://github.com/avivgerz-hue/vibe-shield", "install": ["npm:@vibefoundry/vibe-shield"], "stars": 28, "pushed": "2026-11-12T15:42:07Z", "license": "MIT", "plat": "ai code", "live": "Not checked (runs locally)"}, {"id": "mcp:io.echelongraph/echelongraph-mcp", "name": "EchelonGraph CVE & Exposure", "kind": "mcp", "official": null, "desc": "CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.", "repo": "https://github.com/echelongraph/echelongraph-mcp", "install": ["npm:echelongraph-mcp", "https://mcp.echelongraph.io/mcp"], "stars": 21, "pushed": "2026-11-12T15:07:52Z", "license": "MIT", "plat": "cve & exposure", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mastyf-ai/mastyf.ai", "name": "io.github.mastyf-ai/mastyf.ai", "kind": "mcp", "official": null, "desc": "Runtime proxy for MCP security, cost governance & audit", "repo": "https://github.com/mastyf-ai/mastyf.ai", "install": ["npm:@mastyf_ai/server"], "stars": 21, "pushed": "2026-11-12T17:51:29Z", "license": "AGPL-3.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.IronSecCo/ironclaw", "name": "io.github.IronSecCo/ironclaw", "kind": "mcp", "official": null, "desc": "Sandboxed shell exec for MCP clients: run untrusted agent commands in a gVisor container.", "repo": "https://github.com/IronSecCo/ironclaw", "install": ["oci:ghcr.io/ironsecco/ironclaw-mcp:v0.1.569"], "stars": 20, "pushed": "2026-11-12T23:58:09Z", "license": "AGPL-3.0", "plat": "gvisor", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ai-guard-dev/ai-guard", "name": "AI Guard", "kind": "mcp", "official": null, "desc": "Guardrails for AI-written JS/TS: scans, weakened-test checks, package checks, verify before done.", "repo": "https://github.com/ai-guard-dev/eslint-plugin-ai-guard", "install": ["npm:eslint-plugin-ai-guard"], "stars": 19, "pushed": "2026-11-12T13:18:55Z", "license": "MIT", "plat": "ai-written js/ts", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stanfrbd/mcp-cyberbro", "name": "Cyberbro MCP Server", "kind": "mcp", "official": null, "desc": "MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.", "repo": "https://github.com/stanfrbd/mcp-cyberbro", "install": ["pypi:mcp-cyberbro"], "stars": 19, "pushed": "2026-10-18T16:10:33Z", "license": "MIT", "plat": "cyberbro", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AgentSafe-AI/tooltrust-scanner", "name": "ToolTrust Scanner", "kind": "mcp", "official": null, "desc": "Scans MCP servers for prompt injection, data exfiltration, and privilege escalation.", "repo": "https://github.com/AgentSafe-AI/tooltrust-scanner", "install": ["npm:tooltrust-mcp"], "stars": 19, "pushed": "2026-11-12T18:12:52Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vulncheck-oss/mcp", "name": "VulnCheck", "kind": "mcp", "official": null, "desc": "VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.", "repo": "https://github.com/vulncheck-oss/mcp", "install": ["oci:ghcr.io/vulncheck-oss/mcp:0.2.3"], "stars": 18, "pushed": "2026-11-11T21:14:03Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ninadphalak/chunk-invariance", "name": "chunk-invariance", "kind": "mcp", "official": null, "desc": "Checks whether your streaming redactor leaks a secret split across chunks; writes a pytest for it.", "repo": "https://github.com/ninadphalak/LLM-Shield-Proxy", "install": ["pypi:chunk-invariance"], "stars": 17, "pushed": "2026-11-13T01:55:27Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.poliakarmai/gsc-scanner", "name": "GSC Scanner", "kind": "mcp", "official": null, "desc": "Local security scanner for AI agents: SAST, SCA, secrets, IaC; verifies exploit and fix.", "repo": "https://github.com/poliakarmai/gsc", "install": ["oci:ghcr.io/poliakarmai/gsc-scanner:v1"], "stars": 17, "pushed": "2026-11-09T08:47:18Z", "license": "Apache-2.0", "plat": "gsc scanner", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.quantakrypto/pqc-tools", "name": "quantakrypto pqc-tools", "kind": "mcp", "official": null, "desc": "Scan code for quantum-vulnerable cryptography and get NIST post-quantum migration guidance.", "repo": "https://github.com/quantakrypto/pqc-tools", "install": ["npm:@quantakrypto/mcp", "https://mcp.quantakrypto.com/mcp"], "stars": 16, "pushed": "2026-10-14T17:55:48Z", "license": "Apache-2.0", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.skilltotal/skilltotal", "name": "SkillTotal", "kind": "mcp", "official": null, "desc": "Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.", "repo": "https://github.com/pezhik/skilltotal", "install": ["pypi:skilltotal"], "stars": 16, "pushed": "2026-11-11T20:58:18Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:stackhawk-api", "name": "stackhawk-api", "kind": "claude-plugin", "official": null, "desc": "Query the StackHawk platform API for security posture reporting, findings analysis, and app management. Guides agents through authentication, data retrieval, and result presentation.", "repo": "https://github.com/stackhawk/agent-skills.git", "install": ["claude plugin install stackhawk-api@claude-plugins-official"], "stars": 16, "pushed": "2026-11-11T15:34:39Z", "license": "MIT", "plat": "stackhawk", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:stackhawk-hawkscan", "name": "stackhawk-hawkscan", "kind": "claude-plugin", "official": null, "desc": "Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.", "repo": "https://github.com/stackhawk/agent-skills.git", "install": ["claude plugin install stackhawk-hawkscan@claude-plugins-official"], "stars": 16, "pushed": "2026-11-11T15:34:39Z", "license": "MIT", "plat": "stackhawk", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:aikido", "name": "aikido", "kind": "claude-plugin", "official": null, "desc": "Aikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.", "repo": "https://github.com/AikidoSec/aikido-claude-plugin.git", "install": ["claude plugin install aikido@claude-plugins-official"], "stars": 15, "pushed": "2026-11-05T16:03:26Z", "license": null, "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mindstone/mcp-server-servicenow", "name": "ServiceNow", "kind": "mcp", "official": null, "desc": "ServiceNow ITSM MCP server for Model Context Protocol hosts", "repo": "https://github.com/mindstone/mcp-servers", "install": ["npm:@mindstone/mcp-server-servicenow"], "stars": 14, "pushed": "2026-11-13T03:14:38Z", "license": "NOASSERTION", "plat": "servicenow", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mindstone/mcp-server-vanta", "name": "Vanta", "kind": "mcp", "official": null, "desc": "Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs", "repo": "https://github.com/mindstone/mcp-servers", "install": ["npm:@mindstone/mcp-server-vanta"], "stars": 14, "pushed": "2026-11-13T03:14:38Z", "license": "NOASSERTION", "plat": "vanta", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AperionAI/shield", "name": "Aperion Shield", "kind": "mcp", "official": null, "desc": "Local guardrail proxy that blocks destructive MCP tool calls, rug pulls, and tool poisoning", "repo": "https://github.com/AperionAI/shield", "install": ["oci:ghcr.io/aperionai/shield:shield-v1.0.1"], "stars": 13, "pushed": "2026-11-11T20:35:54Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/cipp-mcp", "name": "CIPP", "kind": "mcp", "official": null, "desc": "MCP server for CIPP — M365 multi-tenant management for MSPs (users, tenants, policies).", "repo": "https://github.com/WYRE-AI/cipp-mcp", "install": ["oci:ghcr.io/wyre-ai/cipp-mcp:v1.11.1"], "stars": 13, "pushed": "2026-11-12T16:55:44Z", "license": "NOASSERTION", "plat": "cipp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.starloghq/starlog", "name": "io.github.starloghq/starlog", "kind": "mcp", "official": null, "desc": "Vet a package (CVEs, license, maintenance) before your AI agent uses it, plus capability discovery.", "repo": "https://github.com/starloghq/index", "install": ["npm:starloghq"], "stars": 13, "pushed": "2026-10-01T22:05:05Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Varshavia/repomagpie", "name": "io.github.Varshavia/repomagpie", "kind": "mcp", "official": null, "desc": "Your agent checks your notes before installing and stops on packages you or your team ruled out.", "repo": "https://github.com/Varshavia/RepoMagpie", "install": ["npm:repomagpie"], "stars": 13, "pushed": "2026-11-13T07:52:08Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:net.lawyerd/takedown", "name": "net.lawyerd/takedown", "kind": "mcp", "official": null, "desc": "DMCA takedown & host reveal for AI agents: who hosts an infringing URL, even behind Cloudflare.", "repo": "https://github.com/lawyerd999/dmca-takedown-mcp", "install": ["https://mcp.lawyerd.net/takedown"], "stars": 13, "pushed": "2026-07-02T10:55:04Z", "license": "MIT", "plat": "", "live": "Live · 1670 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.bawbel/bawbel-scanner", "name": "Bawbel Scanner", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.", "repo": "https://github.com/bawbel/bawbel-scanner", "install": ["pypi:bawbel-scanner"], "stars": 12, "pushed": "2026-10-25T21:45:24Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.bawbel/scanner", "name": "Bawbel Scanner", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.", "repo": "https://github.com/bawbel/scanner", "install": ["pypi:bawbel-scanner"], "stars": 12, "pushed": "2026-10-25T21:45:24Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.hexamatic/pihole-mcp", "name": "Pi-hole MCP Server", "kind": "mcp", "official": null, "desc": "Manage Pi-hole v6: DNS blocking, domains, clients, query analysis, DHCP, and multi-instance sync.", "repo": "https://github.com/hexamatic/pihole-mcp", "install": ["oci:ghcr.io/hexamatic/pihole-mcp:0.10.0"], "stars": 12, "pushed": "2026-11-02T02:09:05Z", "license": "MIT", "plat": "pi-hole", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.adamsjack711-ux/pkgxray", "name": "pkgxray", "kind": "mcp", "official": null, "desc": "Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.", "repo": "https://github.com/adamsjack711-ux/pkgxray", "install": ["npm:pkgxray", "https://mcp.pkgxray.ca/mcp"], "stars": 12, "pushed": "2026-11-11T16:06:10Z", "license": "MIT", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "mcp:sh.clearfront/clearfront", "name": "sh.clearfront/clearfront", "kind": "mcp", "official": null, "desc": "OSINT sweep of a digital footprint: breaches, accounts, data brokers, domains and IPs", "repo": "https://github.com/scottmartinanderson/clearfront", "install": ["pypi:clearfront"], "stars": 12, "pushed": "2026-08-26T03:08:32Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.holistis/bug-bounty-intelligence-mcp", "name": "Bug Bounty Intelligence", "kind": "mcp", "official": null, "desc": "AI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.", "repo": "https://github.com/holistis/bug-bounty-intelligence-mcp", "install": ["https://wazir-x402.duckdns.org/api/bug-intel"], "stars": 11, "pushed": "2026-11-12T15:49:15Z", "license": "MIT", "plat": "solidity", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.Albasha0x0/corvus", "name": "Corvus", "kind": "mcp", "official": null, "desc": "Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.", "repo": "https://github.com/Albasha0x0/Corvus", "install": ["nuget:CorvusRE"], "stars": 11, "pushed": "2026-11-09T23:41:46Z", "license": "Apache-2.0", "plat": "net", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.adhit-r/fairmind", "name": "FairMind", "kind": "mcp", "official": null, "desc": "Release gate for AI systems from FairMind: evaluations, framework evidence and ledger snapshots.", "repo": "https://github.com/adhit-r/fairmind", "install": ["pypi:fairmind-mcp"], "stars": 11, "pushed": "2026-11-13T05:56:51Z", "license": "AGPL-3.0", "plat": "ai systems", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.andrasfe/vulnicheck", "name": "io.github.andrasfe/vulnicheck", "kind": "mcp", "official": null, "desc": "HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.", "repo": "https://github.com/andrasfe/vulnicheck", "install": ["oci:docker.io/andrasfe/vulnicheck:main"], "stars": 11, "pushed": "2026-02-22T14:45:13Z", "license": "MIT", "plat": "python", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.signerless/tolpo", "name": "tolpo", "kind": "mcp", "official": null, "desc": "Local-first control of TP-Link Tapo smart-home devices for AI agents", "repo": "https://github.com/signerless/tolpo", "install": ["npm:tolpo"], "stars": 11, "pushed": "2026-10-14T20:28:56Z", "license": "MIT", "plat": "tp-link tapo", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:ai-plugins", "name": "ai-plugins", "kind": "claude-plugin", "official": null, "desc": "Set up endorctl and use Endor Labs to scan, prioritize, and fix security risks across your software supply chain", "repo": "https://github.com/endorlabs/ai-plugins.git", "install": ["claude plugin install ai-plugins@claude-plugins-official"], "stars": 10, "pushed": "2026-11-10T16:25:29Z", "license": "MIT", "plat": "endor labs", "live": "Not checked (runs locally)"}, {"id": "mcp:com.royalplugins/royal-mcp", "name": "com.royalplugins/royal-mcp", "kind": "mcp", "official": null, "desc": "Security-first WordPress MCP server. 129 tools for Claude, ChatGPT, Gemini. Free on wp.org.", "repo": "https://github.com/royalplugins/royal-mcp", "install": ["https://demo.royalplugins.com/wp-json/royal-mcp/v1/mcp"], "stars": 10, "pushed": "2026-11-11T12:27:11Z", "license": "NOASSERTION", "plat": "wordpress", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.scopeblind/protect-mcp", "name": "com.scopeblind/protect-mcp", "kind": "mcp", "official": null, "desc": "Fail-closed Cedar policy gate + Ed25519 signed receipts for agent tool calls. Denies on any error.", "repo": "https://github.com/ScopeBlind/scopeblind-gateway", "install": ["npm:protect-mcp"], "stars": 10, "pushed": "2026-11-07T04:59:14Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.maximilianfeix/hexvero", "name": "hexvero", "kind": "mcp", "official": null, "desc": "Electron release diff for security review: what changed in IPC, contextBridge, windows and hosts.", "repo": "https://github.com/maximilianfeix/hexvero", "install": ["npm:hexvero"], "stars": 10, "pushed": "2026-11-13T00:08:31Z", "license": "MIT", "plat": "electron", "live": "Not checked (runs locally)"}, {"id": "mcp:com.stackhawk/stackhawk", "name": "com.stackhawk/stackhawk", "kind": "mcp", "official": null, "desc": "An MCP server that provides interaction with StackHawk's security scanning platform.", "repo": "https://github.com/stackhawk/stackhawk-mcp", "install": ["pypi:stackhawk-mcp"], "stars": 9, "pushed": "2026-10-09T16:21:02Z", "license": "NOASSERTION", "plat": "stackhawk", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.piiiico/proof-of-commitment", "name": "Commit — Supply Chain Risk Scoring", "kind": "mcp", "official": null, "desc": "Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.", "repo": "https://github.com/piiiico/proof-of-commitment", "install": ["npm:proof-of-commitment", "https://poc-backend.amdal-dev.workers.dev/mcp"], "stars": 9, "pushed": "2026-11-11T06:27:21Z", "license": "MIT", "plat": "npm, pypi, cargo, go", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:duende-skills", "name": "duende-skills", "kind": "claude-plugin", "official": null, "desc": "Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture", "repo": "https://github.com/DuendeSoftware/duende-skills.git", "install": ["claude plugin install duende-skills@claude-plugins-official"], "stars": 9, "pushed": "2026-10-16T12:29:33Z", "license": "NOASSERTION", "plat": "duende", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.imokokok/insight-oracle", "name": "Insight Pre-Trade Safety", "kind": "mcp", "official": null, "desc": "Decision-input integrity for onchain AI agents: verify oracle prices before signing a trade.", "repo": "https://github.com/imokokok/Insight", "install": ["npm:oracle-insight-mcp", "https://www.oracleinsight.xyz/api/mcp"], "stars": 9, "pushed": "2026-11-12T06:33:23Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.luiacuaniello/perspectivegraph", "name": "PerspectiveGraph", "kind": "mcp", "official": null, "desc": "Read-only attack-path tools: reachable routes to sensitive assets, and what a fix would cut.", "repo": "https://github.com/luiacuaniello/perspectivegraph", "install": ["oci:ghcr.io/luiacuaniello/perspectivegraph:v1.39.4"], "stars": 9, "pushed": "2026-11-10T22:24:37Z", "license": "Apache-2.0", "plat": "security", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.trent/trent", "name": "Trent", "kind": "mcp", "official": null, "desc": "Security reviews, threat models over a repo or website, and remediation tracking, in your editor.", "repo": "https://github.com/trnt-ai/trent-agent-plugin", "install": ["https://mcp.trent.ai/mcp", "https://mcp.eu.trent.ai/mcp"], "stars": 9, "pushed": "2026-11-02T23:11:41Z", "license": "MIT", "plat": "github", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.kushvinth/crowbar", "name": "crowbar", "kind": "mcp", "official": null, "desc": "Retrieve CVEs and index them inside your codebase. One SQLite+FTS5 index, one CLI, one MCP server.", "repo": "https://github.com/kushvinth/crowbar", "install": ["pypi:crowbar-cli"], "stars": 8, "pushed": "2026-11-11T05:46:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.azender1/safeagent", "name": "io.github.azender1/safeagent", "kind": "mcp", "official": null, "desc": "Exactly-once execution guard for AI agents. Prevents duplicate payments and webhooks on retry.", "repo": "https://github.com/azender1/SafeAgent", "install": ["pypi:safeagent-exec-guard"], "stars": 8, "pushed": "2026-10-07T02:34:09Z", "license": "Apache-2.0", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.tb0hdan/wass-mcp", "name": "io.github.tb0hdan/wass-mcp", "kind": "mcp", "official": null, "desc": "MCP server for web application security scanning", "repo": "https://github.com/tb0hdan/wass-mcp", "install": [], "stars": 8, "pushed": "2026-03-18T18:51:47Z", "license": "BSD-3-Clause", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.snyk/saw-mcp", "name": "Snyk API & Web MCP Server", "kind": "mcp", "official": null, "desc": "MCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage", "repo": "https://github.com/snyk/saw-mcp", "install": ["pypi:snyk-apiweb-mcp"], "stars": 8, "pushed": "2026-10-09T12:24:33Z", "license": "Apache-2.0", "plat": "snyk", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vulnersCom/vulners-mcp", "name": "io.github.vulnersCom/vulners-mcp", "kind": "mcp", "official": null, "desc": "MCP server for the Vulners.com API", "repo": "https://github.com/vulnersCom/vulners-mcp", "install": ["pypi:vulners-mcp", "oci:ghcr.io/vulnerscom/vulners-mcp:1.15.1", "https://mcp.vulners.com/mcp"], "stars": 7, "pushed": "2026-10-22T16:50:10Z", "license": null, "plat": "vulners.com", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.yamaru-eu/hardware-probe", "name": "io.github.yamaru-eu/hardware-probe", "kind": "mcp", "official": null, "desc": "Hardware probe for performance diagnostics, thermal monitoring, and LLM optimization.", "repo": "https://github.com/yamaru-eu/hardware-probe", "install": ["npm:@yamaru-eu/hardware-probe"], "stars": 7, "pushed": "2026-07-16T00:10:55Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vaquarkhan/mcp-bastion", "name": "MCP-Bastion", "kind": "mcp", "official": null, "desc": "Security middleware for MCP. Blocks prompt injection, PII leakage, and resource exhaustion.", "repo": "https://github.com/vaquarkhan/MCP-Bastion", "install": ["pypi:mcp-bastion-python"], "stars": 7, "pushed": "2026-11-12T15:05:30Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:pagerduty", "name": "pagerduty", "kind": "claude-plugin", "official": null, "desc": "Enhance code quality and security through PagerDuty risk scoring and incident correlation. Score pre-commit diffs against historical incident data and surface deployment risk before you ship.", "repo": "https://github.com/PagerDuty/claude-code-plugins.git", "install": ["claude plugin install pagerduty@claude-plugins-official"], "stars": 7, "pushed": "2026-10-30T15:47:52Z", "license": "Apache-2.0", "plat": "pagerduty", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Ezed9/mcp-bouncer", "name": "Bouncer", "kind": "mcp", "official": null, "desc": "Stdio MCP proxy that denies agent sends to destinations first seen in untrusted tool output.", "repo": "https://github.com/Ezed9/mcp-bouncer", "install": ["pypi:bouncer-mcp"], "stars": 6, "pushed": "2026-11-12T08:27:31Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.martc03/cybersecurity-vuln", "name": "Cybersecurity Vulnerability Intel", "kind": "mcp", "official": null, "desc": "CVE lookup via NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK. 7 tools.", "repo": "https://github.com/martc03/gov-mcp-servers", "install": ["https://cybersecurity-vuln-mcp.apify.actor/mcp"], "stars": 6, "pushed": "2026-04-06T07:06:08Z", "license": "MIT", "plat": "nist nvd", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.husk-security/husk", "name": "Husk", "kind": "mcp", "official": null, "desc": "Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs", "repo": "https://github.com/husk-security/husk", "install": ["npm:husk-sec", "cargo:husk-sec"], "stars": 6, "pushed": "2026-11-09T11:56:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.goklab/guardvibe", "name": "io.github.goklab/guardvibe", "kind": "mcp", "official": null, "desc": "Deterministic security layer your AI can't be. 670 rules, 39 tools, CLI + doctor + host audit.", "repo": "https://github.com/goklab/guardvibe", "install": ["npm:guardvibe"], "stars": 6, "pushed": "2026-11-12T06:17:08Z", "license": "Apache-2.0", "plat": "guardvibe", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.maciekaz/eset-mcp", "name": "io.github.maciekaz/eset-mcp", "kind": "mcp", "official": null, "desc": "MCP server for the ESET ecosystem - Connect cloud + PROTECT On-Prem, multi-tenant, RO/RW", "repo": "https://github.com/maciekaz/ESET-MCP", "install": ["oci:ghcr.io/maciekaz/eset-mcp:2.0.0"], "stars": 6, "pushed": "2026-11-04T10:08:44Z", "license": "MIT", "plat": "eset", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.SilentMesh-Systems/Lure", "name": "io.github.SilentMesh-Systems/Lure", "kind": "mcp", "official": null, "desc": "Plant fake credentials and get alerted when an attacker uses one. Stdlib-only, no passwords out.", "repo": "https://github.com/SilentMesh-Systems/Lure", "install": ["pypi:silentmesh-lure"], "stars": 6, "pushed": "2026-11-11T11:37:42Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/proofpoint-mcp", "name": "Proofpoint", "kind": "mcp", "official": null, "desc": "MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.", "repo": "https://github.com/wyre-technology/proofpoint-mcp", "install": ["oci:ghcr.io/wyre-technology/proofpoint-mcp:v1.1.4"], "stars": 6, "pushed": "2026-11-12T16:54:37Z", "license": "Apache-2.0", "plat": "proofpoint", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.YawLabs/ssh-mcp", "name": "SSH MCP Server", "kind": "mcp", "official": null, "desc": "MCP server for SSH operations with built-in diagnostics", "repo": "https://github.com/YawLabs/ssh-mcp", "install": ["npm:@yawlabs/ssh-mcp"], "stars": 6, "pushed": "2026-11-12T03:42:27Z", "license": "MIT", "plat": "ssh", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.stackurity/stackurity", "name": "Stackurity", "kind": "mcp", "official": null, "desc": "Installed software, vulnerabilities and end-of-life components across your servers, apps and repos", "repo": "https://github.com/stackurity/stackurity", "install": ["https://app.stackurity.dev/mcp"], "stars": 6, "pushed": "2026-11-13T07:52:41Z", "license": "Apache-2.0", "plat": "stackurity", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.martc03/us-safety-recalls", "name": "US Safety Recalls", "kind": "mcp", "official": null, "desc": "NHTSA vehicle recalls and FDA food/drug recalls. 4 tools.", "repo": "https://github.com/martc03/gov-mcp-servers", "install": ["https://us-safety-recalls-mcp.apify.actor/mcp"], "stars": 6, "pushed": "2026-04-06T07:06:08Z", "license": "MIT", "plat": "nhtsa", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "plugin:anthropics/claude-plugins-official:vanta", "name": "vanta", "kind": "claude-plugin", "official": null, "desc": "The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with your local repository context to help you fix compliance failures faster.", "repo": "https://github.com/VantaInc/vanta-mcp-plugin.git", "install": ["claude plugin install vanta@claude-plugins-official"], "stars": 6, "pushed": "2026-05-13T14:06:23Z", "license": "MIT", "plat": "vanta", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:vanta-mcp-plugin", "name": "vanta-mcp-plugin", "kind": "claude-plugin", "official": null, "desc": "The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with your local repository context to help you fix compliance failures faster.", "repo": "https://github.com/VantaInc/vanta-mcp-plugin.git", "install": ["claude plugin install vanta-mcp-plugin@claude-plugins-official"], "stars": 6, "pushed": "2026-05-13T14:06:23Z", "license": "MIT", "plat": "vanta", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.apiiro/guardian-agent", "name": "Apiiro Guardian Agent", "kind": "mcp", "official": null, "desc": "Apiiro Application Security Posture Management (ASPM) tools for AI coding assistants.", "repo": "https://github.com/apiiro/mcp-server", "install": ["https://mcp.apiiro.com/mcp"], "stars": 5, "pushed": "2026-10-25T12:21:22Z", "license": "Apache-2.0", "plat": "ai coding assistants", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.bountyoperator/bounty-operator", "name": "Bounty Operator", "kind": "mcp", "official": null, "desc": "Argues against a security finding or a draft bug bounty report before you submit it.", "repo": "https://github.com/bountyoperator/bounty-operator", "install": ["https://bountyoperator.com/api/mcp"], "stars": 5, "pushed": "2026-11-12T23:51:15Z", "license": "MIT", "plat": "", "live": "Live · 1690 ms · 5 tools · free to try: `list_profiles` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.aiscihub/cookieguard", "name": "CookieGuard", "kind": "mcp", "official": null, "desc": "Audit HTTP cookie security against your local policy. Returns findings without cookie values.", "repo": "https://github.com/aiscihub/cookieguard-ai", "install": ["npm:@aiscihub/cookieguard-mcp"], "stars": 5, "pushed": "2026-11-08T03:36:56Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.seanebones-lang/deadbolt", "name": "DeadBolt by NextEleven", "kind": "mcp", "official": null, "desc": "Local execution gate: fixed deadlines, operator-only controls, read-only setup and readable denials.", "repo": "https://github.com/seanebones-lang/deadbolt", "install": ["mcpb:https://github.com/seanebones-lang/deadbolt/releases/download/mcpb-v2.0.2/deadbolt-2.0.2.mcpb"], "stars": 5, "pushed": "2026-11-12T22:21:59Z", "license": "Apache-2.0", "plat": "deadbolt", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.twayst0/fsv", "name": "FSV — website security scanner", "kind": "mcp", "official": null, "desc": "Scan your own website for vulnerabilities: DNS takeover, compromised CDNs, debug mode and more.", "repo": "https://github.com/twayst0/fsv", "install": ["pypi:fsv"], "stars": 5, "pushed": "2026-11-01T05:26:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.gl1tchbased-pixel/gl1tch", "name": "GL1TCH Token Safety", "kind": "mcp", "official": null, "desc": "Token rug-risk scans, Know Your Agent wallet checks and deployer reputation for AI agents.", "repo": "https://github.com/gl1tchbased-pixel/gl1tch-coin", "install": ["https://gl1tchbased.xyz/api/mcp"], "stars": 5, "pushed": "2026-11-12T09:32:08Z", "license": "MIT", "plat": "gl1tch", "live": "Live · 1076 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.eltociear/skill-audit-mcp", "name": "io.github.eltociear/skill-audit-mcp", "kind": "mcp", "official": null, "desc": "MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.", "repo": "https://github.com/eltociear/skill-audit-mcp", "install": ["oci:ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0", "https://eltociear-skill-audit.hf.space/mcp"], "stars": 5, "pushed": "2026-09-30T04:21:59Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jonnybottles/patch-tuesday", "name": "io.github.jonnybottles/patch-tuesday", "kind": "mcp", "official": null, "desc": "Query Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment", "repo": "https://github.com/jonnybottles/patch-tuesday-mcp", "install": ["pypi:patch-tuesday-mcp", "https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp"], "stars": 5, "pushed": "2026-10-14T13:20:15Z", "license": null, "plat": "microsoft", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.firatmio/mcp-audit-proxy", "name": "mcp-audit", "kind": "mcp", "official": null, "desc": "Transparent audit proxy for MCP servers: logs every tool call, flags poisoning and rug pulls.", "repo": "https://github.com/firatmio/mcp-audit-proxy", "install": ["npm:mcp-audit-proxy"], "stars": 5, "pushed": "2026-10-23T17:23:12Z", "license": "Apache-2.0", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.behrensd/mcpwall", "name": "mcpwall", "kind": "mcp", "official": null, "desc": "iptables for MCP — blocks dangerous tool calls, scans for secrets, logs everything.", "repo": "https://github.com/behrensd/mcp-firewall", "install": ["npm:mcpwall"], "stars": 5, "pushed": "2026-09-19T17:59:12Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mwieczorkiewicz/opcua-mcp", "name": "OPC-UA MCP Server", "kind": "mcp", "official": null, "desc": "Read, write, browse, search, and subscribe to live data on an OPC-UA industrial automation server.", "repo": "https://github.com/mwieczorkiewicz/opcua-mcp", "install": ["oci:ghcr.io/mwieczorkiewicz/opcua-mcp:main-29734c4"], "stars": 5, "pushed": "2026-10-28T15:56:31Z", "license": "MIT", "plat": "opc-ua", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shyshlakov/pci-dss-mcp", "name": "PCI DSS v4.0.1 Compliance Checker", "kind": "mcp", "official": null, "desc": "PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server", "repo": "https://github.com/shyshlakov/pci-dss-mcp", "install": ["oci:ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1"], "stars": 5, "pushed": "2026-11-09T00:45:26Z", "license": "MIT", "plat": "pci dss", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.blisspixel/recon", "name": "recon", "kind": "mcp", "official": null, "desc": "Public DNS, certificate transparency, and identity observations.", "repo": "https://github.com/blisspixel/recon", "install": ["pypi:recon-tool"], "stars": 5, "pushed": "2026-11-03T21:36:47Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pueo-labs/recon", "name": "recon", "kind": "mcp", "official": null, "desc": "Public DNS, certificate transparency, and identity observations.", "repo": "https://github.com/pueo-labs/recon", "install": ["pypi:recon-tool"], "stars": 5, "pushed": "2026-11-03T21:36:47Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/action1-mcp", "name": "Action1", "kind": "mcp", "official": null, "desc": "Action1 MCP server — endpoint inventory, patch visibility, and policy automation via REST API.", "repo": "https://github.com/WYRE-AI/action1-mcp", "install": ["oci:ghcr.io/wyre-ai/action1-mcp:v1.1.9"], "stars": 4, "pushed": "2026-11-12T16:49:13Z", "license": "Apache-2.0", "plat": "action1", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.drupadsachania/aegis-skills", "name": "Aegis Security Skills", "kind": "mcp", "official": null, "desc": "Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.", "repo": "https://github.com/drupadsachania/aegis-skills", "install": ["npm:aegis-skills", "https://aegis-skills.vercel.app/api/mcp"], "stars": 4, "pushed": "2026-10-15T09:47:40Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.garagon/aguara-mcp", "name": "Aguara MCP", "kind": "mcp", "official": null, "desc": "Security scanner for AI agent skills and MCP servers", "repo": "https://github.com/garagon/aguara-mcp", "install": ["mcpb:https://github.com/garagon/aguara-mcp/releases/download/v0.2.0/aguara-mcp.mcpb"], "stars": 4, "pushed": "2026-11-01T23:17:53Z", "license": "MIT", "plat": "ai agent", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.garagon/mcp-aguara", "name": "Aguara MCP", "kind": "mcp", "official": null, "desc": "Scan skills, MCP configs, and agent content for injection and supply-chain risks. Offline, no LLM.", "repo": "https://github.com/garagon/mcp-aguara", "install": ["oci:ghcr.io/garagon/mcp-aguara:0.8.0"], "stars": 4, "pushed": "2026-11-01T23:17:53Z", "license": "MIT", "plat": "ai agent", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.subodhkc/ai-appsec", "name": "AI AppSec", "kind": "mcp", "official": null, "desc": "Evidence-backed AppSec for AI applications and agents. Powered by HAIEC.", "repo": "https://github.com/subodhkc/ai-appsec", "install": ["npm:ai-appsec"], "stars": 4, "pushed": "2026-11-03T17:07:25Z", "license": "MIT", "plat": "ai appsec", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Buggy1111/anonymize-mcp", "name": "Czech PII Anonymizer & NLP", "kind": "mcp", "official": null, "desc": "Anonymize PII & redact text (GDPR): Czech + 35-lang NER, morphology, translation, spellcheck", "repo": "https://github.com/Buggy1111/anonymize-mcp", "install": ["pypi:anonymize-mcp"], "stars": 4, "pushed": "2026-08-11T17:21:26Z", "license": "NOASSERTION", "plat": "czech", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wefi-ai/ekyc-suite", "name": "eKYC Suite", "kind": "mcp", "official": null, "desc": "KYC / eKYC MCP server for face compare, liveness, OCR, and image labeling.", "repo": "https://github.com/wefi-ai/eKYC-suite", "install": ["npm:@wefi-ai/ekyc-suite-mcp"], "stars": 4, "pushed": "2026-07-21T07:02:34Z", "license": "MIT", "plat": "ekyc", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.fingerprintjs/fingerprint-mcp-server", "name": "Fingerprint", "kind": "mcp", "official": null, "desc": "Device intelligence for AI agents: Fingerprint events, smart signals, and API key management.", "repo": "https://github.com/fingerprintjs/fingerprint-mcp-server", "install": ["https://mcp.fpjs.io/mcp"], "stars": 4, "pushed": "2026-11-10T10:27:54Z", "license": "MIT", "plat": "device intelligence", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.hxckya/pkgtruth", "name": "io.github.hxckya/pkgtruth", "kind": "mcp", "official": null, "desc": "Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.", "repo": "https://github.com/hxckya/pkgtruth", "install": ["npm:pkgtruth"], "stars": 4, "pushed": "2026-11-09T11:16:10Z", "license": "MIT", "plat": "npm/pypi", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kuzivaai/regula", "name": "io.github.kuzivaai/regula", "kind": "mcp", "official": null, "desc": "Offline AI governance code indicators (EU AI Act, Korea, Colorado). Indication, not legal advice.", "repo": "https://github.com/kuzivaai/getregula", "install": ["pypi:regula-ai"], "stars": 4, "pushed": "2026-11-09T10:35:26Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.VamsiSudhakaran1/release-gate", "name": "io.github.VamsiSudhakaran1/release-gate", "kind": "mcp", "official": null, "desc": "Pre-deploy security auditor for AI agent code — the risks generic SAST misses.", "repo": "https://github.com/VamsiSudhakaran1/release-gate", "install": ["pypi:release-gate"], "stars": 4, "pushed": "2026-10-12T03:57:21Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pierre3/zap-mcp", "name": "OWASP ZAP MCP Server", "kind": "mcp", "official": null, "desc": "MCP server for OWASP ZAP vulnerability scanning with Docker management", "repo": "https://github.com/pierre3/dotnet-zap-mcp", "install": ["nuget:dotnet-zap-mcp"], "stars": 4, "pushed": "2026-03-31T06:02:49Z", "license": "MIT", "plat": "owasp zap", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Skyrxin/sast-mcp-server", "name": "SAST MCP Server", "kind": "mcp", "official": null, "desc": "11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations", "repo": "https://github.com/Skyrxin/sast-mcp-server", "install": ["pypi:sast-mcp-server"], "stars": 4, "pushed": "2026-06-29T14:08:19Z", "license": "MIT", "plat": "sast", "live": "Not checked (runs locally)"}, {"id": "mcp:io.kondux/seraph", "name": "Seraph", "kind": "mcp", "official": null, "desc": "Crypto transaction firewall and risk tools for MCP agents.", "repo": "https://github.com/Kondux/seraph-mcp-public", "install": ["https://seraph.kondux.io/mcp"], "stars": 4, "pushed": "2026-07-09T19:02:23Z", "license": "MIT", "plat": "crypto", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.vmware-skills/vmware-harden", "name": "VMware Harden", "kind": "mcp", "official": null, "desc": "VMware compliance scanning (CIS, vSphere SCG, GB/T 22239, PCI-DSS) with drift detection.", "repo": "https://github.com/vmware-skills/VMware-Harden", "install": ["pypi:vmware-harden"], "stars": 4, "pushed": "2026-11-13T03:28:03Z", "license": "MIT", "plat": "vmware", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vmware-skills/vmware-nsx-security", "name": "VMware NSX Security", "kind": "mcp", "official": null, "desc": "VMware NSX security: DFW policies and exclusions, groups, tags, Traceflow, IDPS — 22 MCP tools.", "repo": "https://github.com/vmware-skills/VMware-NSX-Security", "install": ["pypi:vmware-nsx-security"], "stars": 4, "pushed": "2026-11-13T03:28:48Z", "license": null, "plat": "vmware", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ako2345/android-security-analyzer", "name": "Android Security Analyzer", "kind": "mcp", "official": null, "desc": "MCP server for static security analysis of Android source code", "repo": "https://github.com/ako2345/android-security-analyzer", "install": ["https://android-security-analyzer.ako-labs.workers.dev/mcp"], "stars": 3, "pushed": "2026-03-14T22:06:00Z", "license": null, "plat": "android source code", "live": "Live · 1356 ms · 4 tools · free to try: `health` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Defenter-AI/defenter-proxy", "name": "Defenter Proxy", "kind": "mcp", "official": null, "desc": "Real-time semantic security for AI coding agents and MCP tools", "repo": "https://github.com/Defenter-AI/defenter-proxy", "install": ["pypi:defenter-proxy"], "stars": 3, "pushed": "2025-12-22T12:32:39Z", "license": "Apache-2.0", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.koda-ai-studio/grc-lake", "name": "GRC Lake", "kind": "mcp", "official": null, "desc": "Read-only connectors; local writes. Evidence and assessments for agents. Only people approve.", "repo": "https://github.com/koda-ai-studio/grc-lake", "install": ["pypi:grc-lake"], "stars": 3, "pushed": "2026-11-12T17:31:19Z", "license": "Apache-2.0", "plat": "grc lake", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Guard-Core/guard-core-mcp", "name": "Guard Core", "kind": "mcp", "official": null, "desc": "Guard Core security MCP: SecurityConfig validation, docs search, live threat detection.", "repo": "https://github.com/Guard-Core/guard-core-mcp", "install": ["pypi:guard-core-mcp"], "stars": 3, "pushed": "2026-11-09T04:01:25Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Aitejiu/jev", "name": "io.github.Aitejiu/jev", "kind": "mcp", "official": null, "desc": "Jev judgments for agents: injection scanning, shell risk gating, ranking", "repo": "https://github.com/Aitejiu/jev-harness-lab", "install": ["pypi:jev-mcp"], "stars": 3, "pushed": "2026-09-21T08:00:57Z", "license": null, "plat": "jev", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.calllint/calllint", "name": "io.github.calllint/calllint", "kind": "mcp", "official": null, "desc": "Static preflight safety gate for MCP servers — scan configs before you run them. Never executes.", "repo": "https://github.com/calllint/calllint", "install": ["npm:calllint-mcp"], "stars": 3, "pushed": "2026-11-09T16:15:03Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.inkog-io/inkog", "name": "io.github.inkog-io/inkog", "kind": "mcp", "official": null, "desc": "Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.", "repo": "https://github.com/inkog-io/inkog-mcp", "install": ["npm:@inkog-io/mcp"], "stars": 3, "pushed": "2026-09-16T09:53:51Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.KryptosAI/mcp-seatbelt", "name": "io.github.KryptosAI/mcp-seatbelt", "kind": "mcp", "official": null, "desc": "MCP runtime security proxy. Blocks dangerous AI agent tool calls with a policy engine.", "repo": "https://github.com/KryptosAI/mcp-seatbelt", "install": ["npm:@kryptosai/mcp-seatbelt"], "stars": 3, "pushed": "2026-08-04T03:25:35Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Mickdownunder/safeinstall", "name": "io.github.Mickdownunder/safeinstall", "kind": "mcp", "official": null, "desc": "Local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks", "repo": "https://github.com/Mickdownunder/SafeInstall", "install": ["npm:safeinstall-cli"], "stars": 3, "pushed": "2026-10-08T09:46:31Z", "license": "MIT", "plat": "npm/pnpm/bun", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sF1nX/x402station", "name": "io.github.sF1nX/x402station", "kind": "mcp", "official": null, "desc": "x402station.io: independent risk-signal layer for x402 endpoints before agents pay.", "repo": "https://github.com/sF1nX/x402station-mcp", "install": ["npm:x402station-mcp"], "stars": 3, "pushed": "2026-06-02T05:51:47Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shotwellj/air-blackbox", "name": "io.github.shotwellj/air-blackbox", "kind": "mcp", "official": null, "desc": "EU AI Act compliance scanner for Python AI agents — scan, analyze, and remediate", "repo": "https://github.com/airblackbox/air-blackbox-mcp", "install": ["pypi:air-blackbox-mcp"], "stars": 3, "pushed": "2026-10-15T19:32:02Z", "license": "Apache-2.0", "plat": "python ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sparkvibe-io/GuardianShield", "name": "io.github.sparkvibe-io/GuardianShield", "kind": "mcp", "official": null, "desc": "AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs", "repo": "https://github.com/sparkvibe-io/GuardianShield", "install": ["pypi:guardianshield"], "stars": 3, "pushed": "2026-03-03T04:02:02Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ai-mcpower/mcpower-proxy", "name": "MCPower Security Proxy", "kind": "mcp", "official": null, "desc": "Security proxy that wraps MCP servers with real-time monitoring and policy enforcement", "repo": "https://github.com/MCPower-Security/mcpower-proxy", "install": ["pypi:mcpower-proxy"], "stars": 3, "pushed": "2025-12-22T12:32:39Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:nightvision", "name": "nightvision", "kind": "claude-plugin", "official": null, "desc": "Skills for working with NightVision, a DAST and API Discovery platform that finds exploitable vulnerabilities in web applications and REST APIs", "repo": "https://github.com/nvsecurity/nightvision-skills.git", "install": ["claude plugin install nightvision@claude-plugins-official"], "stars": 3, "pushed": "2026-11-12T17:33:46Z", "license": "Apache-2.0", "plat": "nightvision", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.POSIdev-community/ptai-mcp", "name": "PT Application Inspector MCP", "kind": "mcp", "official": null, "desc": "Standalone launcher and agent integration for the PT Application Inspector MCP proxy.", "repo": "https://github.com/POSIdev-community/ptai-mcp", "install": ["npm:@posidev-community/ptai-mcp"], "stars": 3, "pushed": "2026-10-20T11:37:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:eu.quantumreadiness/qrp-mcp", "name": "Quantum Readiness Scan", "kind": "mcp", "official": null, "desc": "Local crypto inventory for developers and AI agents; coverage and limits inside the CBOM.", "repo": "https://github.com/StanimirTenev/qrp-mcp", "install": ["pypi:qrp-mcp"], "stars": 3, "pushed": "2026-11-10T05:31:57Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mechubsec/rustjunosmcp", "name": "rust-junosmcp", "kind": "mcp", "official": null, "desc": "Juniper Junos/SRX MCP server: scoped, audited, two-person change control. Rust.", "repo": "https://github.com/mechubsec/rustjunosmcp", "install": ["oci:ghcr.io/mechubsec/rustjunosmcp:2.7.5"], "stars": 3, "pushed": "2026-11-12T17:29:35Z", "license": "MIT", "plat": "juniper junos/srx", "live": "Not checked (runs locally)"}, {"id": "mcp:com.tlsradar/tlsradar", "name": "TLS Radar", "kind": "mcp", "official": null, "desc": "SSL/TLS scanning, free Let's Encrypt issuance, and certificate-expiry monitoring.", "repo": "https://github.com/TLS-Radar/tlsradar-claude-plugin", "install": ["https://tlsradar.com/api/v1/mcp"], "stars": 3, "pushed": "2026-09-13T18:43:42Z", "license": "MIT", "plat": "", "live": "Live · 1003 ms · 16 tools · `get_account` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.DevHusnainAi/zerodom", "name": "ZeroDOM", "kind": "mcp", "official": null, "desc": "The deterministic attack-surface perception layer for AI security agents", "repo": "https://github.com/DevHusnainAi/zerodom", "install": ["pypi:zerodom", "npm:@vexralabs/zerodom"], "stars": 3, "pushed": "2026-11-02T08:44:53Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Actenon/kernel", "name": "Actenon Kernel", "kind": "mcp", "official": null, "desc": "Verify consequential AI actions before they execute.", "repo": "https://github.com/Actenon/actenon-kernel", "install": ["pypi:actenon-kernel"], "stars": 2, "pushed": "2026-11-02T22:01:22Z", "license": "Apache-2.0", "plat": "ai actions", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lm203688/aishield", "name": "AIShield Security Scanner", "kind": "mcp", "official": null, "desc": "Scans MCP servers for tool poisoning, prompt injection and supply chain risks.", "repo": "https://github.com/lm203688/aishield", "install": ["npm:aishield-mcp-server"], "stars": 2, "pushed": "2026-11-02T18:18:07Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MvikManners/aw1-circuit-breaker", "name": "AW-1 Sovereign Circuit Breaker", "kind": "mcp", "official": null, "desc": "Deterministic sub-0.2ms AST security circuit breaker and agent containment engine.", "repo": "https://github.com/MvikManners/aw1-circuit-breaker", "install": ["https://p20.laveto.net/wisdom/mcp/sse"], "stars": 2, "pushed": "2026-11-10T23:12:53Z", "license": "Apache-2.0", "plat": "", "live": "Live · 758 ms · 3 tools · free to try: `sql_query` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.bawbel/bawbel-mcp", "name": "Bawbel Scanner", "kind": "mcp", "official": null, "desc": "Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.", "repo": "https://github.com/bawbel/bawbel-mcp", "install": ["pypi:bawbel-mcp"], "stars": 2, "pushed": "2026-10-24T01:23:09Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.marras0914/cordon", "name": "Cordon for MCP", "kind": "mcp", "official": null, "desc": "Cordon for MCP. Security gateway with policy enforcement, audit log, and HITL approvals.", "repo": "https://github.com/marras0914/cordon", "install": ["npm:@getcordon/cli"], "stars": 2, "pushed": "2026-07-28T16:44:17Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.alfa-reza/cvss-calculator-mcp", "name": "CVSS Calculator MCP", "kind": "mcp", "official": null, "desc": "Calculate and validate CVSS 2.0, 3.0, 3.1, and 4.0 base scores.", "repo": "https://github.com/alfa-reza/cvss-calculator-mcp", "install": ["https://cvss.my.id/mcp"], "stars": 2, "pushed": "2026-11-08T10:53:23Z", "license": "Apache-2.0", "plat": "", "live": "Live · 1016 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:uk.co.cybercentry/verification", "name": "Cybercentry Verification", "kind": "mcp", "official": null, "desc": "Twelve tools: token, wallet, contract and site security. Two free, the rest $1 in USDC over x402.", "repo": "https://github.com/Cybercentry/verification-mcp", "install": ["https://centry.cybercentry.co.uk/api/mcp"], "stars": 2, "pushed": "2026-08-22T14:52:14Z", "license": "MIT", "plat": "", "live": "Live · 1135 ms · 14 tools · free to try: `list_services` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Gadriel-ai/gadriel", "name": "Gadriel AI Security Harness", "kind": "mcp", "official": null, "desc": "AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.", "repo": "https://github.com/Gadriel-ai/gadriel-copilot-plugin", "install": ["npm:gadriel"], "stars": 2, "pushed": "2026-10-29T01:43:50Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AnshumanAtrey/gitleaks-github-secret-scanner", "name": "Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner", "kind": "mcp", "official": null, "desc": "GitHub Secret Scanner - Find Leaked API Keys | Gitleaks", "repo": "https://github.com/AnshumanAtrey/gitleaks-github-secret-scanner", "install": ["https://mcp.apify.com/?tools=anshumanatrey/gitleaks-github-secret-scanner"], "stars": 2, "pushed": "2026-11-12T04:54:35Z", "license": "MIT", "plat": "github", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:net.honeylabs/mcp", "name": "HoneyLabs", "kind": "mcp", "official": null, "desc": "Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.", "repo": "https://github.com/honeylabshq/honeylabs-mcp", "install": ["https://mcp.honeylabs.net/mcp"], "stars": 2, "pushed": "2026-11-13T10:59:25Z", "license": "MIT", "plat": "", "live": "Live · 1444 ms · 14 tools · `ioc_lookup_tool` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.4hmetuyar/a2a-auditor", "name": "io.github.4hmetuyar/a2a-auditor", "kind": "mcp", "official": null, "desc": "Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-a2a-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/ai-code-scanner", "name": "io.github.4hmetuyar/ai-code-scanner", "kind": "mcp", "official": null, "desc": "Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-ai-code-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/dependency-auditor", "name": "io.github.4hmetuyar/dependency-auditor", "kind": "mcp", "official": null, "desc": "CVE scanning for npm/pip/cargo dependencies via OSV", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-dependency-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/mcp-server-auditor", "name": "io.github.4hmetuyar/mcp-server-auditor", "kind": "mcp", "official": null, "desc": "Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-server-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/memory-poisoning-scanner", "name": "io.github.4hmetuyar/memory-poisoning-scanner", "kind": "mcp", "official": null, "desc": "Scans agent code for untrusted input poisoning persistent cross-session memory", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-memory-poisoning-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/model-scanner", "name": "io.github.4hmetuyar/model-scanner", "kind": "mcp", "official": null, "desc": "Scans ML model files (PyTorch, safetensors, Keras, ONNX) for supply-chain risks", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-model-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/oauth-auditor", "name": "io.github.4hmetuyar/oauth-auditor", "kind": "mcp", "official": null, "desc": "Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-oauth-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/prompt-injection-scanner", "name": "io.github.4hmetuyar/prompt-injection-scanner", "kind": "mcp", "official": null, "desc": "Scans RAG content/scraped pages for indirect prompt injection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-prompt-injection-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/rug-pull-detector", "name": "io.github.4hmetuyar/rug-pull-detector", "kind": "mcp", "official": null, "desc": "Baselines an MCP server's tools and detects tool-definition changes after approval", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-rug-pull-detector"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/security-proxy", "name": "io.github.4hmetuyar/security-proxy", "kind": "mcp", "official": null, "desc": "MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-security-proxy"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/security-suite", "name": "io.github.4hmetuyar/security-suite", "kind": "mcp", "official": null, "desc": "Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/security-suite"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/slopsquat-scanner", "name": "io.github.4hmetuyar/slopsquat-scanner", "kind": "mcp", "official": null, "desc": "Checks declared npm/PyPI dependencies against real registries to catch slopsquatting", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-slopsquat-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/ssl-inspector", "name": "io.github.4hmetuyar/ssl-inspector", "kind": "mcp", "official": null, "desc": "TLS certificate/cipher/protocol inspection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-ssl-inspector"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/tool-poisoning-scanner", "name": "io.github.4hmetuyar/tool-poisoning-scanner", "kind": "mcp", "official": null, "desc": "Scans MCP tool definitions for hidden instructions and confused-deputy sinks", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-tool-poisoning-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/toxic-flow-auditor", "name": "io.github.4hmetuyar/toxic-flow-auditor", "kind": "mcp", "official": null, "desc": "Finds lethal-trifecta toxic flows in MCP tool catalogs: untrusted input, sensitive data, egress", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-toxic-flow-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/unbounded-consumption-auditor", "name": "io.github.4hmetuyar/unbounded-consumption-auditor", "kind": "mcp", "official": null, "desc": "Scans LLM/agent code for Unbounded Consumption / denial-of-wallet risks (OWASP LLM Top 10 2026 #6)", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-unbounded-consumption-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/vector-store-scanner", "name": "io.github.4hmetuyar/vector-store-scanner", "kind": "mcp", "official": null, "desc": "Probes vector-database endpoints for unauthenticated exposure of embeddings/RAG data", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-vector-store-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/vulnerability-scanner", "name": "io.github.4hmetuyar/vulnerability-scanner", "kind": "mcp", "official": null, "desc": "Triggers GuardBee scans, queries findings, AI-assisted remediation guidance", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-vulnerability-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Bajuzjefe/aikido-mcp", "name": "io.github.Bajuzjefe/aikido-mcp", "kind": "mcp", "official": null, "desc": "Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors.", "repo": "https://github.com/Bajuzjefe/Aikido-Security-Analysis-Platform", "install": ["npm:aikido-mcp"], "stars": 2, "pushed": "2026-02-26T02:41:09Z", "license": "MIT", "plat": "cardano smart contracts", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cyanheads/osv-advisory-mcp-server", "name": "io.github.cyanheads/osv-advisory-mcp-server", "kind": "mcp", "official": null, "desc": "Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.", "repo": "https://github.com/cyanheads/osv-advisory-mcp-server", "install": ["npm:@cyanheads/osv-advisory-mcp-server", "npm:@cyanheads/osv-advisory-mcp-server", "https://osv-advisory.caseyjhand.com/mcp"], "stars": 2, "pushed": "2026-11-11T12:28:36Z", "license": "Apache-2.0", "plat": "osv.dev", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.flagrix-io/flagrix", "name": "io.github.flagrix-io/flagrix", "kind": "mcp", "official": null, "desc": "Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents", "repo": "https://github.com/flagrix-io/flagrix-cli", "install": ["npm:flagrix"], "stars": 2, "pushed": "2026-11-10T19:43:54Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/a2a-auditor", "name": "io.github.GuardBee/a2a-auditor", "kind": "mcp", "official": null, "desc": "Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-a2a-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/agent-graph-auditor", "name": "io.github.GuardBee/agent-graph-auditor", "kind": "mcp", "official": null, "desc": "Finds transitive excessive agency across LangGraph/CrewAI/AutoGen orchestration graphs", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-agent-graph-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/ai-code-scanner", "name": "io.github.GuardBee/ai-code-scanner", "kind": "mcp", "official": null, "desc": "Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-ai-code-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/audit-gap-auditor", "name": "io.github.GuardBee/audit-gap-auditor", "kind": "mcp", "official": null, "desc": "OWASP MCP08 audit/telemetry gaps: missing tool-call logs, raw args in logs, disabled audit", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-audit-gap-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/compliance-checker", "name": "io.github.GuardBee/compliance-checker", "kind": "mcp", "official": null, "desc": "KVKK/GDPR/CCPA compliance checks for codebases", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-compliance-checker"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/context-oversharing-auditor", "name": "io.github.GuardBee/context-oversharing-auditor", "kind": "mcp", "official": null, "desc": "OWASP MCP10 context oversharing: session dumps, unscoped memory, shared context, prompt leaks", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-context-oversharing-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/db-gateway", "name": "io.github.GuardBee/db-gateway", "kind": "mcp", "official": null, "desc": "KVKK/GDPR-compliant LLM-to-database gateway: PII masking, RBAC, rate limiting, audit log", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-db-gateway"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/dependency-auditor", "name": "io.github.GuardBee/dependency-auditor", "kind": "mcp", "official": null, "desc": "CVE scanning for npm/pip/cargo dependencies via OSV", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-dependency-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/dns-intelligence", "name": "io.github.GuardBee/dns-intelligence", "kind": "mcp", "official": null, "desc": "DNS record enumeration, misconfiguration and dangling-subdomain detection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-dns-intelligence"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/document-scanner", "name": "io.github.GuardBee/document-scanner", "kind": "mcp", "official": null, "desc": "Finds PII and credentials in PDFs, screenshots and scanned documents", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-document-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/elicitation-auditor", "name": "io.github.GuardBee/elicitation-auditor", "kind": "mcp", "official": null, "desc": "MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-elicitation-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/llm-redteam", "name": "io.github.GuardBee/llm-redteam", "kind": "mcp", "official": null, "desc": "Active jailbreak/extraction/obfuscation red-teaming for live LLM endpoints", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-llm-redteam"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/mcp-config-auditor", "name": "io.github.GuardBee/mcp-config-auditor", "kind": "mcp", "official": null, "desc": "Scans Cursor/Claude/Windsurf/VS Code MCP configs for unpinned versions, secrets, typosquats", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-config-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/mcp-server-auditor", "name": "io.github.GuardBee/mcp-server-auditor", "kind": "mcp", "official": null, "desc": "Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-server-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/memory-poisoning-scanner", "name": "io.github.GuardBee/memory-poisoning-scanner", "kind": "mcp", "official": null, "desc": "Scans agent code for untrusted input poisoning persistent cross-session memory", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-memory-poisoning-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/model-scanner", "name": "io.github.GuardBee/model-scanner", "kind": "mcp", "official": null, "desc": "Scans ML model files (PyTorch, joblib, NumPy, GGUF, TensorFlow…) and HF repos for supply-chain risks", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-model-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/oauth-auditor", "name": "io.github.GuardBee/oauth-auditor", "kind": "mcp", "official": null, "desc": "Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-oauth-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/owasp-scan", "name": "io.github.GuardBee/owasp-scan", "kind": "mcp", "official": null, "desc": "Unified OWASP MCP Top 10 scan — path or live tools/list, A–F grade, SARIF", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-owasp-scan"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/prompt-injection-scanner", "name": "io.github.GuardBee/prompt-injection-scanner", "kind": "mcp", "official": null, "desc": "Scans RAG content/scraped pages for indirect prompt injection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-prompt-injection-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/prompt-leak-scanner", "name": "io.github.GuardBee/prompt-leak-scanner", "kind": "mcp", "official": null, "desc": "Catches leaked credentials and PII in outbound LLM prompts", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-prompt-leak-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/reverse-shield", "name": "io.github.GuardBee/reverse-shield", "kind": "mcp", "official": null, "desc": "Audits shipped apps for how easily they can be reverse engineered", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-reverse-shield"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/rug-pull-detector", "name": "io.github.GuardBee/rug-pull-detector", "kind": "mcp", "official": null, "desc": "Baselines an MCP server's tools and detects tool-definition changes after approval", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-rug-pull-detector"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/secret-scanner", "name": "io.github.GuardBee/secret-scanner", "kind": "mcp", "official": null, "desc": "Scans files for leaked secrets and API keys", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-secret-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/security-engineer", "name": "io.github.GuardBee/security-engineer", "kind": "mcp", "official": null, "desc": "Fix GuardBee AI Security Engineer findings in your repo with your coding agent, then verify", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-security-engineer"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/security-proxy", "name": "io.github.GuardBee/security-proxy", "kind": "mcp", "official": null, "desc": "MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-security-proxy"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/security-suite", "name": "io.github.GuardBee/security-suite", "kind": "mcp", "official": null, "desc": "Every GuardBee MCP security tool in one server: OWASP MCP Top 10, secrets, supply chain, TLS/DNS", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/security-suite"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/slopsquat-scanner", "name": "io.github.GuardBee/slopsquat-scanner", "kind": "mcp", "official": null, "desc": "Checks declared npm/PyPI dependencies against real registries to catch slopsquatting", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-slopsquat-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/ssl-inspector", "name": "io.github.GuardBee/ssl-inspector", "kind": "mcp", "official": null, "desc": "TLS certificate/cipher/protocol inspection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-ssl-inspector"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/threat-rules", "name": "io.github.GuardBee/threat-rules", "kind": "mcp", "official": null, "desc": "GuardBee MCP bridge to Agent Threat Rules (ATR) for runtime agent/MCP threat detection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-threat-rules"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/tool-poisoning-scanner", "name": "io.github.GuardBee/tool-poisoning-scanner", "kind": "mcp", "official": null, "desc": "Scans MCP tool definitions for hidden instructions and confused-deputy sinks", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-tool-poisoning-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/toxic-flow-auditor", "name": "io.github.GuardBee/toxic-flow-auditor", "kind": "mcp", "official": null, "desc": "Finds lethal-trifecta toxic flows in MCP tool catalogs: untrusted input, sensitive data, egress", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-toxic-flow-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/unbounded-consumption-auditor", "name": "io.github.GuardBee/unbounded-consumption-auditor", "kind": "mcp", "official": null, "desc": "Scans LLM/agent code for Unbounded Consumption / denial-of-wallet risks (OWASP LLM Top 10 2026 #6)", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-unbounded-consumption-auditor"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/vector-store-scanner", "name": "io.github.GuardBee/vector-store-scanner", "kind": "mcp", "official": null, "desc": "Probes vector-database endpoints for unauthenticated exposure of embeddings/RAG data", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-vector-store-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GuardBee/vulnerability-scanner", "name": "io.github.GuardBee/vulnerability-scanner", "kind": "mcp", "official": null, "desc": "Triggers GuardBee scans, queries findings, AI-assisted remediation guidance", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-vulnerability-scanner"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.holistis/3ilm-mcp", "name": "io.github.holistis/3ilm-mcp", "kind": "mcp", "official": null, "desc": "Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.", "repo": "https://github.com/holistis/3ilm-mcp", "install": ["npm:3ilm-mcp"], "stars": 2, "pushed": "2026-11-11T10:22:06Z", "license": "MIT", "plat": "sherlock", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MarcelRoozekrans/longterm-memory", "name": "io.github.MarcelRoozekrans/longterm-memory", "kind": "mcp", "official": null, "desc": "A fully local MCP server for long-term memory with semantic search", "repo": "https://github.com/MarcelRoozekrans/LongtermMemory-MCP", "install": ["npm:longterm-memory-mcp"], "stars": 2, "pushed": "2026-11-06T15:22:52Z", "license": "MIT", "plat": "net", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nh4ttruong/secobserve-mcp", "name": "io.github.nh4ttruong/secobserve-mcp", "kind": "mcp", "official": null, "desc": "MCP server for SecObserve: triage findings, import scan reports and SBOMs, generate VEX.", "repo": "https://github.com/nh4ttruong/secobserve-mcp", "install": ["pypi:secobserve-mcp", "oci:ghcr.io/nh4ttruong/secobserve-mcp:1.0.0"], "stars": 2, "pushed": "2026-09-25T08:55:49Z", "license": "MIT", "plat": "secobserve", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.oscal-compass/compliance-trestle-mcp", "name": "io.github.oscal-compass/compliance-trestle-mcp", "kind": "mcp", "official": null, "desc": "An MCP server that provides tools to author OSCAL security compliance documentation", "repo": "https://github.com/oscal-compass/compliance-trestle-mcp", "install": ["pypi:compliance-trestle-mcp"], "stars": 2, "pushed": "2026-11-11T07:58:17Z", "license": "Apache-2.0", "plat": "oscal", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.SemanticDataCharter/sdcgovernance", "name": "io.github.SemanticDataCharter/sdcgovernance", "kind": "mcp", "official": null, "desc": "Governance validation for Semantic Data Charter instances; returns OASIS XACML decisions.", "repo": "https://github.com/SemanticDataCharter/sdcgovernance", "install": ["pypi:sdcgovernance"], "stars": 2, "pushed": "2026-11-10T14:37:17Z", "license": "Apache-2.0", "plat": "semanticdatacharter", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lutfizp/keel", "name": "Keel", "kind": "mcp", "official": null, "desc": "Control plane MCP that dedups scanner output, rate-limits hosts, and runs non-destructive proofs.", "repo": "https://github.com/lutfizp/keel", "install": ["pypi:keel-pentest"], "stars": 2, "pushed": "2026-08-25T08:40:20Z", "license": "MIT", "plat": "keel", "live": "Not checked (runs locally)"}, {"id": "mcp:com.kenwea.www/notary", "name": "Kenwea Notary", "kind": "mcp", "official": null, "desc": "Signed, traced record of what an npm package or file attempts when run, network included. No key.", "repo": "https://github.com/kenwea-protocol/kenwea", "install": ["https://mcp.kenwea.com/notary/v1"], "stars": 2, "pushed": "2026-11-13T07:13:56Z", "license": "MIT", "plat": "kenwea notary", "live": "Live · 2825 ms · 5 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.lintsure/lintsure", "name": "Lintsure", "kind": "mcp", "official": null, "desc": "Compliance readiness checks for code: EU AI Act, GDPR, OWASP, CWE, Cyber Resilience Act. Local.", "repo": "https://github.com/lintsure/lintsure", "install": ["npm:@lintsure/mcp"], "stars": 2, "pushed": "2026-11-10T18:34:47Z", "license": "Apache-2.0", "plat": "code", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mcpcustoms/mcp-customs", "name": "MCP Customs", "kind": "mcp", "official": null, "desc": "Inspect an MCP server for common security risks before you install it. Offline, zero telemetry.", "repo": "https://github.com/mcpcustoms/mcp-customs", "install": ["npm:mcp-customs"], "stars": 2, "pushed": "2026-07-31T02:39:43Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.willianpinho/mcp-gateway-scan", "name": "MCP Gateway Scan", "kind": "mcp", "official": null, "desc": "Read-only MCP/agent-gateway readiness scanner — scores a repo across 7 security dimensions.", "repo": "https://github.com/willianpinho/mcp-gateway-scan", "install": ["npm:mcp-gateway-scan"], "stars": 2, "pushed": "2026-07-15T14:37:36Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ogasurfproject-jpg/hs-verify-gate", "name": "MCP Verification Gate: check an MCP server or an A2A agent before you connect or delegate", "kind": "mcp", "official": null, "desc": "Check an A2A agent before you delegate, or an MCP server's measured conduct. Free, no key.", "repo": "https://github.com/ogasurfproject-jpg/horizon-shield", "install": ["https://gate.horizonshield.dev/mcp"], "stars": 2, "pushed": "2026-11-13T09:50:30Z", "license": "MIT", "plat": "", "live": "Live · 970 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.diemoeve/mcpampel", "name": "MCPAmpel - MCP Security Scanner", "kind": "mcp", "official": null, "desc": "Scan installed MCP servers for security vulnerabilities with 16 detection engines.", "repo": "https://github.com/MCPAmpel/mcpampel", "install": ["pypi:mcpampel"], "stars": 2, "pushed": "2026-04-02T20:32:27Z", "license": "Apache-2.0", "plat": "mcpampel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.tide-foundation/raziel", "name": "Raziel", "kind": "mcp", "official": null, "desc": "MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis", "repo": "https://github.com/tide-foundation/raziel-mcp", "install": ["npm:@tideorg/mcp", "https://mcp.tide.org/mcp"], "stars": 2, "pushed": "2026-10-29T09:30:06Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rubrikinc/rubrik-mcp", "name": "Rubrik Security Cloud", "kind": "mcp", "official": null, "desc": "Connect AI assistants to the Rubrik Security Cloud GraphQL API to discover, query, and automate.", "repo": "https://github.com/rubrikinc/rubrik-mcp", "install": ["pypi:rubrik-mcp"], "stars": 2, "pushed": "2026-11-12T18:14:55Z", "license": "MIT", "plat": "rubrik security cloud", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stevologic/security-recipes", "name": "Security Recipes", "kind": "mcp", "official": null, "desc": "Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.", "repo": "https://github.com/stevologic/security-recipes.ai", "install": ["https://security-recipes.ai/mcp"], "stars": 2, "pushed": "2026-11-13T04:23:10Z", "license": "Apache-2.0", "plat": "cve", "live": "Live · 2791 ms · 75 tools · free to try: `recipes_cve_get` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Shrike-Security/shrike-mcp", "name": "Shrike", "kind": "mcp", "official": null, "desc": "Governs what AI agents do: tool calls, SQL, commands, files checked against policy before they run.", "repo": "https://github.com/Shrike-Security/shrike-mcp", "install": ["npm:shrike-mcp"], "stars": 2, "pushed": "2026-11-10T22:19:04Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.qingxuantang/tar-engine", "name": "TAR Engine", "kind": "mcp", "official": null, "desc": "Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.", "repo": "https://github.com/qingxuantang/tar-engine", "install": ["pypi:tar-engine"], "stars": 2, "pushed": "2026-11-11T09:21:21Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pranlabs/valca", "name": "Valca", "kind": "mcp", "official": null, "desc": "Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.", "repo": "https://github.com/PranLabs/valca", "install": ["pypi:valca"], "stars": 2, "pushed": "2026-10-10T18:19:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vantioai/vantio-gate", "name": "Vantio Gate", "kind": "mcp", "official": null, "desc": "Vantio Gate — Policy Latch dry-run evaluate for agents. No live enforce from MCP.", "repo": "https://github.com/vantioai/vantio-open-core", "install": ["npm:@vantio/gate-mcp"], "stars": 2, "pushed": "2026-11-13T01:17:03Z", "license": null, "plat": "vantio", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vantioai/vantio-optics", "name": "Vantio Optics", "kind": "mcp", "official": null, "desc": "Vantio Optics — read-only Sight Loop observe for agents. Proofs, hosts, upgrade path.", "repo": "https://github.com/vantioai/vantio-open-core", "install": ["npm:@vantio/optics-mcp"], "stars": 2, "pushed": "2026-11-13T01:17:03Z", "license": null, "plat": "vantio", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.openyard-cloud/vetcode", "name": "vetcode", "kind": "mcp", "official": null, "desc": "Security check for coding agents: malware, supply chain, secrets and web bugs. Reads, never runs.", "repo": "https://github.com/openyard-cloud/vetcode", "install": ["mcpb:https://github.com/openyard-cloud/vetcode/releases/download/v0.8.7/vetcode.mcpb"], "stars": 2, "pushed": "2026-11-13T01:44:10Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.vulnify/mcp", "name": "Vulnify", "kind": "mcp", "official": null, "desc": "Ask Vulnify before an AI agent acts. Check, record, and read policy decisions.", "repo": "https://github.com/vulnify/vulnify-mcp", "install": ["npm:@vulnify/mcp", "https://mcp.vulnify.io/mcp"], "stars": 2, "pushed": "2026-10-31T19:07:03Z", "license": "MIT", "plat": "vulnify", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MM-sheng/404-directory", "name": "404.directory", "kind": "mcp", "official": null, "desc": "Risk preflight for AI Agent tool actions and Polymarket settlement and execution checks.", "repo": "https://github.com/MM-sheng/404-directory", "install": ["npm:@mmvv1638/404-directory-mcp", "https://404.directory/mcp"], "stars": 1, "pushed": "2026-10-05T03:27:39Z", "license": "MIT", "plat": "polymarket", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:42crunch-api-security-testing", "name": "42crunch-api-security-testing", "kind": "claude-plugin", "official": null, "desc": "Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.", "repo": "https://github.com/42Crunch-AI/claude-plugins.git", "install": ["claude plugin install 42crunch-api-security-testing@claude-plugins-official"], "stars": 1, "pushed": "2026-11-03T16:09:53Z", "license": null, "plat": "anthropic", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/abstract-api", "name": "Abstract API MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Validate emails, phones, IBAN, VAT; look up IPs and companies; rates, holidays, time via Abstract.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://abstract-api.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "abstract api", "live": "Live · 1808 ms · 14 tools · `abstractapi_lookup_ip` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.usefulapi/action1", "name": "Action1 MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Read endpoints, missing updates, CVE vulnerabilities, installed software and reports in Action1.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://action1.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "action1", "live": "Live · 1260 ms · 16 tools · `action1_search` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.AI-Blockchain-Ventures/agentverify", "name": "Agent Verify", "kind": "mcp", "official": null, "desc": "Security checks for AI agents and MCP configs: 124 tested checks, from your AI coding assistant.", "repo": "https://github.com/AI-Blockchain-Ventures/agentverify", "install": ["npm:agentverify"], "stars": 1, "pushed": "2026-11-12T21:31:39Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.co2water/agentegress", "name": "agentegress", "kind": "mcp", "official": null, "desc": "See which AI agent and MCP server talks to what on Windows, with a rule-based security verdict", "repo": "https://github.com/co2water/agentegress", "install": ["mcpb:https://github.com/co2water/agentegress/releases/download/v0.1.4/agentegress-windows.mcpb"], "stars": 1, "pushed": "2026-11-06T07:47:33Z", "license": "MIT", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.aileron-sh/aileron", "name": "Aileron Journal", "kind": "mcp", "official": null, "desc": "Read-only queries over Aileron audit journals: verify integrity, search recorded tool calls", "repo": "https://github.com/aileron-sh/aileron", "install": ["pypi:aileron"], "stars": 1, "pushed": "2026-11-12T15:05:34Z", "license": "Apache-2.0", "plat": "aileron", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/all-quiet", "name": "All Quiet MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Manage incidents and on-call: list/create/update incidents, who is on call, on-call overrides.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://all-quiet.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "all quiet", "live": "Live · 540 ms · 11 tools · `allquiet_list_teams` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.arcjet/mcp", "name": "Arcjet", "kind": "mcp", "official": null, "desc": "An MCP server for Arcjet - the runtime security platform that ships with your AI code.", "repo": "https://github.com/arcjet/mcp", "install": ["https://api.arcjet.com/mcp"], "stars": 1, "pushed": "2026-04-09T18:50:37Z", "license": null, "plat": "arcjet", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/atera-mcp", "name": "Atera", "kind": "mcp", "official": null, "desc": "MCP server for Atera RMM — customers, tickets, and more.", "repo": "https://github.com/WYRE-AI/atera-mcp", "install": ["oci:ghcr.io/wyre-ai/atera-mcp:v1.5.13"], "stars": 1, "pushed": "2026-11-12T16:56:29Z", "license": "Apache-2.0", "plat": "atera", "live": "Not checked (runs locally)"}, {"id": "mcp:com.authichain/authichain", "name": "AuthiChain", "kind": "mcp", "official": null, "desc": "Verification of signed records, plus an EU DPP check.", "repo": "https://github.com/undone0603/authichain-unified", "install": ["https://authichain.com/mcp"], "stars": 1, "pushed": "2026-11-13T08:52:03Z", "license": null, "plat": "verification", "live": "Live · 3229 ms · 8 tools · free to try: `dpp_readiness_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/auvik-mcp", "name": "Auvik", "kind": "mcp", "official": null, "desc": "MCP server for the Auvik network monitoring API — devices, alerts, statistics, billing.", "repo": "https://github.com/WYRE-AI/auvik-mcp", "install": ["oci:ghcr.io/wyre-ai/auvik-mcp:v1.4.6"], "stars": 1, "pushed": "2026-11-12T16:49:05Z", "license": "NOASSERTION", "plat": "auvik", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/avanan-mcp", "name": "Avanan", "kind": "mcp", "official": null, "desc": "MCP server for Check Point Harmony Email & Collaboration (Avanan) email security.", "repo": "https://github.com/WYRE-AI/avanan-mcp", "install": ["oci:ghcr.io/wyre-ai/avanan-mcp:v2.2.5"], "stars": 1, "pushed": "2026-11-12T16:55:55Z", "license": "Apache-2.0", "plat": "avanan", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jesleytassili-glitch/b2b-compliance-quant-mcp", "name": "B2B Compliance, KYB, Cyber & GovCon Suite (31 Tools)", "kind": "mcp", "official": null, "desc": "31 stateless B2B tools for KYB, OFAC sanctions, SEC EDGAR, CISA CVEs, FDA, tenders & tax audits.", "repo": "https://github.com/jesleytassili-glitch/b2b-quant-mcp-n8n-suite", "install": ["https://mcp.apify.com/?actors=b2b-quant-apis/b2b-quant-mcp-server,b2b-quant-apis/global-sanctions-pep-interpol-watchlist-screener,b2b-quant-apis/global-gleif-lei-corporate-ownership-kyb,b2b-quant-apis/us-sec-edgar-filings-insider-radar,b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor"], "stars": 1, "pushed": "2026-11-11T02:54:24Z", "license": "MIT", "plat": "b2b compliance", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Alessiolucini/binsight", "name": "BinSight", "kind": "mcp", "official": null, "desc": "The AI X-ray for any file: what is it, what does it hide, what changed. Built on REA.", "repo": "https://github.com/Alessiolucini/binsight", "install": ["npm:binsight"], "stars": 1, "pushed": "2026-10-25T12:45:30Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.blackduck/mcp-server", "name": "Black Duck Security Scanner", "kind": "mcp", "official": null, "desc": "AI-powered security scanning using Black Duck Signal for vulnerability detection.", "repo": "https://github.com/blackducksoftware/mcp-server", "install": ["npm:@black-duck/mcp-server", "mcpb:https://github.com/blackducksoftware/mcp-server/releases/download/v1.1.8/black-duck-mcp-1.1.8.mcpb"], "stars": 1, "pushed": "2026-09-02T19:54:28Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.BitmapAsset/block-genomics-mcp", "name": "Block Genomics — Nexus Protocol", "kind": "mcp", "official": null, "desc": "Prove Bitcoin block ownership via BIP-322 and register sovereign AI agents on the Nexus Protocol.", "repo": "https://github.com/BitmapAsset/block-genomics-nexus", "install": ["npm:block-genomics-mcp"], "stars": 1, "pushed": "2026-11-13T00:53:48Z", "license": "NOASSERTION", "plat": "bitcoin", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nugehs/bouncer", "name": "bouncer", "kind": "mcp", "official": null, "desc": "Static compliance-controls checker for UK Online Safety Act & ICO Children's Code. CLI + MCP.", "repo": "https://github.com/nugehs/bouncer", "install": ["npm:@nugehs/bouncer"], "stars": 1, "pushed": "2026-10-26T08:30:14Z", "license": "MIT", "plat": "uk online safety act", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jesleytassili-glitch/brazil-tax-cnpj-pncp-mcp", "name": "Brazil Tax Reform IBS/CBS, CNPJ QSA, BCB PTAX & Pix KYB", "kind": "mcp", "official": null, "desc": "Audit Brazil LC 214 NCM tax reform, CNPJ QSA partners, BCB PTAX/Selic, Pix ISPB, TISS XML & ANTT.", "repo": "https://github.com/jesleytassili-glitch/b2b-quant-mcp-n8n-suite", "install": ["https://mcp.apify.com/?actors=b2b-quant-apis/brazil-tax-reform-ncm-classtrib-auditor,b2b-quant-apis/brazil-b2b-cnpj-qsa-lead-enricher,b2b-quant-apis/brazil-bcb-ptax-sgs-financial-contract-indexer,b2b-quant-apis/brazil-pix-ispb-cvm-financial-kyb-auditor,b2b-quant-apis/healthcare-tiss-xml-validator,b2b-quant-apis/brazil-antt-freight-cte-auditor"], "stars": 1, "pushed": "2026-11-11T02:54:24Z", "license": "MIT", "plat": "brazil tax reform", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.tangchangzhe/bt-ops-mcp-server", "name": "BT Ops MCP", "kind": "mcp", "official": null, "desc": "Secure MCP server for BT Panel operations with scoped permissions and audited writes.", "repo": "https://github.com/tangchangzhe/bt-ops-mcp-server", "install": ["npm:bt-ops-mcp-server"], "stars": 1, "pushed": "2026-09-05T04:19:39Z", "license": "Apache-2.0", "plat": "bt panel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cairncommons/cairn-commons", "name": "Cairn Commons", "kind": "mcp", "official": null, "desc": "Checked dependency-bug records: look an error up, check versions before installing.", "repo": "https://github.com/cairncommons/cairn-commons", "install": ["https://cairncommons.dev/api/mcp"], "stars": 1, "pushed": "2026-11-12T10:59:21Z", "license": "MIT", "plat": "cairn commons", "live": "Live · 1514 ms · 26 tools · free to try: `cairn_local_status` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.cairncommons/cairn-read", "name": "Cairn Commons (read-only)", "kind": "mcp", "official": null, "desc": "Read-only: look up checked dependency bugs and check versions before installing. No account.", "repo": "https://github.com/cairncommons/cairn-commons-read", "install": ["https://cairncommons.dev/api/mcp/read"], "stars": 1, "pushed": "2026-11-07T09:21:14Z", "license": "MIT", "plat": "cairn commons", "live": "Live · 1061 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.usefulapi/castle", "name": "Castle MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Investigate security events and manage the allow/deny lists an analyst acts on.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://castle.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "castle", "live": "Live · 836 ms · 14 tools · `castle_search_lists` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.jesleytassili-glitch/cybersecurity-cve-ssl-mcp", "name": "CISA KEV Ransomware CVE, SSL CT Logs & Domain Recon", "kind": "mcp", "official": null, "desc": "Audit active CISA KEV ransomware CVEs, SSL/TLS CT log subdomains, SPF/DMARC security & ICANN RDAP.", "repo": "https://github.com/jesleytassili-glitch/b2b-quant-mcp-n8n-suite", "install": ["https://mcp.apify.com/?actors=b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor,b2b-quant-apis/b2b-ssl-tls-ct-log-subdomain-attack-surface-auditor,b2b-quant-apis/global-b2b-email-domain-security-auditor,b2b-quant-apis/icann-rdap-domain-whois-brand-recon"], "stars": 1, "pushed": "2026-11-11T02:54:24Z", "license": "MIT", "plat": "cisa kev", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/cisco-duo-mcp", "name": "Cisco Duo", "kind": "mcp", "official": null, "desc": "MCP server for Cisco Duo's identity/MFA administration API.", "repo": "https://github.com/WYRE-AI/cisco-duo-mcp", "install": ["oci:ghcr.io/wyre-ai/cisco-duo-mcp:v1.0.1"], "stars": 1, "pushed": "2026-11-12T17:00:14Z", "license": "NOASSERTION", "plat": "cisco duo", "live": "Not checked (runs locally)"}, {"id": "mcp:com.checkmarx/checkmarx", "name": "com.checkmarx/checkmarx", "kind": "mcp", "official": null, "desc": "Official Checkmarx MCP Server", "repo": "https://github.com/Checkmarx/cx-agentic-ai", "install": ["https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}"], "stars": 1, "pushed": "2026-11-13T09:25:48Z", "license": "Apache-2.0", "plat": "checkmarx", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.fidacy/ai-agent-firewall", "name": "com.fidacy/ai-agent-firewall", "kind": "mcp", "official": null, "desc": "Every agent action watched, every money-moving one gated, every verdict independently verifiable.", "repo": "https://github.com/lucaslubi/fidacy-mcp", "install": ["npm:@fidacy/mcp"], "stars": 1, "pushed": "2026-08-04T23:36:11Z", "license": "Apache-2.0", "plat": "agent actions", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/complycube", "name": "ComplyCube MCP by usefulapi", "kind": "mcp", "official": null, "desc": "List and create clients, run AML screening checks and read results in ComplyCube.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://complycube.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "complycube", "live": "Live · 606 ms · 6 tools · `complycube_get_check` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:app.openkrill/cve", "name": "CVE Risk Check", "kind": "mcp", "official": null, "desc": "Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.", "repo": "https://github.com/nguyenhieuec/agent-tools-plugins", "install": ["https://cve.openkrill.app/mcp"], "stars": 1, "pushed": "2026-10-13T07:38:39Z", "license": "MIT", "plat": "cve risk", "live": "Live · 1869 ms · 6 tools · free to try: `get_feedback_reply` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.markusweldon/cverdict", "name": "CVErdict", "kind": "mcp", "official": null, "desc": "Read-only CVE triage: verdicts from CISA KEV, EPSS and exploit feeds, each reason linked.", "repo": "https://github.com/markusweldon/cverdict", "install": ["npm:cverdict-mcp"], "stars": 1, "pushed": "2026-11-13T07:58:39Z", "license": "MIT", "plat": "cve", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shadoprizm/cyberlens-mcp-server", "name": "CyberLens", "kind": "mcp", "official": null, "desc": "Security scanning for websites, public repositories, and Open CLAW skills.", "repo": "https://github.com/shadoprizm/cyberlens-mcp-server", "install": ["npm:@shadoprizm/cyberlens-mcp-server"], "stars": 1, "pushed": "2026-09-20T14:11:02Z", "license": "MIT", "plat": "cyberlens", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.node-man/dechonet-mcp", "name": "DechoNet", "kind": "mcp", "official": null, "desc": "Moved to com.dechonet/mcp. 25 security tools, hosted at https://dechonet.com/mcp", "repo": "https://github.com/node-man/dechonet-mcp", "install": [], "stars": 1, "pushed": "2026-11-06T03:54:10Z", "license": null, "plat": "com.dechonet/mcp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.DeepSleuth/deepsleuth", "name": "Deepsleuth", "kind": "mcp", "official": null, "desc": "Deterministic, no-LLM security scanner for MCP servers, plus an inline proxy gate.", "repo": "https://github.com/DeepSleuth/deepsleuth-mcp", "install": ["pypi:security-scanner-deepsleuth-mcp"], "stars": 1, "pushed": "2026-10-07T11:46:46Z", "license": "Apache-2.0", "plat": "mcp servers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.inspicere/mcp-defectdojo", "name": "DefectDojo", "kind": "mcp", "official": null, "desc": "MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding", "repo": "https://github.com/inspicere/mcp-defectdojo", "install": ["pypi:mcp-defectdojo"], "stars": 1, "pushed": "2026-06-14T00:47:14Z", "license": "MIT", "plat": "defectdojo", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.DeltaX-Public/deltax-preflight", "name": "DeltaX Preflight", "kind": "mcp", "official": null, "desc": "Check finite candidate proposals against separate policy and evidence, with canonical hash receipts.", "repo": "https://github.com/DeltaX-Public/deltax-preflight", "install": ["mcpb:https://github.com/DeltaX-Public/deltax-preflight/releases/download/mcp-v0.1.0/deltax-preflight-mcp-0.1.0.mcpb"], "stars": 1, "pushed": "2026-11-13T00:26:56Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stand-out-of-my-sun/diogenes-web3-security-mcp", "name": "Diogenes Web3, DeFi & 402 Security MCP", "kind": "mcp", "official": null, "desc": "Smart contract audit oracles, Solana risk analysis, MEV defense & HTTP 402 verifiers.", "repo": "https://github.com/stand-out-of-my-sun/diogenes-web3-security-mcp", "install": ["https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security"], "stars": 1, "pushed": "2026-11-04T20:42:33Z", "license": "MIT", "plat": "solana", "live": "Live · 605 ms · 15 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.mclose/dns-mcp", "name": "DNS MCP Server", "kind": "mcp", "official": null, "desc": "Real-time DNS security analysis — DNSSEC, email auth, and RDAP. Built for SOC investigations.", "repo": "https://github.com/mclose/dns-mcp", "install": ["oci:docker.io/mclose/dns-mcp:1.3.4"], "stars": 1, "pushed": "2026-11-09T13:07:38Z", "license": null, "plat": "dns", "live": "Not checked (runs locally)"}, {"id": "mcp:com.dregs/dregs-mcp", "name": "Dregs", "kind": "mcp", "official": null, "desc": "Fraud and abuse detection for SaaS: investigate scored identities, triage escalations, tune rules.", "repo": "https://github.com/dregs-sdk/dregs-mcp", "install": ["https://dregs.com/mcp"], "stars": 1, "pushed": "2026-11-10T19:59:39Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Super-Eric/falsepass", "name": "falsepass", "kind": "mcp", "official": null, "desc": "Find RL environment graders that pay wrong answers: probes reward code, returns reproducible leads", "repo": "https://github.com/Super-Eric/falsepass", "install": ["pypi:falsepass"], "stars": 1, "pushed": "2026-11-08T09:34:36Z", "license": "Apache-2.0", "plat": "falsepass", "live": "Not checked (runs locally)"}, {"id": "mcp:com.project-feldspar/scan", "name": "Feldspar free repository security scan", "kind": "mcp", "official": null, "desc": "Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.", "repo": "https://github.com/project-feldspar-resources/feldspar-scan", "install": ["https://project-feldspar.com/mcp"], "stars": 1, "pushed": "2026-10-24T05:14:53Z", "license": "MIT", "plat": "git repos", "live": "Live · 1576 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.vardhjain/finos-mcp-aigf", "name": "FINOS MCP - AI Governance (community)", "kind": "mcp", "official": null, "desc": "Read-only MCP for FINOS AI governance risks, controls and crosswalks. Independent project.", "repo": "https://github.com/vardhjain/finos-mcp", "install": ["pypi:finos-mcp-aigf"], "stars": 1, "pushed": "2026-11-09T13:30:00Z", "license": "Apache-2.0", "plat": "finos", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shane-js/ghostfree", "name": "GhostFree", "kind": "mcp", "official": null, "desc": "MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.", "repo": "https://github.com/shane-js/ghostfree", "install": ["npm:ghostfree"], "stars": 1, "pushed": "2026-04-07T01:46:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/huntress-mcp", "name": "Huntress", "kind": "mcp", "official": null, "desc": "MCP server for Huntress — accounts, organizations, agents, incidents, and reports.", "repo": "https://github.com/WYRE-AI/huntress-mcp", "install": ["oci:ghcr.io/wyre-ai/huntress-mcp:v1.2.24"], "stars": 1, "pushed": "2026-11-12T16:55:13Z", "license": "NOASSERTION", "plat": "huntress", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/inforcer-mcp", "name": "Inforcer", "kind": "mcp", "official": null, "desc": "Read-only MCP server for Inforcer M365 baseline governance, plus assessment and report runs.", "repo": "https://github.com/WYRE-AI/inforcer-mcp", "install": ["oci:ghcr.io/wyre-ai/inforcer-mcp:v1.1.3"], "stars": 1, "pushed": "2026-11-12T16:49:35Z", "license": "NOASSERTION", "plat": "inforcer", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Achilles1089/pentagonal-mcp", "name": "io.github.Achilles1089/pentagonal-mcp", "kind": "mcp", "official": null, "desc": "AI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains", "repo": "https://github.com/Pentagonal-ai/pentagonal", "install": ["npm:pentagonal-mcp"], "stars": 1, "pushed": "2026-07-27T19:35:53Z", "license": "MIT", "plat": "smart contracts", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.bitterdev/dropscan-mcp", "name": "io.github.bitterdev/dropscan-mcp", "kind": "mcp", "official": null, "desc": "MCP server for the Dropscan postal mail scanning API: read scanned letters, act on mailings.", "repo": "https://github.com/bitterdev/dropscan-mcp", "install": ["pypi:dropscan-mcp"], "stars": 1, "pushed": "2026-10-19T18:15:30Z", "license": "MIT", "plat": "dropscan", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.bitterdev/veracrypt-mcp", "name": "io.github.bitterdev/veracrypt-mcp", "kind": "mcp", "official": null, "desc": "MCP server to mount and unmount VeraCrypt containers with secure stdin password handling.", "repo": "https://github.com/bitterdev/veracrypt-mcp", "install": ["pypi:veracrypt-mcp"], "stars": 1, "pushed": "2026-10-19T18:19:07Z", "license": "MIT", "plat": "veracrypt", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CSOAI-ORG/sbom-cyclonedx-mcp", "name": "io.github.CSOAI-ORG/sbom-cyclonedx-mcp", "kind": "mcp", "official": null, "desc": "Software Bill of Materials generation + validation in CycloneDX 1.6 and SPDX 2.3 formats. Requir...", "repo": "https://github.com/CSOAI-ORG/sbom-cyclonedx-mcp", "install": ["pypi:sbom-cyclonedx-mcp"], "stars": 1, "pushed": "2026-10-08T01:13:14Z", "license": "MIT", "plat": "cyclonedx", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cyanheads/cisa-cybersecurity-mcp-server", "name": "io.github.cyanheads/cisa-cybersecurity-mcp-server", "kind": "mcp", "official": null, "desc": "CISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.", "repo": "https://github.com/cyanheads/cisa-cybersecurity-mcp-server", "install": ["npm:@cyanheads/cisa-cybersecurity-mcp-server", "npm:@cyanheads/cisa-cybersecurity-mcp-server", "https://cisa-cybersecurity.caseyjhand.com/mcp"], "stars": 1, "pushed": "2026-11-11T12:14:10Z", "license": "Apache-2.0", "plat": "cisa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-reverse-engineering", "name": "io.github.daedalus/mcp-reverse-engineering", "kind": "mcp", "official": null, "desc": "A sandboxed MCP tool for reverse engineering with multiple tool integrations", "repo": "https://github.com/daedalus/mcp_reverse_engineering", "install": ["pypi:mcp-reverse-engineering"], "stars": 1, "pushed": "2026-05-03T03:46:39Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.digidenone/synapse-audit", "name": "io.github.digidenone/synapse-audit", "kind": "mcp", "official": null, "desc": "AI-Powered Security Scanner for LLMs. Detects vulnerabilities and syncs with SynapseAudit.", "repo": "https://github.com/digidenone/SynapseAudit", "install": ["npm:@digidenone/synapseaudit-mcp"], "stars": 1, "pushed": "2026-11-12T13:26:58Z", "license": null, "plat": "synapseaudit", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.DingDawg-dev/dingdawg-compliance", "name": "io.github.DingDawg-dev/dingdawg-compliance", "kind": "mcp", "official": null, "desc": "EU AI Act + Colorado AI Act compliance scoring. 87/100 in 60 seconds. Free local scan.", "repo": "https://github.com/DingDawg-dev/dingdawg-compliance", "install": ["npm:dingdawg-compliance"], "stars": 1, "pushed": "2026-05-26T20:00:24Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dingdawg/dingdawg-shield", "name": "io.github.dingdawg/dingdawg-shield", "kind": "mcp", "official": null, "desc": "AI security scanning and trust scoring. Stack-specific threat models. Free local scan.", "repo": "https://github.com/dingdawg/dingdawg-agent-1", "install": ["npm:dingdawg-shield"], "stars": 1, "pushed": "2026-08-05T20:36:57Z", "license": "MIT", "plat": "ai security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Infinihash/infinihash-kyt-mcp", "name": "io.github.Infinihash/infinihash-kyt-mcp", "kind": "mcp", "official": null, "desc": "Screen crypto wallets vs OFAC SDN + threat intel; pre-payment checks, signed receipts; SAR drafts", "repo": "https://github.com/Infinihash/infinihash-kyt-mcp", "install": ["pypi:infinihash-kyt-mcp", "https://mcp.infinihash.com/mcp"], "stars": 1, "pushed": "2026-10-13T18:01:00Z", "license": null, "plat": "ofac sdn", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Iomed-commits/elthio-mcp", "name": "io.github.Iomed-commits/elthio-mcp", "kind": "mcp", "official": null, "desc": "Supplement safety for AI agents. 1,500+ rules, NIH+FDA data, quality grading A-D.", "repo": "https://github.com/Iomed-commits/elthio-mcp", "install": ["https://elthio-production.up.railway.app/mcp"], "stars": 1, "pushed": "2026-09-05T13:20:25Z", "license": null, "plat": "nih+fda", "live": "Live · 3169 ms · 6 tools · free to try: `check_supplement_safety` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.jeneric/stig-mcp", "name": "io.github.jeneric/stig-mcp", "kind": "mcp", "official": null, "desc": "MCP server: MITRE ATT&CK® -> NIST 800-53r5 -> DISA STIG fix/check steps, mitigations and detections", "repo": "https://github.com/jeneric/STIG-MCP", "install": ["pypi:stig-mcp"], "stars": 1, "pushed": "2026-11-11T03:46:16Z", "license": "MIT", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/container-hardening-800-190", "name": "io.github.jmshinhwa/container-hardening-800-190", "kind": "mcp", "official": null, "desc": "Reads a Dockerfile or compose file and names the hardening controls it fails, with the NIST SP 800-1", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/container-hardening-800-190"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "nist sp 800-190", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/license-flip-audit", "name": "io.github.jmshinhwa/license-flip-audit", "kind": "mcp", "official": null, "desc": "Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitna", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/license-flip-audit"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "licenses", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/lit-binding-xss-audit", "name": "io.github.jmshinhwa/lit-binding-xss-audit", "kind": "mcp", "official": null, "desc": "Finds the lit-html binding positions auto-escaping does not cover, before the component ships", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/lit-binding-xss-audit"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "lit-html", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/openapi-security-contract-lint", "name": "io.github.jmshinhwa/openapi-security-contract-lint", "kind": "mcp", "official": null, "desc": "Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in th", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/openapi-security-contract-lint"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/pqc-deprecation-lint", "name": "io.github.jmshinhwa/pqc-deprecation-lint", "kind": "mcp", "official": null, "desc": "Dates every quantum-vulnerable algorithm in your code against the NIST IR 8547 clock: deprecated aft", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/pqc-deprecation-lint"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "nist", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/romu-hozon-kikan-lint-jp", "name": "io.github.jmshinhwa/romu-hozon-kikan-lint-jp", "kind": "mcp", "official": null, "desc": "法定帳簿の保存期間を文書保存期間表で検査 — 労基法109条・安衛則51条・石綿則41条・雇用保険法施行規則143条・健保則34条（20 rules）", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/romu-hozon-kikan-lint-jp"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "japanese labor laws", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/security-headers-csp-lint", "name": "io.github.jmshinhwa/security-headers-csp-lint", "kind": "mcp", "official": null, "desc": "Reads security headers and CSP line by line in your config file and names the lines that silently do", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/security-headers-csp-lint"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "content security policy", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/security-txt-cra-lint", "name": "io.github.jmshinhwa/security-txt-cra-lint", "kind": "mcp", "official": null, "desc": "13 rules that decide whether a vulnerability report ever reaches you", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/security-txt-cra-lint"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "security.txt", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jmshinhwa/ssdf-attestation-workflow-audit", "name": "io.github.jmshinhwa/ssdf-attestation-workflow-audit", "kind": "mcp", "official": null, "desc": "14 rules, four CISA attestation sections, one workflow file", "repo": "https://github.com/jmshinhwa/readystack-themes", "install": ["npm:@readystack/ssdf-attestation-workflow-audit"], "stars": 1, "pushed": "2026-11-02T04:17:54Z", "license": "NOASSERTION", "plat": "cisa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kjgueye/netintel-mcp", "name": "io.github.kjgueye/netintel-mcp", "kind": "mcp", "official": null, "desc": "MCP server for NetIntel — DNS, SSL, WHOIS, email security, OSINT via x402 micropayments", "repo": "https://github.com/kjgueye/netintel-mcp", "install": ["npm:netintel-mcp"], "stars": 1, "pushed": "2026-10-28T23:12:34Z", "license": "MIT", "plat": "netintel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.krunalsolanki/ofac-match", "name": "io.github.krunalsolanki/ofac-match", "kind": "mcp", "official": null, "desc": "Explainable OFAC sanctions name screening against the SDN list. Runs locally, no API key.", "repo": "https://github.com/krunalsolanki/ofac-match", "install": ["nuget:OfacMatch.Mcp"], "stars": 1, "pushed": "2026-11-05T18:12:46Z", "license": "Apache-2.0", "plat": "ofac", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lucaslubi/fidacy-mcp", "name": "io.github.lucaslubi/fidacy-mcp", "kind": "mcp", "official": null, "desc": "AI Agent Firewall. Enforce signed authority before consequential actions. Free API key required.", "repo": "https://github.com/lucaslubi/fidacy-mcp", "install": ["npm:@fidacy/mcp"], "stars": 1, "pushed": "2026-08-04T23:36:11Z", "license": "Apache-2.0", "plat": "ai agent firewall", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mcp-protocol/node-runtime", "name": "io.github.mcp-protocol/node-runtime", "kind": "mcp", "official": null, "desc": "This package is intended for demonstration only. Maintained by JFrog Security.", "repo": "https://github.com/mcp-protocol/node-runtime", "install": ["npm:@mcp-protocol/node-runtime"], "stars": 1, "pushed": "2026-02-25T11:23:52Z", "license": null, "plat": "jfrog", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nan786521/recon-kit-mcp", "name": "io.github.nan786521/recon-kit-mcp", "kind": "mcp", "official": null, "desc": "Read-only network & security recon tools (DNS, TLS, headers, CORS) for AI agents, each graded.", "repo": "https://github.com/nan786521/recon-mcp", "install": ["pypi:recon-kit-mcp"], "stars": 1, "pushed": "2026-09-08T04:02:13Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.normancomics/phantomoperator", "name": "io.github.normancomics/phantomoperator", "kind": "mcp", "official": null, "desc": "Authorized privacy and exposure checks for people and agents; USDC on Base via x402.", "repo": "https://github.com/normancomics/PhantomOperator", "install": ["https://freysaai.freysa.dev/mcp"], "stars": 1, "pushed": "2026-11-12T21:41:34Z", "license": "MIT", "plat": "", "live": "Live · 689 ms · 11 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Omodaka9375/netexpert-mcp", "name": "io.github.Omodaka9375/netexpert-mcp", "kind": "mcp", "official": null, "desc": "Cross-platform local-network diagnostics & security-posture MCP server — 31 tools.", "repo": "https://github.com/Omodaka9375/netexpert-mcp", "install": ["npm:netexpert-mcp"], "stars": 1, "pushed": "2026-10-24T00:57:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rijul170/sophos-central-mcp", "name": "io.github.rijul170/sophos-central-mcp", "kind": "mcp", "official": null, "desc": "MCP server for Sophos Central — endpoint security, XDR/MDR, and MSSP multi-tenant ops", "repo": "https://github.com/rijul170/sophos-central-mcp", "install": ["npm:@rijul170/sophos-mcp"], "stars": 1, "pushed": "2026-07-26T18:58:09Z", "license": "MIT", "plat": "sophos central", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rom-baro/arcwall-security", "name": "io.github.rom-baro/arcwall-security", "kind": "mcp", "official": null, "desc": "Security scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks.", "repo": "https://github.com/rom-baro/arcwall-mcp", "install": ["npm:@arcwall/mcp-server"], "stars": 1, "pushed": "2026-05-07T02:10:44Z", "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sergii-ziborov/weavatrix-online", "name": "io.github.sergii-ziborov/weavatrix-online", "kind": "mcp", "official": null, "desc": "Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.", "repo": "https://github.com/sergii-ziborov/weavatrix-online", "install": ["npm:weavatrix-online"], "stars": 1, "pushed": "2026-08-24T15:12:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shahidh68/audit-ledger-mcp", "name": "io.github.shahidh68/audit-ledger-mcp", "kind": "mcp", "official": null, "desc": "Record AI decisions to a tamper-evident audit ledger from any MCP-compatible agent.", "repo": "https://github.com/shahidh68/audit-ledger-mcp", "install": ["npm:audit-ledger-mcp"], "stars": 1, "pushed": "2026-07-06T22:10:41Z", "license": "Apache-2.0", "plat": "audit ledger", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stasxr/palanit-core", "name": "io.github.stasxr/palanit-core", "kind": "mcp", "official": null, "desc": "Scan MCP servers and agent tool manifests for poisoning, exfiltration, secrets and supply-chain risk", "repo": "https://github.com/stasxr/palanit-core", "install": ["pypi:palanit-core"], "stars": 1, "pushed": "2026-10-30T12:18:14Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.thegridwork/privacy", "name": "io.github.thegridwork/privacy", "kind": "mcp", "official": null, "desc": "Audit websites for GDPR, CCPA, and ePrivacy compliance — trackers, consent, and policies.", "repo": "https://github.com/thegridwork/privacy", "install": ["npm:gridwork-privacy"], "stars": 1, "pushed": "2026-04-12T11:32:21Z", "license": null, "plat": "websites", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Toraastrta/sphior-code-mcp", "name": "io.github.Toraastrta/sphior-code-mcp", "kind": "mcp", "official": null, "desc": "Deterministic security findings + fix guidance for your AI agent. Runs locally, no account needed.", "repo": "https://github.com/Toraastrta/sphior-code", "install": ["npm:sphior-code-mcp"], "stars": 1, "pushed": "2026-11-12T00:26:34Z", "license": "MIT", "plat": "ai agent", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.viridis-security/injection-detector", "name": "io.github.viridis-security/injection-detector", "kind": "mcp", "official": null, "desc": "Formally-verified injection/exfiltration detector for AI agents (MCP-02).", "repo": "https://github.com/viridis-security/mcp-services-sdk", "install": ["https://mcp.viridis-security.com/mcp"], "stars": 1, "pushed": "2026-11-01T15:42:41Z", "license": "Apache-2.0", "plat": "", "live": "Live · 526 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Weavatrix/weavatrix-online", "name": "io.github.Weavatrix/weavatrix-online", "kind": "mcp", "official": null, "desc": "Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.", "repo": "https://github.com/Weavatrix/weavatrix-online", "install": ["npm:weavatrix-online"], "stars": 1, "pushed": "2026-08-24T15:12:12Z", "license": "MIT", "plat": "weavatrix", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wgd5678/license-sentinel", "name": "io.github.wgd5678/license-sentinel", "kind": "mcp", "official": null, "desc": "Audit Python and npm dependency licenses before you ship, judged against how you distribute.", "repo": "https://github.com/wgd5678/license-sentinel", "install": ["pypi:license-sentinel"], "stars": 1, "pushed": "2026-09-14T11:45:23Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.zapsoblige-hash/policyvault", "name": "io.github.zapsoblige-hash/policyvault", "kind": "mcp", "official": null, "desc": "Non-custodial Kaspa policy enforcement for AI agents; signers retain custody.", "repo": "https://github.com/zapsoblige-hash/PolicyVault", "install": ["npm:policyvault-mcp"], "stars": 1, "pushed": "2026-10-16T10:09:05Z", "license": "Apache-2.0", "plat": "kaspa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Iteksmart/mcp-server", "name": "iTechSmart UAIO", "kind": "mcp", "official": null, "desc": "Connect AI agents to iTechSmart UAIO, ProofLink verification, and autonomous IT operations.", "repo": "https://github.com/Iteksmart/mcp-server", "install": ["npm:@itechsmart/mcp-server", "https://mcp.itechsmart.dev/sse"], "stars": 1, "pushed": "2026-07-19T02:00:05Z", "license": "MIT", "plat": "it operations", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/kisi", "name": "Kisi MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Read Kisi places, doors, users, groups, access rights and access logs (no unlocking).", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://kisi.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "kisi", "live": "Live · 442 ms · 20 tools · `kisi_get_lock` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.kosa8ai/kosa8", "name": "kosa8", "kind": "mcp", "official": null, "desc": "Sealed microVM sandboxes for AI agents: run untrusted code locally or in kosa8 Cloud.", "repo": "https://github.com/kosa8ai/kosa8-claude-plugin", "install": ["mcpb:https://github.com/kosa8ai/kosa8-claude-plugin/releases/download/v0.1.0/kosa8-mcp.mcpb", "https://api.kosa8.com/mcp"], "stars": 1, "pushed": "2026-11-12T08:08:10Z", "license": "MIT", "plat": "kosa8", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jamesdfinance-dev/lazaretto", "name": "Lazaretto", "kind": "mcp", "official": null, "desc": "Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.", "repo": "https://github.com/jamesdfinance-dev/lazaretto-mcp", "install": ["npm:lazaretto-mcp", "https://lazaretto.dev/mcp"], "stars": 1, "pushed": "2026-11-04T22:16:44Z", "license": "MIT", "plat": "lazaretto", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.droideck/ldap-assistant-mcp", "name": "LDAP Assistant MCP", "kind": "mcp", "official": null, "desc": "MCP server for 389 Directory Server health diagnostics, log analysis, and SOS-report investigation", "repo": "https://github.com/droideck/ldap-assistant-mcp", "install": ["pypi:ldap-assistant-mcp"], "stars": 1, "pushed": "2026-10-30T02:25:17Z", "license": "GPL-3.0", "plat": "389 directory server", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.caiderek/logcarverguard", "name": "LogCarverGuard", "kind": "mcp", "official": null, "desc": "Guardrail for AI agents on SQL Server: statement blocking, optional read-only mode and an audit log.", "repo": "https://github.com/caiderek/LogCarverGuard", "install": ["nuget:LogCarverGuard.Local"], "stars": 1, "pushed": "2026-11-05T01:12:53Z", "license": "MIT", "plat": "sql server", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.tangfei7777-cell/mcp-output-firewall", "name": "MCP Output Firewall", "kind": "mcp", "official": null, "desc": "Three-layer firewall for MCP: content, egress and action policy. Proxy or server.", "repo": "https://github.com/tangfei7777-cell/mcp-output-firewall", "install": ["npm:mcp-output-firewall"], "stars": 1, "pushed": "2026-10-23T04:51:43Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.mcpqueen/registry", "name": "MCP Queen", "kind": "mcp", "official": null, "desc": "The evidence layer for MCP: live operational grades plus Trust Receipts for every registry server.", "repo": "https://github.com/mcpqueen/mcpqueen", "install": ["https://mcpqueen.com/mcp"], "stars": 1, "pushed": "2026-09-13T15:28:33Z", "license": "MIT", "plat": "", "live": "Live · 12667 ms · 7 tools · free to try: `search_servers` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.studiomeyer/armor", "name": "mcp-armor", "kind": "mcp", "official": null, "desc": "Security sidecar for MCP servers: 11 read-only control-plane tools for prompt-injection checks.", "repo": "https://github.com/studiomeyer-io/mcp-armor", "install": ["oci:ghcr.io/studiomeyer-io/mcp-armor:0.8.2"], "stars": 1, "pushed": "2026-11-09T11:35:34Z", "license": "MIT", "plat": "mcp-armor", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.gentaArnezzi/mcpsentinel", "name": "MCPSentinel", "kind": "mcp", "official": null, "desc": "Precision-first security scanning for Model Context Protocol servers.", "repo": "https://github.com/gentaArnezzi/MCPSentinel", "install": ["pypi:mcp-guardian-scan"], "stars": 1, "pushed": "2026-11-06T08:14:27Z", "license": "MIT", "plat": "mcpsentinel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/mimecast-mcp", "name": "Mimecast", "kind": "mcp", "official": null, "desc": "MCP server for Mimecast email security: message queue, held messages, domains, and threats.", "repo": "https://github.com/wyre-technology/mimecast-mcp", "install": ["oci:ghcr.io/wyre-technology/mimecast-mcp:v1.3.5"], "stars": 1, "pushed": "2026-11-12T16:49:40Z", "license": "Apache-2.0", "plat": "mimecast", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/onfido", "name": "Onfido MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Create and read Onfido applicants, documents, checks and reports.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://onfido.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "", "live": "Live · 544 ms · 14 tools · `onfido_list_applicants` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.d3ltasecurity/opnsense-guard-mcp", "name": "OPNsense Guard", "kind": "mcp", "official": null, "desc": "Safety-first OPNsense firewall MCP: read-only by default, planned and auto-reverting writes.", "repo": "https://github.com/d3ltasecurity/opnsense-guard-mcp", "install": ["pypi:opnsense-guard-mcp"], "stars": 1, "pushed": "2026-11-09T09:45:01Z", "license": "MIT", "plat": "opnsense", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.polymatx/opsgate", "name": "opsgate", "kind": "mcp", "official": null, "desc": "The safety gate between AI agents and your servers: typed, policy-checked, audited ops tools.", "repo": "https://github.com/polymatx/opsgate", "install": ["oci:ghcr.io/polymatx/opsgate:0.1.3"], "stars": 1, "pushed": "2026-10-18T19:00:49Z", "license": "MIT", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.basitalisandhu/mcp-osv-advisories", "name": "OSV Advisories", "kind": "mcp", "official": null, "desc": "Query OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch.", "repo": "https://github.com/basitalisandhu/dev-mcp-servers", "install": ["oci:ghcr.io/basitalisandhu/mcp-osv-advisories:0.3.0"], "stars": 1, "pushed": "2026-11-12T23:56:39Z", "license": "MIT", "plat": "osv.dev", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.abelreqma/oxiploitability-mcp", "name": "Oxiploitability", "kind": "mcp", "official": null, "desc": "Sourced, evidence-aware CVE research for CVEs, products, SBOMs and images via NVD, EPSS, KEV, OSV.", "repo": "https://github.com/abelreqma/oxiploitability-mcp", "install": ["cargo:oxiploitability-mcp"], "stars": 1, "pushed": "2026-10-23T00:16:22Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pageguard/pageguard-mcp", "name": "PageGuard MCP", "kind": "mcp", "official": null, "desc": "Privacy compliance scanning for AI coding tools. Detects tracking tech, cookies, and data gaps.", "repo": "https://github.com/pageguard/pageguard-mcp", "install": ["npm:pageguard-mcp"], "stars": 1, "pushed": "2026-04-07T01:16:42Z", "license": "MIT", "plat": "ai coding tools", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.PassTunnel/passtunnel", "name": "PassTunnel", "kind": "mcp", "official": null, "desc": "macOS OpenVPN/FortiGate VPN status, logs and diagnosis; read-only by default, never returns secrets", "repo": "https://github.com/PassTunnel/passtunnel", "install": ["mcpb:https://github.com/passtunnel/passtunnel/releases/download/v1.8.0/PassTunnel-mcp-1.8.0.mcpb"], "stars": 1, "pushed": "2026-11-11T20:41:47Z", "license": "MIT", "plat": "openvpn/fortigate", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.GodSmasher/patchbay", "name": "patchbay", "kind": "mcp", "official": null, "desc": "Audit any remote MCP server for OAuth 2.1 and security gaps.", "repo": "https://github.com/GodSmasher/patchbay", "install": ["npm:@patchbay-nebius/mcp"], "stars": 1, "pushed": "2026-11-12T10:54:10Z", "license": "MIT", "plat": "mcp server", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nouchix/pqc-khepra-mcp", "name": "PQC-Khepra MCP — CMMC Autopilot & AI Security Recorder", "kind": "mcp", "official": null, "desc": "Post-quantum CMMC compliance scanner & AI agent attestation. FIPS 140-3, ML-DSA-65, 36K+ mappings.", "repo": "https://github.com/nouchix/PQC-Khepra-MCP.git", "install": ["oci:ghcr.io/nouchix/pqc-khepra-mcp:v1.0.0"], "stars": 1, "pushed": "2026-11-10T19:42:31Z", "license": "NOASSERTION", "plat": "post-quantum", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.microtoll/pqc-scan", "name": "pqc-scan", "kind": "mcp", "official": null, "desc": "The cryptography a JavaScript or TypeScript codebase uses, and which a quantum computer would break.", "repo": "https://github.com/microtoll/pqc-scan", "install": ["npm:@microtoll/pqc-scan"], "stars": 1, "pushed": "2026-10-06T22:01:34Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.tanod/security", "name": "Pre-transaction Safety Checks (Tanod)", "kind": "mcp", "official": null, "desc": "Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC.", "repo": "https://github.com/tanod-labs/tanod-mcp", "install": ["https://tanod.dev/mcp/security"], "stars": 1, "pushed": "2026-11-10T06:04:56Z", "license": "MIT", "plat": "tanod", "live": "Live · 6113 ms · 28 tools · free to try: `check_sanctions` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.GuardianVigil-Labs/prufgate", "name": "PrufGate", "kind": "mcp", "official": null, "desc": "Read-only tools that check whether code, and the tests that claim it works, are real.", "repo": "https://github.com/GuardianVigil-Labs/Prufgate", "install": ["pypi:prufgate"], "stars": 1, "pushed": "2026-11-10T02:34:59Z", "license": "Apache-2.0", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.moncef00327-cloud/quantum-aether", "name": "Quantum Aether", "kind": "mcp", "official": null, "desc": "Measure post-quantum TLS evidence and buy full reports through x402 USDC on Base", "repo": "https://github.com/moncef00327-cloud/quantum-aether", "install": ["pypi:quantum-aether-mcp", "https://ather-quantum.com/mcp"], "stars": 1, "pushed": "2026-11-13T01:37:22Z", "license": "MIT", "plat": "quantum aether", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/remotelock", "name": "RemoteLock MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Read RemoteLock devices and guests; manage door access and physically lock or unlock doors.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://remotelock.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "remotelock", "live": "Live · 421 ms · 20 tools · `remotelock_get_account` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.mechubsec/rustpanosmcp", "name": "rust-panosmcp", "kind": "mcp", "official": null, "desc": "PAN-OS firewall MCP server: scoped, audited, two-person change control. Rust.", "repo": "https://github.com/mechubsec/rustpanosmcp", "install": ["oci:ghcr.io/mechubsec/rustpanosmcp:0.17.1"], "stars": 1, "pushed": "2026-11-10T15:05:04Z", "license": "MIT", "plat": "pan-os firewall", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mechubsec/rustmistmcp", "name": "rustmistmcp", "kind": "mcp", "official": null, "desc": "HPE Juniper Mist MCP server: scoped, audited, two-person change control. Rust.", "repo": "https://github.com/mechubsec/rustmistmcp", "install": ["oci:ghcr.io/mechubsec/rustmistmcp:0.5.2"], "stars": 1, "pushed": "2026-11-12T16:28:47Z", "license": "MIT", "plat": "hpe juniper mist", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mechubsec/rustsdcmcp", "name": "rustsdcmcp", "kind": "mcp", "official": null, "desc": "Juniper Security Director Cloud MCP server: scoped, audited change control. Rust.", "repo": "https://github.com/mechubsec/rustsdcmcp", "install": ["oci:ghcr.io/mechubsec/rustsdcmcp:0.7.0"], "stars": 1, "pushed": "2026-11-10T03:45:12Z", "license": "MIT", "plat": "juniper security director cloud", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mechubsec/rustunifimcp", "name": "rustunifimcp", "kind": "mcp", "official": null, "desc": "UniFi Network MCP server: scoped tools, audited two-person change control. Rust.", "repo": "https://github.com/mechubsec/rustunifimcp", "install": ["oci:ghcr.io/mechubsec/rustunifimcp:0.6.14"], "stars": 1, "pushed": "2026-11-12T18:12:00Z", "license": "MIT", "plat": "unifi network", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.odaiameera/scamgate", "name": "scamgate", "kind": "mcp", "official": null, "desc": "Offline scam check for agents: verify links and payments before acting (allow, ask or deny).", "repo": "https://github.com/odaiameera/scamgate", "install": ["pypi:scamgate"], "stars": 1, "pushed": "2026-10-31T22:45:39Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.scanmalware.mcp/scanmalware-mcp", "name": "ScanMalware.com URL Scanner", "kind": "mcp", "official": null, "desc": "MCP server for ScanMalware.com URL scanning, malware detection, and analysis.", "repo": "https://github.com/scanmalware/mcp-server", "install": ["https://mcp.scanmalware.com/mcp"], "stars": 1, "pushed": "2026-11-12T17:43:29Z", "license": "Apache-2.0", "plat": "scanmalware.com", "live": "Live · 7842 ms · 145 tools · free to try: `search_ocr` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.omarmohelal/sechelix", "name": "SecHelix", "kind": "mcp", "official": null, "desc": "Evidence-first security review of authorized repositories. Read-only, root-confined, no shell.", "repo": "https://github.com/omarmohelal/SecHelix", "install": ["pypi:sechelix"], "stars": 1, "pushed": "2026-10-30T00:17:14Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:one.seclens/seclens", "name": "SecLens.ONE Email Security", "kind": "mcp", "official": null, "desc": "Assess any domain's email security across SPF, DMARC, DKIM, MTA-STS, DNSSEC, DANE, and TLS-RPT.", "repo": "https://github.com/42Sec-Pte-Ltd/seclens", "install": ["https://seclens.one/mcp"], "stars": 1, "pushed": "2026-10-27T13:18:45Z", "license": "Apache-2.0", "plat": "", "live": "Live · 6701 ms · 3 tools · free to try: `get_summary` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.basitalisandhu/mcp-security-headers", "name": "Security Headers", "kind": "mcp", "official": null, "desc": "Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.", "repo": "https://github.com/basitalisandhu/dev-mcp-servers", "install": ["oci:ghcr.io/basitalisandhu/mcp-security-headers:0.3.0"], "stars": 1, "pushed": "2026-11-12T23:56:39Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kaitzyy-dev/sighttrue", "name": "Sighttrue", "kind": "mcp", "official": null, "desc": "Measured readings on open-source dependencies: health, end-of-life, model prices, incidents.", "repo": "https://github.com/kaitzyy-dev/sighttrue", "install": ["https://sighttrue.com/api/mcp"], "stars": 1, "pushed": "2026-11-13T01:33:53Z", "license": "MIT", "plat": "", "live": "Live · 2126 ms · 31 tools · free to try: `check_package` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.RunTimeAdmin/sigvara", "name": "Sigvara", "kind": "mcp", "official": null, "desc": "Read-only checks of an AI agent's Sigvara standing, score, stake and slashes before you rely on it.", "repo": "https://github.com/RunTimeAdmin/Sigvara", "install": ["npm:@sigvara/protocol-sdk"], "stars": 1, "pushed": "2026-11-14T02:40:47Z", "license": "MIT", "plat": "sigvara", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Timothymycompc/solana-pulse-gateway", "name": "Solana Pulse: agent safety layer", "kind": "mcp", "official": null, "desc": "Dry-run Solana txs before agents sign: exact balance changes, intent match, token traps. 25 free/day", "repo": "https://github.com/Timothymycompc/solana-pulse-ai-agent-gateway", "install": ["https://solana-pulse-gateway-1021990235790.us-central1.run.app/mcp"], "stars": 1, "pushed": "2026-11-13T03:17:39Z", "license": "MIT", "plat": "solana", "live": "Live · 1513 ms · 19 tools · free to try: `tx_version` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.kajaril/sovereignty-scan-mcp", "name": "Sovereignty Scan", "kind": "mcp", "official": null, "desc": "EU AI Act sovereignty scanning. Provider residency, registration status, audit trail support.", "repo": "https://github.com/kajaril/sovereignty-scan-mcp", "install": ["https://sovereignty-scan.kajaril.com/mcp"], "stars": 1, "pushed": "2026-09-10T01:32:04Z", "license": "MIT", "plat": "eu ai act", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/teramind-mcp", "name": "Teramind", "kind": "mcp", "official": null, "desc": "MCP server for Teramind's insider-threat/employee-monitoring API (read-only, metadata-only surface).", "repo": "https://github.com/WYRE-AI/teramind-mcp", "install": ["oci:ghcr.io/wyre-ai/teramind-mcp:v1.0.1"], "stars": 1, "pushed": "2026-11-12T17:01:14Z", "license": "NOASSERTION", "plat": "teramind", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/threatlocker-mcp", "name": "ThreatLocker", "kind": "mcp", "official": null, "desc": "MCP server for ThreatLocker — zero-trust endpoint protection, allowlisting, and policies.", "repo": "https://github.com/WYRE-AI/threatlocker-mcp", "install": ["oci:ghcr.io/wyre-ai/threatlocker-mcp:v1.4.1"], "stars": 1, "pushed": "2026-11-12T18:06:11Z", "license": "NOASSERTION", "plat": "threatlocker", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/threatlocker-mcp", "name": "ThreatLocker", "kind": "mcp", "official": null, "desc": "MCP server for ThreatLocker — zero-trust endpoint protection, allowlisting, and policies.", "repo": "https://github.com/wyre-technology/threatlocker-mcp", "install": ["oci:ghcr.io/wyre-technology/threatlocker-mcp:v1.3.6"], "stars": 1, "pushed": "2026-11-12T18:06:11Z", "license": "NOASSERTION", "plat": "threatlocker", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ECD5A/tkach-security", "name": "Tkach Security", "kind": "mcp", "official": null, "desc": "Fail-closed MCP adapter for untrusted model output over a local Tkach runtime.", "repo": "https://github.com/ECD5A/Tkach-Security", "install": ["cargo:tkach-mcp"], "stars": 1, "pushed": "2026-09-19T17:29:50Z", "license": "Apache-2.0", "plat": "tkach", "live": "Not checked (runs locally)"}, {"id": "mcp:io.usefulapi/trestle", "name": "Trestle MCP by usefulapi", "kind": "mcp", "official": null, "desc": "Validate phone numbers, line types and TCPA litigator risk in Trestle.", "repo": "https://github.com/m190/usefulapi-mcp", "install": ["https://trestle.usefulapi.io/mcp"], "stars": 1, "pushed": "2026-11-13T06:39:36Z", "license": "MIT", "plat": "trestle", "live": "Live · 575 ms · 2 tools · `trestle_check_tcpa_litigator` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.DevInder1/tridentchain-security", "name": "TridentChain Security", "kind": "mcp", "official": null, "desc": "Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.", "repo": "https://github.com/DevInder1/supply-chain-scanner-public", "install": ["pypi:tridentchain-mcp"], "stars": 1, "pushed": "2026-10-28T06:03:32Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.smilemino/unchore-defend", "name": "Unchore Defend", "kind": "mcp", "official": null, "desc": "Grade a site's security headers with fixes and a badge; read logs or code for the defender.", "repo": "https://github.com/smilemino/unchore-defend", "install": ["mcpb:https://github.com/smilemino/unchore-defend/releases/download/v0.1.0/unchore-defend.mcpb"], "stars": 1, "pushed": "2026-10-03T03:25:21Z", "license": "MIT", "plat": "site's security headers", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.OjasKord/url-safety-validator-mcp", "name": "URL Safety Validator MCP", "kind": "mcp", "official": null, "desc": "AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.", "repo": "https://github.com/OjasKord/url-safety-validator-mcp", "install": ["npm:url-safety-validator-mcp", "https://url-safety-validator-mcp-production.up.railway.app"], "stars": 1, "pushed": "2026-09-07T12:34:50Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.heidihelena/vahtian", "name": "Vahtian", "kind": "mcp", "official": null, "desc": "Freeze a corpus, check it for drift, keep a hash-chained audit ledger. Local-first, stdlib-only.", "repo": "https://github.com/heidihelena/vahtian", "install": ["pypi:vahtian"], "stars": 1, "pushed": "2026-08-05T11:26:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.verfy-dev/verfy", "name": "Verfy", "kind": "mcp", "official": null, "desc": "Ask before acting: would a command run, is an MCP config risky, what do the receipts say", "repo": "https://github.com/verfy-dev/verfy", "install": ["pypi:verfy"], "stars": 1, "pushed": "2026-11-13T18:55:44Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Adityarajtiwari880/verisight", "name": "VeriSight MCP", "kind": "mcp", "official": null, "desc": "Sub-3ms OpenCV 5 image forensics, deepfake, AI inpainting & tamper fraud detection MCP.", "repo": "https://github.com/Adityarajtiwari880/verisight", "install": ["pypi:verisight"], "stars": 1, "pushed": "2026-11-12T13:04:25Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:cloud.coredls.vigia/vigia", "name": "Vigía", "kind": "mcp", "official": null, "desc": "What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.", "repo": "https://github.com/MatiasDelosSantos/vigia", "install": ["https://vigia.coredls.cloud/mcp"], "stars": 1, "pushed": "2026-10-31T23:25:39Z", "license": "AGPL-3.0", "plat": "", "live": "Live · 4485 ms · 12 tools · free to try: `model_status` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.dytredline/vulkill-security", "name": "VulKill Security", "kind": "mcp", "official": null, "desc": "Autonomous AppSec & DAST scanner across 12 security domains (260+ controls) with 3-Layer Triage.", "repo": "https://github.com/dytredline/VulKill", "install": ["https://app.vulkill.com/api/mcp"], "stars": 1, "pushed": "2026-11-06T14:48:44Z", "license": "Apache-2.0", "plat": "vulkill", "live": "Live · 2432 ms · 12 tools · `search` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.MRFrazer25/vulnerability-exposure-mcp", "name": "Vulnerability Exposure", "kind": "mcp", "official": null, "desc": "Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)", "repo": "https://github.com/MRFrazer25/Vulnerability-Exposure-MCP", "install": ["pypi:vulnerability-exposure-mcp"], "stars": 1, "pushed": "2026-11-12T19:54:36Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.vulntracker/mcp", "name": "VulnTracker", "kind": "mcp", "official": null, "desc": "CVEs, affected versions and fix versions for your dependencies, from an affected-version ledger.", "repo": "https://github.com/vulntracker/vulntracker-mcp", "install": ["https://api.vulntracker.io/mcp"], "stars": 1, "pushed": "2026-11-10T07:17:35Z", "license": "MIT", "plat": "vulntracker", "live": "Live · 1752 ms · 15 tools · `search_cves` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.maebsy/72hours", "name": "72hours security check", "kind": "mcp", "official": null, "desc": "Scan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.", "repo": "https://github.com/maebsy/YMCA-hackathon-2026", "install": ["https://oboe-handiness-enroll.ngrok-free.dev/mcp/service/rpc"], "stars": 0, "pushed": "2026-11-01T03:54:57Z", "license": null, "plat": "github", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.GregDog/mcp-server-abnormal", "name": "Abnormal MCP Server", "kind": "mcp", "official": null, "desc": "Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.", "repo": "https://github.com/GregDog/mcp-server-abnormal", "install": ["oci:ghcr.io/gregdog/mcp-server-abnormal:v1.1.0"], "stars": 0, "pushed": "2026-11-05T16:34:24Z", "license": "Apache-2.0", "plat": "abnormal security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/abnormal-mcp", "name": "Abnormal Security", "kind": "mcp", "official": null, "desc": "MCP server for Abnormal Security — AI-powered email threat detection, cases, and remediation.", "repo": "https://github.com/WYRE-AI/abnormal-mcp", "install": ["oci:ghcr.io/wyre-ai/abnormal-mcp:v1.2.7"], "stars": 0, "pushed": "2026-11-12T16:57:13Z", "license": "Apache-2.0", "plat": "abnormal security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/abuseipdb", "name": "Abuseipdb", "kind": "mcp", "official": null, "desc": "AbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)", "repo": "https://github.com/pipeworx-io/mcp-abuseipdb", "install": ["npm:@pipeworx/mcp-abuseipdb", "https://gateway.pipeworx.io/abuseipdb/mcp"], "stars": 0, "pushed": "2026-11-09T13:20:09Z", "license": "MIT", "plat": "abuseipdb", "live": "Not checked (runs locally)"}, {"id": "mcp:com.acidpeak/acidpeak", "name": "AcidPeak", "kind": "mcp", "official": null, "desc": "Read-only vulnerability intelligence: CVEs, exploitation evidence, fixes and product matches.", "repo": null, "install": ["https://www.acidpeak.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1884 ms · 10 tools · free to try: `find_products` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/acronis-mcp", "name": "Acronis Cyber Protect Cloud", "kind": "mcp", "official": null, "desc": "Acronis Cyber Protect Cloud MCP: alerts, policies, resources, agents, tenants and EDR incidents.", "repo": "https://github.com/WYRE-AI/acronis-mcp", "install": ["oci:ghcr.io/wyre-ai/acronis-mcp:v1.0.3"], "stars": 0, "pushed": "2026-11-12T16:54:25Z", "license": "NOASSERTION", "plat": "acronis cyber protect cloud", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lsendel/actionguard", "name": "ActionGuard Protocol Inspector Agent", "kind": "mcp", "official": null, "desc": "Diff and poisoning detection for MCP servers: catch schema drift and prompt poisoning.", "repo": "https://github.com/lsendel/actionguard", "install": ["https://actionguard.ai/mcp"], "stars": 0, "pushed": "2026-11-07T16:22:45Z", "license": null, "plat": "", "live": "Live · 1175 ms · 2 tools · free to try: `actionguard_check_drift` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.netbasecorp/adminkit-mcp", "name": "AdminKit", "kind": "mcp", "official": null, "desc": "Network, DNS, mail-auth and MCP endpoint security checks for AI agents, backed by adminkit.net.", "repo": "https://github.com/netbasecorp/adminkit-mcp", "install": ["pypi:adminkit-mcp"], "stars": 0, "pushed": "2026-11-12T10:03:08Z", "license": "MIT", "plat": "adminkit.net", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.verrysimatupang99/aegis", "name": "Aegis", "kind": "mcp", "official": null, "desc": "Charter-bound defensive security copilot: secrets, obfuscation, deps, Dockerfile, IaC scans.", "repo": "https://github.com/verrysimatupang99/aegis", "install": ["pypi:aegis-sec"], "stars": null, "pushed": null, "license": null, "plat": "dockerfile, iac", "live": "Not checked (runs locally)"}, {"id": "mcp:solutions.int-tech/events", "name": "AEGIS Events", "kind": "mcp", "official": null, "desc": "Read-only search of security events from the news by place, point and radius, category and date.", "repo": "https://github.com/inttech-solutions/events-mcp", "install": ["https://mcp.int-tech.solutions"], "stars": 0, "pushed": "2026-11-11T11:18:02Z", "license": "NOASSERTION", "plat": "security events", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.kadopi/aegis-ai", "name": "AegisAI", "kind": "mcp", "official": null, "desc": "Paid pre-execution risk verification for AI agents over MCP and x402.", "repo": null, "install": ["https://aegis-api.kadopi.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai agents", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:ai.afmr/discovery", "name": "AFMR Discovery", "kind": "mcp", "official": null, "desc": "Read AFMR failure modes and discover scoped attestation and lift-evidence contracts.", "repo": null, "install": ["https://afmr.ai/mcp", "https://afmr.ai/api/rpc"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1066 ms · 4 tools · free to try: `get_reputation_attestation_contract` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.kwekuanansi/africa-scam-check", "name": "Africa Scam Check", "kind": "mcp", "official": null, "desc": "Fraud patterns a message or call resembles in Kenya and Nigeria, and where to report.", "repo": null, "install": ["https://kwekuanansi.ai/mcp/africa-scam-check"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 5356 ms · 3 tools · free to try: `africa_scams.list_patterns` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.gmahar82-stack/agent-deals", "name": "Agent Deals", "kind": "mcp", "official": null, "desc": "Pay less for x402 APIs: free pre-payment checks, cheapest working service finder, web/PDF reader.", "repo": null, "install": ["https://agent-deals.gm-tools.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "trust check", "live": "Live · 1284 ms · 5 tools · `read_web_page` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.bluecloudcyber/guestbook", "name": "Agent Guestbook", "kind": "mcp", "official": null, "desc": "Read and verify the Blue Cloud Cyber agent guestbook, and sign one Ed25519 entry per UTC day.", "repo": null, "install": ["npm:@bluecloudcyberai/guestbook-mcp"], "stars": null, "pushed": null, "license": null, "plat": "blue cloud cyber", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.sdnscreen.sdn-screen-x402/agent-preflight", "name": "Agent Preflight: OFAC, DNS, Email Auth, Domain, Email & URL", "kind": "mcp", "official": null, "desc": "$0.01/call via x402: OFAC wallet screen, DNS, email auth, domain age, email verify, URL unshorten.", "repo": null, "install": ["https://sdn-screen-x402.sdnscreen.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1509 ms · 6 tools · `email_auth_check` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.soldanoandrea/agent-risk-desk", "name": "Agent Risk Desk", "kind": "mcp", "official": null, "desc": "EVM address enrichment, counterparty risk and tx screening for agents, paid per call in USDC (x402)", "repo": null, "install": ["https://x402-services.soldano.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1750 ms · 7 tools · free to try: `list_services` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.oroboros-design.angel/tradesignal", "name": "Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)", "kind": "mcp", "official": null, "desc": "Checks before an agent acts: prompt-injection scan, honeypot check, x402 preflight. 3 free calls.", "repo": null, "install": ["https://angel.oroboros-design.com/agenten/signal/mcp"], "stars": null, "pushed": null, "license": null, "plat": "agent safety checks", "live": "Live · 2181 ms · 18 tools · `get_signals` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.Mikehzp/agentvuln", "name": "Agent Security Scanner", "kind": "mcp", "official": null, "desc": "Scan AI agents for tool-calling vulnerabilities: prompt leaks, hijacking, injections, and more.", "repo": null, "install": ["pypi:agentvuln"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pcp183/agent-services-mcp", "name": "Agent Services (x402): compliance, company, procurement", "kind": "mcp", "official": null, "desc": "27 pay-per-call agent tools (KYB, VAT, sanctions, tenders, data). Pays via x402; holds no funds.", "repo": "https://github.com/pcp183/agent-services-mcp", "install": ["https://agent-services-mcp-production.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2179 ms · 30 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.startekenterprises-ai/agent-shield", "name": "Agent-Shield", "kind": "mcp", "official": null, "desc": "Security scanner for AI agents: prompt injection, leaked secrets, PII, and SSRF-risk URL detection.", "repo": "https://github.com/startekenterprises-ai/agent-shield", "install": ["https://agent-shield.startekenterprises.com/mcp"], "stars": 0, "pushed": "2026-11-09T18:37:56Z", "license": null, "plat": "", "live": "Live · 522 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.astafford8488/agentaegis", "name": "AgentAegis", "kind": "mcp", "official": null, "desc": "Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.", "repo": "https://github.com/astafford8488/agentaegis-mcp", "install": ["https://agentaegis-mcp-production.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:dev.agentdiet/onchain-risk", "name": "AgentDiet Base EVM & Solana Smart Contract Security Scanner", "kind": "mcp", "official": null, "desc": "Audits any Base EVM 0x contract or Solana SPL Mint for proxy patterns, GoPlus honeypot flags, and.", "repo": "https://github.com/robertoyanguas-ops/assay", "install": ["https://onchain-risk.agentdiet.dev/mcp"], "stars": 0, "pushed": "2026-10-17T08:54:05Z", "license": "MIT", "plat": "agentdiet", "live": "Live · 949 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:dev.agentdiet/github-audit", "name": "AgentDiet Coding Agent GitHub Repo, Dependency & License Security Auditor", "kind": "mcp", "official": null, "desc": "Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-c.", "repo": "https://github.com/robertoyanguas-ops/assay", "install": ["https://github-audit.agentdiet.dev/mcp"], "stars": 0, "pushed": "2026-10-17T08:54:05Z", "license": "MIT", "plat": "github", "live": "Live · 1244 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:dev.agentdiet/domain-osint", "name": "AgentDiet Domain OSINT, TLS Certificate & Security Headers Recon", "kind": "mcp", "official": null, "desc": "Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.", "repo": "https://github.com/robertoyanguas-ops/assay", "install": ["https://domain-osint.agentdiet.dev/mcp"], "stars": 0, "pushed": "2026-10-17T08:54:05Z", "license": "MIT", "plat": "", "live": "Live · 1216 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:dev.agentdiet/cve-intel", "name": "AgentDiet Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)", "kind": "mcp", "official": null, "desc": "Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and r.", "repo": "https://github.com/robertoyanguas-ops/assay", "install": ["https://cve-intel.agentdiet.dev/mcp"], "stars": 0, "pushed": "2026-10-17T08:54:05Z", "license": "MIT", "plat": "osv.dev", "live": "Live · 1020 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.agentgraph-co/agentgraph-trust", "name": "AgentGraph Trust", "kind": "mcp", "official": null, "desc": "Security scanning and trust verification for AI agent tools.", "repo": null, "install": ["pypi:agentgraph-trust"], "stars": null, "pushed": null, "license": null, "plat": "ai agent tools", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shuaicongxiaomai/agentguard", "name": "AgentGuard — security checks for AI agents", "kind": "mcp", "official": null, "desc": "Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev).", "repo": "https://github.com/shuaicongxiaomai/agentguard", "install": ["oci:ghcr.io/shuaicongxiaomai/agentguard:0.1.2"], "stars": 0, "pushed": "2026-07-02T10:56:01Z", "license": "MIT", "plat": "osv.dev", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.detection-forge/agentic-detection-lookups", "name": "Agentic Detection Lookups", "kind": "mcp", "official": null, "desc": "LOLBAS, GTFOBins, and process parent-child lookups for detection engineering agents.", "repo": "https://github.com/detection-forge/agentic-detection-lookups", "install": [], "stars": 0, "pushed": "2026-10-16T15:08:34Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ormuzdo/agentic-security-shield", "name": "Agentic Security Shield", "kind": "mcp", "official": null, "desc": "12-layer security configs for AI coding agents. Autonomous purchase via x402 (USDC on Base).", "repo": "https://github.com/ormuzdo/agentic-security-shield", "install": ["https://agentic-security-shield-mcp-production.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai coding agents", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.agentproofchain/agentproof", "name": "AgentProof", "kind": "mcp", "official": null, "desc": "Verify signed, hash-chained AI agent audit logs and watch a live AgentProof-signed agent town.", "repo": "https://github.com/cipherxsniper/agentproof", "install": ["https://agentproofchain.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "agentproof", "live": "Live · 604 ms · 6 tools · free to try: `get_started` answered without a key (checked 2026-11-15)"}, {"id": "mcp:com.isagentproof/agentproof", "name": "AgentProof", "kind": "mcp", "official": null, "desc": "Start AgentProof security audits of websites you own or may test, and read reports and findings.", "repo": null, "install": ["https://isagentproof.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.traveljamboree/agentsec-mcp", "name": "AgentSec MCP", "kind": "mcp", "official": null, "desc": "Security intelligence via x402 on Base. CVE lookup, IP reputation, secret scanning.", "repo": null, "install": ["https://agentsec-mcp.agentsec-mcp.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "base", "live": "Live · 863 ms · 3 tools · `cve_lookup` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.atmflow55/agentshield", "name": "AgentShield", "kind": "mcp", "official": null, "desc": "Smart contract security for AI agents — verify, monitor, freeze, x402 payments", "repo": null, "install": ["npm:agentshield-protocol"], "stars": null, "pushed": null, "license": null, "plat": "smart contract security", "live": "Not checked (runs locally)"}, {"id": "mcp:com.agoraverify/agora-omega", "name": "AGORA Omega", "kind": "mcp", "official": null, "desc": "Pay-per-call checks for AI agents: sanctions, MiCA, French KYB, AI Act. USDC via x402.", "repo": null, "install": ["https://agoraverify.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 608 ms · 8 tools · `agora_ai_act_check` asked for payment (checked 2026-11-13)"}, {"id": "mcp:dev.shveik/agosint", "name": "agosint", "kind": "mcp", "official": null, "desc": "Company and domain due diligence for agents: registers, sanctions, VAT, domain. Pay per call.", "repo": null, "install": ["https://agosint.shveik.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "company due diligence", "live": "Live · 1688 ms · 10 tools (checked 2026-11-13)"}, {"id": "mcp:com.airedteamingservices/site", "name": "AI application security research and assessments", "kind": "mcp", "official": null, "desc": "Read AI security guides and lab research, and request an LLM or AI agent security assessment.", "repo": "https://github.com/Excession-Labs/mcp-servers", "install": ["https://airedteamingservices.com/mcp"], "stars": 0, "pushed": "2026-11-12T15:12:23Z", "license": "MIT", "plat": "ai security", "live": "Live · 865 ms · 4 tools · free to try: `search_site` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.aiwebsitesecurity/ai-website-security", "name": "AI Website Security", "kind": "mcp", "official": null, "desc": "Security basics of a website: HTTPS certificate, redirection, headers, mixed content, DNS filtering.", "repo": null, "install": ["https://scan.aiwebsitesecurity.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2084 ms · 2 tools · free to try: `check_site_security_basics` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.rjhsignaltech.ai/dkim-selector-check", "name": "AI-operated. DKIM key reader: free, no key, finds unknown selectors.", "kind": "mcp", "official": null, "desc": "AI-operated. Two free DKIM readers, no signup: reads keys, finds the selector. Paid roster $99.", "repo": null, "install": ["https://ai.rjhsignaltech.workers.dev/mcp/dkim"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:dev.workers.rjhsignaltech.ai/spf-dmarc", "name": "AI-operated. Email authentication reader: six free tools, no key, no signup.", "kind": "mcp", "official": null, "desc": "AI-operated. Free SPF (RFC 7208 count), DMARC, MTA-STS, DMARC rua/ruf readers. Paid audit $29.", "repo": null, "install": ["https://ai.rjhsignaltech.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:ai.kaiv/dependency-trust", "name": "ai.kaiv/dependency-trust", "kind": "mcp", "official": null, "desc": "Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.", "repo": null, "install": ["https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1980 ms · 5 tools · free to try: `get_package_version` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.smithery/PabloLec-keyprobe-mcp", "name": "ai.smithery/PabloLec-keyprobe-mcp", "kind": "mcp", "official": null, "desc": "Audit certificates and keystores to surface expiry risks, weak algorithms, and misconfigurations.…", "repo": "https://github.com/PabloLec/KeyProbe-MCP", "install": ["https://server.smithery.ai/@PabloLec/keyprobe-mcp/mcp"], "stars": 0, "pushed": "2025-09-10T18:05:06Z", "license": "Apache-2.0", "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.mateuszingano/airlock-rls-mcp", "name": "Airlock RLS", "kind": "mcp", "official": null, "desc": "Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security.", "repo": "https://github.com/mateuszingano/airlock-rls-mcp", "install": ["npm:airlock-rls-mcp"], "stars": 0, "pushed": "2026-11-08T05:14:36Z", "license": "MIT", "plat": "supabase", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.aislabs/cve", "name": "AIS CVE Priorities — daily exploit-ranked patch list for AI agents", "kind": "mcp", "official": null, "desc": "Daily CVE priorities ranked by real exploitation (KEV+EPSS) for AI agents; free teaser, paid full", "repo": null, "install": ["https://api.aislabs.ai/cve/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 994 ms · 4 tools · `top_cves_today` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.alalanet/guard", "name": "alalanet guard — check before you install", "kind": "mcp", "official": null, "desc": "Check packages, repositories, skills and MCP servers before agents install or connect. Signed.", "repo": "https://github.com/alalanet/alalanet-agent", "install": ["https://alalanet.com/mcp/guard"], "stars": 0, "pushed": "2026-11-12T12:01:47Z", "license": "Apache-2.0", "plat": "alalanet guard", "live": "Live · 3762 ms · 7 tools · free to try: `install_check` answered without a key (checked 2026-11-15)"}, {"id": "mcp:io.github.WYRE-AI/alertops-mcp", "name": "AlertOps", "kind": "mcp", "official": null, "desc": "MCP server for AlertOps' incident alerting/on-call API.", "repo": "https://github.com/WYRE-AI/alertops-mcp", "install": ["oci:ghcr.io/wyre-ai/alertops-mcp:v1.0.2"], "stars": 0, "pushed": "2026-11-12T16:59:47Z", "license": "NOASSERTION", "plat": "alertops", "live": "Not checked (runs locally)"}, {"id": "mcp:bar.alerts/alertsbar", "name": "AlertsBar", "kind": "mcp", "official": null, "desc": "Domain exposures: breaches, infostealers, ULP heap, cookies. Counts and samples, free.", "repo": null, "install": ["https://mcp.alerts.bar/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1209 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Alex-Proof/alex-evidence-verify-mcp", "name": "ALEX Evidence Verify", "kind": "mcp", "official": null, "desc": "Verify signed ALEX Evidence Packages. Fails closed on signature or schema errors.", "repo": null, "install": ["pypi:alex-evidence-verify-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/alloy-navigator-mcp", "name": "Alloy Navigator", "kind": "mcp", "official": null, "desc": "MCP server for Alloy Navigator's REST API - IT asset management and ITSM data for MSPs.", "repo": "https://github.com/WYRE-AI/alloy-navigator-mcp", "install": ["oci:ghcr.io/wyre-ai/alloy-navigator-mcp:v1.0.1"], "stars": 0, "pushed": "2026-11-12T17:01:39Z", "license": "NOASSERTION", "plat": "alloy navigator", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.getambr/ambr-mcp-server", "name": "Ambr", "kind": "mcp", "official": null, "desc": "Ricardian contracts for AI agents — dual-format, SHA-256 bound, legible by construction.", "repo": "https://github.com/getambr/site", "install": ["https://getamber.dev/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ricardian contracts", "live": "Live · 1682 ms · 7 tools · free to try: `ambr_list_templates` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.AnchorRegistry/ar-mcp", "name": "AnchorRegistry", "kind": "mcp", "official": null, "desc": "On-chain provenance lookup for AnchorRegistry. Resolve AR-IDs, hashes, and full trees. Authless.", "repo": "https://github.com/anchorregistry/ar-mcp", "install": ["https://mcp.anchorregistry.ai/mcp", "https://mcp.anchorregistry.ai/sse"], "stars": 0, "pushed": "2026-06-13T19:25:26Z", "license": "MIT", "plat": "anchorregistry", "live": "Live · 1396 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:com.oroboros-design.angel/agent-guard", "name": "Angel Agent Guard: pre-purchase check + prompt-injection scan", "kind": "mcp", "official": null, "desc": "Check a shop, checkout or payment link, paid API or token before paying; prompt-injection scan.", "repo": "https://github.com/daoudandiaye98-alt/angel-agent-guard", "install": ["npm:angel-agent-guard"], "stars": null, "pushed": null, "license": null, "plat": "angel agent guard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Aleph-Lab-s/apc-security-reference-server", "name": "APC Security Reference Server", "kind": "mcp", "official": null, "desc": "Reference MCP server for synthetic APC action-security evaluation and local SQLite sandbox testin...", "repo": "https://github.com/Aleph-Lab-s/apc-open-core", "install": ["pypi:apc-action-security"], "stars": 0, "pushed": "2026-11-07T20:26:41Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:xyz.apexfaucet/apex-evm", "name": "APEX EVM Reads & Security", "kind": "mcp", "official": null, "desc": "7-chain EVM audits, log simulator, wallet due diligence, calldata decoder, Chainlink & ENS.", "repo": null, "install": ["https://apexfaucet.xyz/api/mcp/evm"], "stars": null, "pushed": null, "license": null, "plat": "evm", "live": "Live · 1435 ms · 17 tools (checked 2026-11-13)"}, {"id": "mcp:com.run402.apishield-waf/mcp", "name": "APIShield WAF v4.0 MCP", "kind": "mcp", "official": null, "desc": "50-vector prompt-injection, llms.txt poisoning, SSRF & OpenAPI scanner ($1 USDC).", "repo": null, "install": ["https://apishield-waf.run402.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1372 ms · 4 tools · free to try: `get_package_manifest` answered without a key (checked 2026-11-13)"}, {"id": "mcp:app.vercel.exploitwatch-kappa/exploitwatch", "name": "app.vercel.exploitwatch-kappa/exploitwatch", "kind": "mcp", "official": null, "desc": "Check dependencies against CISA's real Known Exploited Vulnerabilities feed.", "repo": null, "install": ["https://exploitwatch-kappa.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 749 ms · 1 tools · free to try: `check_kev` answered without a key (checked 2026-11-13)"}, {"id": "mcp:net.appledger/appledger", "name": "AppLedger", "kind": "mcp", "official": null, "desc": "Plain-English security checks for AI-built apps (Trivy + Opengrep), with fix requests for agents", "repo": "https://github.com/contentasoftware/appledger", "install": ["pypi:appledger"], "stars": 0, "pushed": "2026-10-14T10:51:12Z", "license": "MIT", "plat": "ai-built apps", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ai-ronin-systems/appsec-toolbox-mcp", "name": "AppSec Toolbox MCP", "kind": "mcp", "official": null, "desc": "Passive AppSec scanners as eight parameterless MCP tools; the audited repository is data.", "repo": "https://github.com/ai-ronin-systems/appsec-toolbox-mcp", "install": ["oci:ghcr.io/ai-ronin-systems/appsec-toolbox-mcp:0.3.0"], "stars": 0, "pushed": "2026-11-01T05:21:03Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ictechgy/apsa", "name": "APSA mobile app security audit", "kind": "mcp", "official": null, "desc": "Local, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.", "repo": "https://github.com/ictechgy/apsa", "install": ["pypi:apsa"], "stars": 0, "pushed": "2026-11-06T16:32:35Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.arbiterscan/arbiter", "name": "Arbiter", "kind": "mcp", "official": null, "desc": "Security checks for apps built with AI: leaked keys, open routes, database rules, each with a fix.", "repo": null, "install": ["https://api.arbiterscan.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.r0ptik/argus", "name": "Argus", "kind": "mcp", "official": null, "desc": "Reverse-engineering evidence from a running Windows process, not the binary on disk.", "repo": "https://github.com/r0ptik/argus", "install": ["mcpb:https://github.com/r0ptik/argus/releases/download/v0.1.1/argus.mcpb"], "stars": 0, "pushed": "2026-11-04T14:44:36Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.igor-vii/argus-console", "name": "Argus Console — AI Agent Test Lab", "kind": "mcp", "official": null, "desc": "Adversarial testing for AI agents that move money: engine battery, Ed25519-sealed verdict reports.", "repo": "https://github.com/igor-vii/Argus-Agent-Test-Lab", "install": ["https://console.argus-lab.tech/mcp"], "stars": 0, "pushed": "2026-11-12T21:09:12Z", "license": "MIT", "plat": "ai agents", "live": "Live · 725 ms · 5 tools · `argus_list_agents` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.ayurak/aribot-mcp", "name": "Aribot", "kind": "mcp", "official": null, "desc": "Threat modeling, code, API & cloud security, shadow-AI & compliance governance.", "repo": null, "install": ["https://mcp.aribot.ayurak.com/"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.arnakoff/api", "name": "Arnakoff", "kind": "mcp", "official": null, "desc": "Signaux anti-arnaque sourcés sur un site, un e-mail, un numéro, un IBAN ou un SIREN", "repo": "https://github.com/arnakoff/api", "install": ["https://api.arnakoff.com/mcp"], "stars": 0, "pushed": "2026-11-12T20:38:40Z", "license": "AGPL-3.0", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.autosecurelogin/colorado-complaint-access", "name": "ASL Colorado Complaint Access", "kind": "mcp", "official": null, "desc": "Colorado DORA license lookups, the SOMB provider directory and answers from the rules and standards.", "repo": null, "install": ["https://mcp.autosecurelogin.com/colorado/mcp"], "stars": null, "pushed": null, "license": null, "plat": "asl colorado", "live": "Live · 1016 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:app.asmhunter/asmhunter-mcp", "name": "ASMHunter", "kind": "mcp", "official": null, "desc": "Drive ASMHunter attack-surface monitoring from an AI agent: recon, scans, findings, reports.", "repo": null, "install": ["pypi:asmhunter-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.agentdiet/assay", "name": "Assay A2A, MCP & x402 Pre-Flight Verifier & Observatory", "kind": "mcp", "official": null, "desc": "Live behavioral security verifier, schema auditor, and trust oracle for A2A, MCP & x402 agents.", "repo": "https://github.com/robertoyanguas-ops/assay", "install": ["https://assay.agentdiet.dev/mcp"], "stars": 0, "pushed": "2026-10-17T08:54:05Z", "license": "MIT", "plat": "", "live": "Live · 1165 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:uk.co.atinamos/evidence", "name": "Atinamos Evidence", "kind": "mcp", "official": null, "desc": "Read-only verification evidence for paid machine services and buyer policy checks.", "repo": "https://github.com/Atinamos/agent-verification-research", "install": ["https://verify.atinamos.co.uk/mcp"], "stars": 0, "pushed": "2026-09-16T21:17:51Z", "license": "NOASSERTION", "plat": "atinamos evidence", "live": "Down · HTTP 503 (checked 2026-11-13)"}, {"id": "mcp:com.atkvn/security-checks", "name": "ATK Security Checks", "kind": "mcp", "official": null, "desc": "PQ TLS + cert checks; Wazuh rules tested on a real manager; PHP2Shell CVE check + fix steps", "repo": null, "install": ["https://atkvn.com/agent/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 3788 ms · 5 tools · `check_tls_certificate` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.attackerview/website-security-check", "name": "AttackerView quick website security check", "kind": "mcp", "official": null, "desc": "Passive security check of a domain: headers, TLS, DNS and email authentication. No login needed.", "repo": null, "install": ["https://attackerview.com/api/public/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2081 ms · 1 tools · free to try: `check_website_security` answered without a key (checked 2026-11-13)"}, {"id": "mcp:us.srv.vehcdj664efetfrsolne5umanq/quoteproof-mcp", "name": "AttestPage (Quoteproof)", "kind": "mcp", "official": null, "desc": "Use before citing a page, sharing links or installing a suggested package. Signed receipts.", "repo": null, "install": ["https://vehcdj664efetfrsolne5umanq.srv.us/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · ConnectionResetError: [WinError 10054] 현재 연결은 원격 호스트에 의해 강제로 끊겼습니다 (checked 2026-11-13)"}, {"id": "mcp:io.github.audit0/auditai-mcp", "name": "Audit AI", "kind": "mcp", "official": null, "desc": "Finds authorization holes in Next.js + Supabase apps and live Supabase databases. No API key.", "repo": null, "install": ["npm:auditai-mcp"], "stars": null, "pushed": null, "license": null, "plat": "supabase", "live": "Not checked (runs locally)"}, {"id": "mcp:co.auditon/assessments", "name": "Auditon security assessments", "kind": "mcp", "official": null, "desc": "Read-only access to your Auditon vulnerability scans: findings, endpoints, reports and changes.", "repo": null, "install": ["https://auditon.co/mcp"], "stars": null, "pushed": null, "license": null, "plat": "auditon", "live": "Live · 1915 ms · 6 tools · `list_scans` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.mwstech/auditra", "name": "Auditra", "kind": "mcp", "official": null, "desc": "Read-only MCP server for WordPress plugin audits: vulnerabilities, bloat, cron, orphaned tables.", "repo": "https://github.com/mwstech/auditra", "install": ["https://{site_domain}/wp-json/auditra/v1/mcp/{token}"], "stars": 0, "pushed": "2026-10-06T07:27:56Z", "license": "GPL-2.0", "plat": "wordpress", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.donniertf-hub/au-sanctions-screen-mcp", "name": "Australia Sanctions Screening MCP", "kind": "mcp", "official": null, "desc": "Screen names against Australia DFAT consolidated sanctions targets.", "repo": "https://github.com/donniertf-hub/uk-mcp-fleet", "install": ["https://au-sanctions-screen-mcp.donniertf.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-09T13:17:25Z", "license": null, "plat": "australia dfat", "live": "Live · 886 ms · 3 tools · free to try: `screen_search` answered without a key (checked 2026-11-13)"}, {"id": "mcp:app.vercel.automaton-tx-explainer/base-tools", "name": "Automaton Onchain Tools", "kind": "mcp", "official": null, "desc": "Paid x402 crypto safety tools (Base/ETH/BSC): tx, approvals, contract risk, token deep scan.", "repo": null, "install": ["https://automaton-tx-explainer.vercel.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "base/eth/bsc", "live": "Live · 1258 ms · 60 tools · `url_safety_check` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.baianomarceloeduardo-jpg/automaton-token-safety-mcp", "name": "Automaton Token Safety", "kind": "mcp", "official": null, "desc": "Base L2 token safety for AI agents: honeypot scans, swap simulation, approval and liquidity risk.", "repo": "https://github.com/baianomarceloeduardo-jpg/automaton-x402", "install": ["npm:@celorodrigues/token-safety-mcp", "https://api.automaton-sovereign.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/avanan-legacy-mcp", "name": "Avanan MSP (Legacy SmartAPI)", "kind": "mcp", "official": null, "desc": "MCP server for the legacy Avanan SmartAPI: MSP tenant management plus per-tenant security tools.", "repo": "https://github.com/WYRE-AI/avanan-legacy-mcp", "install": ["oci:ghcr.io/wyre-ai/avanan-legacy-mcp:v2.3.2"], "stars": 0, "pushed": "2026-11-09T08:35:04Z", "license": "Apache-2.0", "plat": "avanan msp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/axcient-mcp", "name": "Axcient x360Recover", "kind": "mcp", "official": null, "desc": "MCP server for Axcient x360Recover — BCDR clients, devices, jobs, vaults, and appliances.", "repo": "https://github.com/WYRE-AI/axcient-mcp", "install": ["oci:ghcr.io/wyre-ai/axcient-mcp:v1.0.4"], "stars": 0, "pushed": "2026-11-12T16:45:44Z", "license": "NOASSERTION", "plat": "axcient x360recover", "live": "Not checked (runs locally)"}, {"id": "mcp:app.vercel.axiom-risk-mcp/solana-token-risk", "name": "Axiom Solana Token Risk", "kind": "mcp", "official": null, "desc": "Solana SPL token risk checks: free preview tool plus links to paid x402 (USDC) full reports.", "repo": null, "install": ["https://axiom-risk-mcp.vercel.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "solana", "live": "Live · 521 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:com.autosecurelogin/aya-scam-check", "name": "Aya scam check", "kind": "mcp", "official": null, "desc": "Screens a message or its links for scam patterns with Aya's offline rules, in English and Spanish.", "repo": null, "install": ["https://mcp.autosecurelogin.com/aya/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1004 ms · 2 tools · `link_check` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.b2ige2-a11y/b2ige-verify", "name": "B2IGE Verify", "kind": "mcp", "official": null, "desc": "Independent deterministic verification for AI-written software. Local, evidence-backed checks.", "repo": "https://github.com/b2ige2-a11y/b2ige-verify", "install": ["mcpb:https://github.com/b2ige2-a11y/b2ige-verify/releases/download/v0.1.0/b2ige-verify-0.1.0.mcpb"], "stars": 0, "pushed": "2026-09-19T05:08:52Z", "license": "Apache-2.0", "plat": "ai-written software", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Evozim/bio-safe-audit", "name": "Bio-Safe-Audit", "kind": "mcp", "official": null, "desc": "Biometric data privacy auditor ensuring Zero-Knowledge compliance.", "repo": null, "install": ["https://bio-safe-audit-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 655 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/bitdefender-mcp", "name": "Bitdefender GravityZone", "kind": "mcp", "official": null, "desc": "MCP server for Bitdefender GravityZone's JSON-RPC API.", "repo": "https://github.com/WYRE-AI/bitdefender-mcp", "install": ["oci:ghcr.io/wyre-ai/bitdefender-mcp:v1.1.0"], "stars": 0, "pushed": "2026-11-12T17:28:39Z", "license": "NOASSERTION", "plat": "bitdefender gravityzone", "live": "Not checked (runs locally)"}, {"id": "mcp:co.bizverify/mcp", "name": "BizVerify", "kind": "mcp", "official": null, "desc": "KYB for AI agents: verify business registrations from MCP clients.", "repo": "https://github.com/BizVerify/bizverify-mcp", "install": ["https://api.bizverify.co/mcp"], "stars": 0, "pushed": "2026-06-03T08:08:34Z", "license": "MIT", "plat": "", "live": "Live · 1286 ms · 9 tools · `get_account` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/blackpoint-mcp", "name": "Blackpoint Cyber", "kind": "mcp", "official": null, "desc": "MCP server for Blackpoint Cyber MDR — alerts, threats, and operations.", "repo": "https://github.com/WYRE-AI/blackpoint-mcp", "install": ["oci:ghcr.io/wyre-ai/blackpoint-mcp:v1.2.1"], "stars": 0, "pushed": "2026-11-12T16:49:22Z", "license": "Apache-2.0", "plat": "blackpoint cyber", "live": "Not checked (runs locally)"}, {"id": "mcp:io.blockchainanalysis/mcp", "name": "BlockchainAnalysis", "kind": "mcp", "official": null, "desc": "Compliance MCP for AI agents: sanctions & KYT screening on 50+ chains, stablecoin-freeze, oracle.", "repo": null, "install": ["https://blockchainanalysis.io/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "blockchainanalysis", "live": "Live · 2683 ms · 13 tools · free to try: `list_supported_chains` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/blumira-mcp", "name": "Blumira", "kind": "mcp", "official": null, "desc": "MCP server for Blumira SIEM — query findings, evidence, and detection data via the Blumira API.", "repo": "https://github.com/WYRE-AI/blumira-mcp", "install": ["oci:ghcr.io/wyre-ai/blumira-mcp:v1.2.16"], "stars": 0, "pushed": "2026-11-12T16:57:33Z", "license": "NOASSERTION", "plat": "blumira", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.cybermax-tools.cybermax/bonafido", "name": "Bonafido: Business Domain Verification API", "kind": "mcp", "official": null, "desc": "Bonafido: is a domain a real business site? Verdict, trust score, risk flags.", "repo": "https://gitlab.com/CyberMax.tools/agent-tools", "install": ["https://bonafido.cybermaxtools.com/mcp?via=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "bonafido", "live": "Live · 564 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.CyberMax-tools/domain-verify", "name": "Bonafido: Business Domain Verification API", "kind": "mcp", "official": null, "desc": "Bonafido: is a domain a real business site? Verdict, trust score, risk flags.", "repo": "https://github.com/CyberMax-tools/product-factory", "install": ["https://bonafido.cybermax-tools.workers.dev/mcp?via=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "bonafido", "live": "Live · 695 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.bot403/bot403", "name": "Bot403", "kind": "mcp", "official": null, "desc": "Invisible bot shield for HTML forms: the browser solves a proof of work and your server checks it.", "repo": null, "install": ["https://bot403.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "html forms", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.brightsec/mcp", "name": "Bright Security", "kind": "mcp", "official": null, "desc": "Enables AI agents to access Bright Security tools for app discovery and security testing.", "repo": null, "install": ["https://{instance}.brightsec.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "bright security", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.NeuraLegion/mcp", "name": "Bright Security", "kind": "mcp", "official": null, "desc": "AI-powered application security testing — scan APIs, discover endpoints, and find vulnerabilities.", "repo": "https://github.com/NeuraLegion/mcp", "install": ["https://app.brightsec.com/mcp"], "stars": 0, "pushed": "2026-09-03T13:34:07Z", "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.bynn/bynn", "name": "Bynn", "kind": "mcp", "official": null, "desc": "Document fraud detection for manipulated, fake and AI-generated PDF and image documents.", "repo": "https://github.com/Bynn-Intelligence/skills", "install": ["https://mcp.bynn.com"], "stars": 0, "pushed": "2026-10-19T14:31:57Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:ai.byteray/byteray-mcp", "name": "ByteRay AI", "kind": "mcp", "official": null, "desc": "Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai", "repo": null, "install": ["https://mcp.byteray.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.helpforsupport/caisey", "name": "Caisey", "kind": "mcp", "official": null, "desc": "Troubleshoot enrolled client PCs from your AI client, with human approval and an audit trail.", "repo": null, "install": ["https://helpforsupport.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:cc.captcha/captchacc", "name": "captcha.cc Human Verification", "kind": "mcp", "official": null, "desc": "Human verification CAPTCHA with visual and selective-listening audio challenges.", "repo": "https://github.com/earonesty/captcha", "install": ["https://captcha.cc/mcp"], "stars": null, "pushed": null, "license": null, "plat": "captcha.cc", "live": "Live · 1068 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.CAST-Extend/gatekeeper-mcp-server", "name": "CAST Gatekeeper MCP Server", "kind": "mcp", "official": null, "desc": "CAST Dashboard MCP server for compliance, quality, and technical debt insights for AI agents", "repo": null, "install": ["oci:docker.io/castbuild/gatekeeper-mcp-server:3.0.0-beta5-46"], "stars": null, "pushed": null, "license": null, "plat": "cast", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-cert-fr-advisory-national-cert-alert", "name": "CERT-FR Security Advisories — buy per-query in-session (certfrwatch)", "kind": "mcp", "official": null, "desc": "CERT-FR (ANSSI) security advisories & alerts: French national CERT vulnerability feed, hourly", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/certfrwatch-cert-fr-anssi-national-security-advisories-b65f45/http"], "stars": null, "pushed": null, "license": null, "plat": "cert-fr", "live": "Live · 1153 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:dev.certdesk/certdesk", "name": "certdesk", "kind": "mcp", "official": null, "desc": "TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts", "repo": null, "install": ["https://certdesk.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 5100 ms · 7 tools · free to try: `check_certificate` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.mike-tusa.certguard/certguard", "name": "CertGuard", "kind": "mcp", "official": null, "desc": "Free SSL/TLS certificate checker: expiry, chain trust, hostname match, TLS version, A/B/C/F grade.", "repo": null, "install": ["https://certguard.mike-tusa.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1305 ms · 1 tools · `check_certificate` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.chainitor/chainitor", "name": "Chainitor", "kind": "mcp", "official": null, "desc": "Monitor EVM wallets, tokens, contracts and Safe multisigs, and read their alerts.", "repo": null, "install": ["https://mcp.chainitor.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "chainitor", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.chain305/chainsaw", "name": "Chainsaw package firewall", "kind": "mcp", "official": null, "desc": "Package firewall for agents: route npm, pip and docker installs through Chainsaw.", "repo": null, "install": ["https://chain305.com/chainproxy/mcp"], "stars": null, "pushed": null, "license": null, "plat": "chainsaw package firewall", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.oroboros-design.angel/checkout-guard", "name": "Checkout Guard — pre-purchase check for shops, payment links and paid APIs", "kind": "mcp", "official": null, "desc": "Pre-purchase check for any shop, checkout or payment link, paid API or x402 endpoint.", "repo": "https://github.com/daoudandiaye98-alt/mcp-checkout-guard", "install": ["https://angel.oroboros-design.com/mcp/checkout-guard"], "stars": null, "pushed": null, "license": null, "plat": "checkout guard", "live": "Live · 4996 ms · 2 tools (checked 2026-11-15)"}, {"id": "mcp:io.github.cian-spider/cian-endpoint-audit", "name": "Cian Endpoint Audit", "kind": "mcp", "official": null, "desc": "HTTP, TLS and DNS audit of one public URL, paid per call in USDC over x402 on Base.", "repo": "https://github.com/cian-spider/cian-endpoint-audit-mcp", "install": ["https://cian-x402.netlify.app/mcp"], "stars": 0, "pushed": "2026-11-13T13:02:06Z", "license": null, "plat": "", "live": "Live · 2468 ms · 1 tools (checked 2026-11-14)"}, {"id": "mcp:io.github.pipeworx-io/circl-vulnerability-lookup", "name": "Circl Vulnerability Lookup", "kind": "mcp", "official": null, "desc": "CIRCL Vulnerability-Lookup — aggregated vulnerability records", "repo": "https://github.com/pipeworx-io/mcp-circl-vulnerability-lookup", "install": ["npm:@pipeworx/mcp-circl-vulnerability-lookup", "https://gateway.pipeworx.io/circl-vulnerability-lookup/mcp"], "stars": 0, "pushed": "2026-11-09T13:40:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-cisa-advisory-ics-security-alert", "name": "CISA Cybersecurity & ICS Advisories — buy per-query in-session (cisaalerts)", "kind": "mcp", "official": null, "desc": "CISA advisories & ICS alerts: new CVEs, remediation. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/cisaalerts-cisa-cybersecurity-ics-advisories-55420c/http"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 1630 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/cisa-kev", "name": "Cisa Kev", "kind": "mcp", "official": null, "desc": "CISA KEV MCP.", "repo": "https://github.com/pipeworx-io/mcp-cisa-kev", "install": ["npm:@pipeworx/mcp-cisa-kev", "https://gateway.pipeworx.io/cisa-kev/mcp"], "stars": 0, "pushed": "2026-11-09T13:41:01Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-cisa-known-exploited-vulnerability-catalog", "name": "CISA Known Exploited Vulnerabilities (kevwatch)", "kind": "mcp", "official": null, "desc": "CISA KEV catalog: active-exploit alerts, hourly. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/cisa-known-exploited-vulnerabilities-kevwatch-aedaf3/http"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 1635 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/cisco-umbrella-mcp", "name": "Cisco Umbrella", "kind": "mcp", "official": null, "desc": "MCP server for Cisco Umbrella's deployment, admin, policy, reporting, and investigate APIs.", "repo": "https://github.com/WYRE-AI/cisco-umbrella-mcp", "install": ["oci:ghcr.io/wyre-ai/cisco-umbrella-mcp:v1.0.3"], "stars": 0, "pushed": "2026-11-12T16:57:57Z", "license": "NOASSERTION", "plat": "cisco umbrella", "live": "Not checked (runs locally)"}, {"id": "mcp:ru.cisoclub/mcp", "name": "CISOCLUB", "kind": "mcp", "official": null, "desc": "Материалы CISOCLUB об ИБ и ИТ: поиск, мероприятия, вакансии, продукты, уязвимости БДУ ФСТЭК", "repo": null, "install": ["https://cisoclub.ru/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cisoclub materials on it security", "live": "Live · 5875 ms · 8 tools · free to try: `cisoclub_get_publication` answered without a key (checked 2026-11-13)"}, {"id": "mcp:tech.thecompound/civicbinder", "name": "CivicBinder MCP", "kind": "mcp", "official": null, "desc": "CivicBinder: ADA Title II accessibility grades for US local-government websites.", "repo": "https://github.com/kyisaiah47/openlookup", "install": ["npm:civicbinder-mcp"], "stars": null, "pushed": null, "license": null, "plat": "civicbinder", "live": "Not checked (runs locally)"}, {"id": "mcp:org.dpdns.clair/clair", "name": "Clair", "kind": "mcp", "official": null, "desc": "Audits AI-built websites for France and Belgium: cookies, GDPR, legal pages, exposed keys, security.", "repo": null, "install": ["https://clair.dpdns.org/mcp"], "stars": null, "pushed": null, "license": null, "plat": "clair", "live": "Down · HTTP 503 (checked 2026-11-13)"}, {"id": "mcp:io.github.AlexFloyd13/clevername-mcp", "name": "Clevername", "kind": "mcp", "official": null, "desc": "AI agent governance — security scanning, BYOK routing, audit logging, and Council approvals.", "repo": "https://github.com/AlexFloyd13/clevername", "install": ["npm:@clevername/clevername-mcp", "npm:@clevername/clevername-mcp"], "stars": null, "pushed": null, "license": null, "plat": "alex", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.FreeGuy-AI/closeread-verify", "name": "Closeread Verify", "kind": "mcp", "official": null, "desc": "A verified dependency-audit verdict any AI agent can call over MCP, not a raw scan.", "repo": "https://github.com/FreeGuy-AI/closeread-verify", "install": ["pypi:closeread-verify"], "stars": 0, "pushed": "2026-06-11T18:55:13Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:co.auditro/auditro", "name": "co.auditro/auditro", "kind": "mcp", "official": null, "desc": "UAE ICV compliance: governed scores, evidence gaps and actions with deterministic numbers.", "repo": null, "install": ["https://app.auditro.co/mcp"], "stars": null, "pushed": null, "license": null, "plat": "auditro", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/codevulnerability", "name": "CodeVulnerability", "kind": "mcp", "official": null, "desc": "OWASP threat scanner auditing codebases for safety leaks.", "repo": null, "install": ["https://codevulnerability-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 893 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:net.fmelo/cognita", "name": "Cognita", "kind": "mcp", "official": null, "desc": "Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.", "repo": null, "install": ["https://cognita.fmelo.net/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cognita", "live": "Live · 2250 ms · 51 tools · free to try: `spf_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:trade.coil/stock-market-scanner", "name": "Coil Live", "kind": "mcp", "official": null, "desc": "Trading discipline for AI agents: when to trade or sit in cash, on 650+ US stocks and ETFs", "repo": null, "install": ["https://coil.trade/mcp", "https://mcp.coil.trade/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1749 ms · 49 tools · free to try: `get_day_board` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.arcnautical/mcp", "name": "com.arcnautical/mcp", "kind": "mcp", "official": null, "desc": "Screen any vessel by IMO for sanctions, ownership opacity and vetting grade. Keyless check included.", "repo": "https://github.com/arcnautical/arcnautical-mcp", "install": ["npm:@arcnautical/mcp", "https://mcp.arcnautical.com/mcp"], "stars": 0, "pushed": "2026-10-27T18:05:51Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.arcself/arc-security", "name": "com.arcself/arc-security", "kind": "mcp", "official": null, "desc": "Scan AI agent skills for 25 attack classes + runtime monitoring. 1,316+ findings.", "repo": "https://github.com/ArcSelf/arc-security-mcp", "install": ["npm:arc-security-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.bidda/bidda-compliance", "name": "com.bidda/bidda-compliance", "kind": "mcp", "official": null, "desc": "10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).", "repo": null, "install": ["https://bidda.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "compliance", "live": "Live · 3000 ms · 25 tools · free to try: `browse_topics` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.cautellus/scam-detection", "name": "com.cautellus/scam-detection", "kind": "mcp", "official": null, "desc": "Scam and phishing detection for AI agents: safe/warn/danger verdicts for URLs and messages.", "repo": null, "install": ["https://cautellus.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "scam detection", "live": "Live · 1519 ms · 3 tools · `get_usage` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.chaink9/chaink9", "name": "com.chaink9/chaink9", "kind": "mcp", "official": null, "desc": "Token risk checks on BSC, ETH, Base and Arc: trades the token on a fork. Paid in USDC/USDT via x402.", "repo": "https://github.com/ChainK9/chaink9-mcp", "install": ["npm:chaink9-mcp", "https://api.chaink9.com/mcp"], "stars": 0, "pushed": "2026-11-11T17:47:12Z", "license": "MIT", "plat": "chaink9", "live": "Not checked (runs locally)"}, {"id": "mcp:com.cognivators/mcp-safeguard", "name": "com.cognivators/mcp-safeguard", "kind": "mcp", "official": null, "desc": "MCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning.", "repo": "https://gitlab.com/anasmohiuddinsyed/mcp-safeguard", "install": ["pypi:mcp-safeguard"], "stars": null, "pushed": null, "license": null, "plat": "security", "live": "Not checked (runs locally)"}, {"id": "mcp:com.compliapi/screening", "name": "com.compliapi/screening", "kind": "mcp", "official": null, "desc": "OFAC and global sanctions screening: crypto addresses, emails, websites, IDs, countries, VPN, geo", "repo": null, "install": ["https://api.compliapi.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "com.compliapi", "live": "Live · 689 ms · 11 tools (checked 2026-11-13)"}, {"id": "mcp:com.correctover/mcp-server", "name": "com.correctover/mcp-server", "kind": "mcp", "official": null, "desc": "MCP runtime security. 22µs validation, 97% self-healing. Detects RCE, SSRF, credential hijacking.", "repo": "https://github.com/CorrectOver/mcp-server", "install": ["npm:correctover-mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.craftedtrust/mcp-shield", "name": "com.craftedtrust/mcp-shield", "kind": "mcp", "official": null, "desc": "Trust verification for MCP servers. Check scores, scan for security issues, search 4,200+ servers.", "repo": "https://github.com/cybercraftsolutionsllc/trust-gated-agent-example", "install": ["https://mcp.craftedtrust.com/api/v1/mcp"], "stars": 0, "pushed": "2026-03-25T17:33:00Z", "license": "MIT", "plat": "", "live": "Live · 1414 ms · 4 tools · free to try: `check_trust` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.edgethirteen.www/exploitwatch", "name": "com.edgethirteen.www/exploitwatch", "kind": "mcp", "official": null, "desc": "Check a dependency list against CISA's live Known Exploited Vulnerabilities catalog.", "repo": null, "install": ["https://www.edgethirteen.com/api/mcp/exploitwatch"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.edgethirteen.www/tariff-refund-screen", "name": "com.edgethirteen.www/tariff-refund-screen", "kind": "mcp", "official": null, "desc": "Screen US public companies for IEEPA tariff-refund exposure disclosed in their SEC filings.", "repo": null, "install": ["https://www.edgethirteen.com/api/mcp/tariff-refund-screen"], "stars": null, "pushed": null, "license": null, "plat": "ieepa", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.edgethirteen.www/triageshield", "name": "com.edgethirteen.www/triageshield", "kind": "mcp", "official": null, "desc": "Verify a vuln report's file/line/function claims against a real GitHub repo.", "repo": null, "install": ["https://www.edgethirteen.com/api/mcp/triageshield"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.encompassconfirm/ec360", "name": "com.encompassconfirm/ec360", "kind": "mcp", "official": null, "desc": "KYC automation from authoritative public sources. Requires an Encompass licence.", "repo": null, "install": ["https://encompass-mcp.encompassconfirm.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.grcmigrate/directory", "name": "com.grcmigrate/directory", "kind": "mcp", "official": null, "desc": "Search a directory of SOC 2 audit and compliance firms; read GRC migration guides. Read-only.", "repo": null, "install": ["https://grcmigrate.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "com.grcmigrate/directory", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.kenoodl/verify", "name": "com.kenoodl/verify", "kind": "mcp", "official": null, "desc": "Runs your code against a contract; HELD or BROKE at the exact input. Deterministic. 0.10 USDC/call.", "repo": null, "install": ["https://kenoodl.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "com.kenoodl/verify", "live": "Live · 3120 ms · 31 tools · free to try: `listing_link` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.keyboardcrumbs/mcp", "name": "com.keyboardcrumbs/mcp", "kind": "mcp", "official": null, "desc": "Live threat intel for Claude — CVE, KEV predictions, IP lookup, malware hashes. Free, no API key.", "repo": "https://github.com/kbcrumbs/mcp", "install": ["pypi:keyboardcrumbs-mcp"], "stars": null, "pushed": null, "license": null, "plat": "com.keyboardcrumbs/mcp", "live": "Not checked (runs locally)"}, {"id": "mcp:com.metricprovenance/odgs-mcp-server", "name": "com.metricprovenance/odgs-mcp-server", "kind": "mcp", "official": null, "desc": "ODGS governance enforcement — validation, regulation compilation, drift detection, signed S-Certs.", "repo": "https://github.com/MetricProvenance/odgs-mcp-server", "install": ["pypi:odgs-mcp-server"], "stars": 0, "pushed": "2026-10-21T16:03:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.mnemopay/gridstamp", "name": "com.mnemopay/gridstamp", "kind": "mcp", "official": null, "desc": "Tamper-evident spatial receipts: cryptographic proof-of-presence for AV fleets, logistics and AR.", "repo": "https://github.com/mnemopay/gridstamp", "install": ["npm:gridstamp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.obeliskgate/trust-tools", "name": "com.obeliskgate/trust-tools", "kind": "mcp", "official": null, "desc": "Website security ratings, token verification, and tamper-evident ledger heads from Obelisk Gate.", "repo": null, "install": ["https://obeliskgate.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "obelisk gate", "live": "Live · 984 ms · 10 tools · free to try: `get_org_rating` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.rangercheck/security-tools", "name": "com.rangercheck/security-tools", "kind": "mcp", "official": null, "desc": "Free front-end security check for any website: a grade plus the secrets and keys it exposes.", "repo": null, "install": ["https://rangercheck.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 639 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.screenata/compliance", "name": "com.screenata/compliance", "kind": "mcp", "official": null, "desc": "Manage compliance controls, policies, and audit readiness for SOC 2, HIPAA, ISO 27001 and more.", "repo": null, "install": ["https://api.screenata.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "screenata", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.secdim/mcp", "name": "com.secdim/mcp", "kind": "mcp", "official": null, "desc": "Personalised developer security learning pathways from SecDim's challenges and courses.", "repo": "https://github.com/secdim/mcp", "install": ["https://mcp.secdim.com/mcp"], "stars": 0, "pushed": "2026-07-20T06:14:26Z", "license": "NOASSERTION", "plat": "", "live": "Live · 3965 ms · 7 tools · free to try: `get_learn_course` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.thetempleofdoom.argus/argus", "name": "com.thetempleofdoom.argus/argus", "kind": "mcp", "official": null, "desc": "Agent rental platform: web-vuln scanning, OSINT and red-team tools via subscription.", "repo": null, "install": ["https://argus.thetempleofdoom.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 530 (checked 2026-11-13)"}, {"id": "mcp:com.trycloudflare.candy-josh-writers-balance/yultrace-audit", "name": "com.trycloudflare.candy-josh-writers-balance/yultrace-audit", "kind": "mcp", "official": null, "desc": "EVM Slither audit (zero-arg demo + live) + Blockscout source + security.txt lookup + MCP probe.", "repo": null, "install": ["https://candy-josh-writers-balance.trycloudflare.com/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "evm", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.trycloudflare.urgent-clean-occupied-catalogs/yultrace-audit", "name": "com.trycloudflare.urgent-clean-occupied-catalogs/yultrace-audit", "kind": "mcp", "official": null, "desc": "EVM audit (Slither + source + security.txt + MCP-probe + wallet-exposure). 6 tools + /trace.", "repo": null, "install": ["https://urgent-clean-occupied-catalogs.trycloudflare.com/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.vulnrable/vulnrable", "name": "com.vulnrable/vulnrable", "kind": "mcp", "official": null, "desc": "Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.", "repo": null, "install": ["https://vulnrable.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "npm/pypi packages", "live": "Live · 5078 ms · 4 tools · free to try: `list_mcp_servers` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.x402supply/endpoint-diligence", "name": "com.x402supply/endpoint-diligence", "kind": "mcp", "official": null, "desc": "Live x402 endpoint trust/diligence check before you pay it. $0.02/call via x402.", "repo": null, "install": ["https://diligence.x402supply.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Live · 901 ms · 3 tools · `check_endpoint` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.xtrinel/vaast", "name": "com.xtrinel/vaast", "kind": "mcp", "official": null, "desc": "Read-only access to VAAST vulnerability scan findings, workspaces, and targets for AI agents", "repo": null, "install": ["npm:@xtrinel/vaast-mcp"], "stars": null, "pushed": null, "license": null, "plat": "vaast", "live": "Not checked (runs locally)"}, {"id": "mcp:com.zeltser/website-search", "name": "com.zeltser/website-search", "kind": "mcp", "official": null, "desc": "Improve security writing, score it against rubrics, plan IR, CTI, vuln, and product strategy.", "repo": "https://github.com/lennyzeltser/zeltser-website-mcp-server", "install": ["https://website-mcp.zeltser.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "com.zeltser", "live": "Live · 3673 ms · 53 tools · free to try: `search_zeltser` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pcp183/company-lookup", "name": "Company Lookup (GLEIF LEI, UK, Norway)", "kind": "mcp", "official": null, "desc": "Confirm a company exists and is active (GLEIF, Norway registry). $0.02/call via x402.", "repo": "https://github.com/pcp183/company-lookup", "install": ["https://company-lookup-production-5a48.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1310 ms · 1 tools · free to try: `lookup_company` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.timzinin.api/compliance-tools", "name": "Compliance Tools", "kind": "mcp", "official": null, "desc": "Pay-per-call compliance lead scanners with free MCP discovery and x402 payments.", "repo": null, "install": ["https://api.timzinin.com/mcp/compliance-tools"], "stars": null, "pushed": null, "license": null, "plat": "compliance tools", "live": "Live · 2427 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:tech.concord/concord", "name": "Concord", "kind": "mcp", "official": null, "desc": "Work with your Concord privacy and trust data: consent, privacy requests, data map, risks, vendors.", "repo": null, "install": ["https://api.concord.tech/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.continueops/continueops-public", "name": "ContinueOps Public MCP", "kind": "mcp", "official": null, "desc": "BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.", "repo": null, "install": ["https://tjcjvxibsrxizwuajypz.supabase.co/functions/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 7256 ms · 7 tools · free to try: `dora_readiness_assessment` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.fino-oss/contract-scanner", "name": "Contract Security Scanner", "kind": "mcp", "official": null, "desc": "Scans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.", "repo": "https://github.com/fino-oss/contract-scanner-mcp", "install": ["npm:@fino314-oss/contract-scanner-mcp"], "stars": 0, "pushed": "2026-03-17T20:14:52Z", "license": null, "plat": "smart contracts", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vincentn-waivern/cookie-checker-gdpr-ccpa-gcmv2", "name": "Cookie Consent Compliance Scanner", "kind": "mcp", "official": null, "desc": "Cookie consent scanner: GDPR, CCPA, GCMv2. PASS/FAIL compliance checklists with fix recommendations.", "repo": "https://github.com/waivern-compliance/har-analyzer", "install": ["https://consent-analyser-emea.waivern.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/cork-mcp", "name": "Cork", "kind": "mcp", "official": null, "desc": "MCP server for Cork's cyber-insurance API for MSPs.", "repo": "https://github.com/WYRE-AI/cork-mcp", "install": ["oci:ghcr.io/wyre-ai/cork-mcp:v1.0.1"], "stars": 0, "pushed": "2026-11-12T17:00:31Z", "license": "NOASSERTION", "plat": "cork", "live": "Not checked (runs locally)"}, {"id": "mcp:io.corrie/site-check", "name": "Corrie Site Check", "kind": "mcp", "official": null, "desc": "Free HTTPS and security header check from Corrie, uptime monitoring for small teams. No auth.", "repo": null, "install": ["https://corrie.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "corrie", "live": "Live · 1134 ms · 1 tools · free to try: `check_website` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pcp183/due-diligence", "name": "Counterparty Due Diligence", "kind": "mcp", "official": null, "desc": "One-call counterparty screen: sanctions, export, PEP, registry. $0.10/call via x402.", "repo": "https://github.com/pcp183/due-diligence", "install": ["https://due-diligence-production-1338.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 731 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.croviatrust/crovia", "name": "Crovia — verifiable silence (TACET) and Crovia Seal", "kind": "mcp", "official": null, "desc": "Signed, Bitcoin-anchored observations of AI training-data disclosure; verifies silence proofs, seals", "repo": "https://github.com/croviatrust/countersign", "install": ["https://croviatrust.com/mcp"], "stars": 0, "pushed": "2026-10-27T19:45:35Z", "license": "Apache-2.0", "plat": "bitcoin-anchored observations", "live": "Live · 1830 ms · 8 tools · free to try: `search_models` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.custosa/tools", "name": "Custosa Tools", "kind": "mcp", "official": null, "desc": "Scans schema metadata to classify PHI, score HIPAA readiness, and generate compliant migrations.", "repo": null, "install": ["https://mcp.custosa.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "hipaa", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.brunckel/cve-exploit-priority", "name": "CVE Exploit Priority (CISA KEV + EPSS)", "kind": "mcp", "official": null, "desc": "CISA KEV status and EPSS scores for CVE IDs, ranked P1/P2/P3 for patching, via Apify.", "repo": null, "install": ["https://mcp.apify.com/?tools=implementable_antler/cve-exploit-priority"], "stars": null, "pushed": null, "license": null, "plat": "apify", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.casco/cve-intelligence", "name": "CVE Intelligence by Casco", "kind": "mcp", "official": null, "desc": "Free CVE lookup, dependency vulnerability checks, and CVE updates. No signup or API key.", "repo": null, "install": ["https://casco.com/cve/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cve intelligence by casco", "live": "Live · 910 ms · 4 tools · free to try: `list_ecosystems` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-cve-security-advisory-vulnerability-database", "name": "CVE Security Advisories (NVD High & Critical) — buy per-query in-session (cvewatch)", "kind": "mcp", "official": null, "desc": "CVE advisories: high/critical NVD vulns, daily digest. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/cvewatch-cve-security-advisories-nvd-high-critical-9a16b6/http"], "stars": null, "pushed": null, "license": null, "plat": "nvd", "live": "Live · 1609 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.kriton-dev/cve-risk-metrics", "name": "CVE Vulnerability Lookup — CVSS Scores & NVD Status", "kind": "mcp", "official": null, "desc": "Look up NVD CVE dates, status, numeric CVSS scores and severity", "repo": null, "install": ["https://mcp.apify.com/?tools=hermeskd/cve-risk-metrics"], "stars": null, "pushed": null, "license": null, "plat": "nvd", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.weiseer/cve-cache", "name": "cve-cache", "kind": "mcp", "official": null, "desc": "Recent CVE + GHSA cache for AI agents auditing dependencies (npm/PyPI/Cargo/Maven/Go).", "repo": "https://github.com/weiseer/cve-cache-mcp", "install": ["npm:@weiseer/cve-cache-mcp"], "stars": 0, "pushed": "2026-06-01T09:28:33Z", "license": null, "plat": "cve-cache", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.shadoprizm/cyberlens-ai", "name": "CyberLens AI", "kind": "mcp", "official": null, "desc": "Review saved CyberLens website and repository scans through read-only OAuth tools.", "repo": null, "install": ["https://www.cyberlensai.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cyberlens", "live": "Live · 1750 ms · 6 tools · free to try: `explain_website_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/cyberqp-mcp", "name": "CyberQP", "kind": "mcp", "official": null, "desc": "MCP server for CyberQP's privileged access management API.", "repo": "https://github.com/WYRE-AI/cyberqp-mcp", "install": ["oci:ghcr.io/wyre-ai/cyberqp-mcp:v1.0.2"], "stars": 0, "pushed": "2026-11-12T17:00:48Z", "license": "NOASSERTION", "plat": "cyberqp", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-cybersecurity-news-breach-alert", "name": "Cybersecurity News & Breach Alerts — buy per-query in-session (bleepingwatch)", "kind": "mcp", "official": null, "desc": "Cybersecurity news & breach alerts: hacks, patches. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/bleepingwatch-cybersecurity-news-breach-alerts-522e02/http"], "stars": null, "pushed": null, "license": null, "plat": "bleeping computer", "live": "Live · 1448 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.FoundryNet/cyber-intel-mcp", "name": "Cybersecurity Threat Intelligence MCP", "kind": "mcp", "official": null, "desc": "CVE search, vulnerability database, EPSS exploit prediction, KEV, IP reputation & threat feed.", "repo": "https://github.com/FoundryNet/cyber-intel-mcp", "install": ["https://cyber-intel-mcp-production.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cybersecurity threat", "live": "Down · TimeoutError: The read operation timed out (checked 2026-11-13)"}, {"id": "mcp:com.cyberspf/mcp", "name": "CyberSPF", "kind": "mcp", "official": null, "desc": "Assess a domain, IP or ASN: mail and DNS security, certificates, routing and a report card.", "repo": null, "install": ["pypi:cyberspf-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:app.ulapcybo/attest", "name": "CYBO Attest", "kind": "mcp", "official": null, "desc": "Scan, fix and justify your application code until it is approved to ship.", "repo": "https://github.com/ulap-co/cybo-attest-mcp", "install": ["https://attest.ulapcybo.app/mcp"], "stars": 0, "pushed": "2026-10-21T23:11:26Z", "license": null, "plat": "cybo", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:ai.cybret/findings", "name": "Cybret findings", "kind": "mcp", "official": null, "desc": "Validated API and app vulnerability findings with remediation guidance.", "repo": null, "install": ["https://mcp.cybret.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cybret", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.getcyphrex/cyphrex-mcp", "name": "Cyphrex", "kind": "mcp", "official": null, "desc": "Checks AI agent actions before they run. Signed, RFC 3161 timestamped evidence for audits.", "repo": "https://github.com/getcyphrex/platform", "install": ["https://mcp.cyphrex.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai agent actions", "live": "Live · 996 ms · 11 tools · `get_audit_log` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.milesdev888/guardian", "name": "CYRE Guardian", "kind": "mcp", "official": null, "desc": "Solana address risk grades and token scans for AI agents. Pay-per-call via x402 (USDC on Base).", "repo": "https://github.com/milesdev888/cyre-fraud-prediction", "install": ["https://cyre-fraud-prediction.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "solana", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.OjasKord/data-compliance-mcp", "name": "Data Compliance Classifier MCP", "kind": "mcp", "official": null, "desc": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.", "repo": "https://github.com/OjasKord/data-compliance-mcp", "install": ["npm:data-compliance-mcp", "https://data-compliance-mcp-production.up.railway.app"], "stars": 0, "pushed": "2026-09-07T12:34:42Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.beepboop2025/data-breach-detector", "name": "data-breach-detector", "kind": "mcp", "official": null, "desc": "Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.", "repo": "https://github.com/beepboop2025/data-breach-detector", "install": ["pypi:data-breach-detector", "https://breach.seiche.info/mcp"], "stars": 0, "pushed": "2026-08-22T20:41:11Z", "license": "MIT", "plat": "data-breach-detector", "live": "Not checked (runs locally)"}, {"id": "mcp:com.datanexusmcp/mcp-server", "name": "DataNexus MCP", "kind": "mcp", "official": null, "desc": "Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.", "repo": null, "install": ["npm:@datanexusmcp/mcp-server", "https://datanexusmcp.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-debian-security-advisory-dsa-linux", "name": "Debian Security Advisories — buy per-query in-session (debianwatch)", "kind": "mcp", "official": null, "desc": "Debian Security Advisories (DSA). $0.01/query. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/debian-security-advisories-05eb6d/http"], "stars": null, "pushed": null, "license": null, "plat": "debian", "live": "Live · 971 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.run402.deepcheck-kyb/mcp", "name": "DeepCheck KYB v4.0 MCP", "kind": "mcp", "official": null, "desc": "Real-time B2B counterparty KYB, SSL, DNSSEC & DMARC/SPF trust verifier ($1 USDC).", "repo": null, "install": ["https://deepcheck-kyb.run402.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 903 ms · 4 tools · free to try: `get_package_manifest` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.systechgd/defectdojo-community-mcp", "name": "DefectDojo Community", "kind": "mcp", "official": null, "desc": "Read-only MCP server for DefectDojo Community Edition: triage findings, grouped across products.", "repo": "https://github.com/systechgd/defectdojo-community-mcp", "install": ["pypi:defectdojo-community-mcp", "oci:ghcr.io/systechgd/defectdojo-community-mcp:0.1.1"], "stars": 0, "pushed": "2026-11-12T23:35:52Z", "license": "Apache-2.0", "plat": "defectdojo", "live": "Not checked (runs locally)"}, {"id": "mcp:com.demisignal/mcp", "name": "DemiSignal", "kind": "mcp", "official": null, "desc": "Check a domain's DMARC, SPF, DKIM, MX, BIMI and MTA-STS records. Generate SPF and DMARC records.", "repo": null, "install": ["https://demisignal.com/mcp?utm_source=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2271 ms · 3 tools · free to try: `check_domain` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.kaneky/depcheck", "name": "Depcheck", "kind": "mcp", "official": null, "desc": "Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.", "repo": null, "install": ["https://depcheck.kaneky.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1339 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.ladanyin/dependency-check", "name": "Dependency check", "kind": "mcp", "official": null, "desc": "Check a package version for known vulnerabilities and Packagist release facts.", "repo": "https://github.com/ladanyin/agentlane", "install": ["https://deps.bestsmartgoods.com/mcp"], "stars": 0, "pushed": "2026-11-05T21:09:45Z", "license": null, "plat": "package", "live": "Down · URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issue (checked 2026-11-13)"}, {"id": "mcp:io.github.brunckel/dependency-vuln-check", "name": "Dependency Vulnerability Check (OSV)", "kind": "mcp", "official": null, "desc": "Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.", "repo": null, "install": ["https://mcp.apify.com/?tools=implementable_antler/dependency-vuln-check"], "stars": null, "pushed": null, "license": null, "plat": "apify", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-dependency-vulnerability-malicious-package-security", "name": "Dependency Vulnerability Tracker — package security advisories ($0.01/query)", "kind": "mcp", "official": null, "desc": "Dependency vulns & malicious-package advisories. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673/http"], "stars": null, "pushed": null, "license": null, "plat": "nvd", "live": "Live · 1423 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.yc-droid/depscout", "name": "DepScout", "kind": "mcp", "official": null, "desc": "Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.", "repo": null, "install": ["https://depscout.salesup.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1431 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:com.soflution/depsonar", "name": "Depsonar", "kind": "mcp", "official": null, "desc": "Dependency audits, live CVE scans, migration detection and stack health across 9 languages.", "repo": "https://github.com/Soflutionltd/depsonar", "install": ["mcpb:https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb"], "stars": 0, "pushed": "2026-11-13T03:22:32Z", "license": "MIT", "plat": "software", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.ecoa/ecoa", "name": "dev.ecoa/ecoa", "kind": "mcp", "official": null, "desc": "Verificação de segurança e conformidade de sites: cabeçalhos, TLS, DNS, e-mail, LGPD e pentest.", "repo": "https://github.com/ecoa-org/ecoa", "install": ["https://mcp.ecoa.dev/api/mcp", "https://mcp.ecoa.dev/api/mcp/public"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:dev.fly.obol-x402/obol", "name": "dev.fly.obol-x402/obol", "kind": "mcp", "official": null, "desc": "Pre-trade safety verdicts for agents: token rug/honeypot, calldata guard, wallet risk — signed x402.", "repo": null, "install": ["https://obol-mcp.fly.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Live · 4345 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Ansarii/devops-code-auditor", "name": "DevOps & Cloud Code Auditor", "kind": "mcp", "official": null, "desc": "Detects database migration table locks, terraform cost leaks, and OWASP API flaws.", "repo": "https://github.com/Ansarii/devops-code-auditor", "install": ["https://neon_innovation_lab--devops-code-auditor.apify.actor/mcp"], "stars": 0, "pushed": "2026-09-20T00:20:28Z", "license": "MIT", "plat": "devops", "live": "Down · URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certif (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/didit", "name": "Didit", "kind": "mcp", "official": null, "desc": "Didit MCP — wraps the Didit v3 identity / compliance API (didit.me)", "repo": "https://github.com/pipeworx-io/mcp-didit", "install": ["npm:@pipeworx/mcp-didit", "https://gateway.pipeworx.io/didit/mcp"], "stars": 0, "pushed": "2026-11-09T13:52:25Z", "license": "MIT", "plat": "didit", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/dilisense", "name": "Dilisense", "kind": "mcp", "official": null, "desc": "dilisense MCP — sanctions / PEP / criminal / adverse-media screening (AML/KYC)", "repo": "https://github.com/pipeworx-io/mcp-dilisense", "install": ["npm:@pipeworx/mcp-dilisense", "https://gateway.pipeworx.io/dilisense/mcp"], "stars": 0, "pushed": "2026-11-09T13:52:43Z", "license": "MIT", "plat": "dilisense", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mgleonard-ops/double-check", "name": "Double Check", "kind": "mcp", "official": null, "desc": "AI-powered scam detection for suspicious texts, emails, and screenshots. US-focused.", "repo": null, "install": ["https://web-production-970ba.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2210 ms · 1 tools · free to try: `check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Inferensys/dr-mcp", "name": "dr-mcp", "kind": "mcp", "official": null, "desc": "Audits MCP configs, scores risk, and creates reversible repair plans.", "repo": "https://github.com/Inferensys/dr-mcp", "install": ["npm:@inferensys/dr-mcp"], "stars": 0, "pushed": "2026-05-20T08:51:51Z", "license": "MIT", "plat": "crypto wallets", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pduggusa/dredd-mcp", "name": "Dredd MCP", "kind": "mcp", "official": null, "desc": "Pre-flight verdict on MCP servers: known-bad identity, CVEs, dependency tree, tool drift. Signed.", "repo": "https://github.com/pduggusa/dredd-mcp", "install": ["https://analytics.dugganusa.com/api/v1/dredd/mcp"], "stars": 0, "pushed": "2026-11-03T17:14:05Z", "license": "MIT", "plat": "", "live": "Live · 1761 ms · 1 tools · free to try: `check_mcp_server` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-brake-mcp", "name": "Eclipse Brake", "kind": "mcp", "official": null, "desc": "Third-party halt authority for fixture fleets: poll-based BRAKE verdicts, signed halt receipts.", "repo": "https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-brake-mcp", "install": [], "stars": null, "pushed": null, "license": null, "plat": "eclipse", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-exportcheck-mcp", "name": "Eclipse Exportcheck", "kind": "mcp", "official": null, "desc": "Vintage-sealed fixture screening verdicts; clearance provable after lists change, local.", "repo": "https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-exportcheck-mcp", "install": [], "stars": null, "pushed": null, "license": null, "plat": "eclipse", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/friction", "name": "Eclipse Friction MCP", "kind": "mcp", "official": null, "desc": "Signed agent-only friction board: findings backed by verified trace packs, in a closed vocabulary.", "repo": "https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-friction-mcp", "install": ["oci:ghcr.io/cyan-eclipse-technologies-llc/eclipse-friction-mcp:0.1.1"], "stars": null, "pushed": null, "license": null, "plat": "eclipse", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/health-check", "name": "Eclipse Health Check MCP", "kind": "mcp", "official": null, "desc": "Scan an MCP server or agent configuration for security posture — evidence-bound findings", "repo": null, "install": [], "stars": null, "pushed": null, "license": null, "plat": "eclipse", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.asostudio.aso-x402-screen/edgescreen", "name": "EdgeScreen x402 Security Screening", "kind": "mcp", "official": null, "desc": "Free MCP hooks + $0.002 Base USDC x402 OFAC, impersonation, prompt, SSRF, secret & diff screening.", "repo": null, "install": ["https://aso-x402-screen.asostudio.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "edgescreen", "live": "Live · 827 ms · 8 tools · `health_check` asked for payment (checked 2026-11-14)"}, {"id": "mcp:io.github.hernaninverso/eleion-scanner-mcp", "name": "Eleion Scanner", "kind": "mcp", "official": null, "desc": "Register/verify your domains, queue security scans, and read findings (CVE, severity).", "repo": "https://github.com/hernaninverso/eleion-scanner-mcp", "install": ["npm:eleion-scanner-mcp"], "stars": 0, "pushed": "2026-06-30T15:36:30Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/benchmark-access-request-review-2026-09-10-81479355", "name": "Employee Operations — Access Request Review — Larkspur Partners (81479355)", "kind": "mcp", "official": null, "desc": "Free to compete: testnet faucet funds everything. 12 synthetic access request exception cases:…", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/benchmarks/access-request-review-2026-09-10-81479355/http"], "stars": null, "pushed": null, "license": null, "plat": "access request review", "live": "Live · 1248 ms · 29 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.endoflife-ai/endoflife-mcp", "name": "endoflife.ai — Software Lifecycle Intelligence", "kind": "mcp", "official": null, "desc": "EOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 700+ products.", "repo": "https://github.com/endoflife-ai/endoflife-mcp", "install": ["https://mcp.endoflife.ai"], "stars": 0, "pushed": "2026-11-11T04:14:21Z", "license": "MIT", "plat": "", "live": "Live · 2641 ms · 10 tools · free to try: `get_risk_score` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.enokilabs/enoki", "name": "Enoki", "kind": "mcp", "official": null, "desc": "Test your AI agents for security and safety weaknesses, and re-verify the fixes.", "repo": null, "install": ["https://mcp.enokilabs.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:uk.co.cybercentry/erc-8126-scan", "name": "ERC-8126 Scan", "kind": "mcp", "official": null, "desc": "378k+ ERC-8004 agents and their security verifications. Two tools free, the rest USDC over x402.", "repo": "https://github.com/Cybercentry/erc-8126-scan-mcp", "install": ["https://erc8126scan.ai/api/mcp"], "stars": 0, "pushed": "2026-08-22T16:08:29Z", "license": "MIT", "plat": "", "live": "Live · 1386 ms · 6 tools · `search_agents` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.apidefects/errata", "name": "Errata", "kind": "mcp", "official": null, "desc": "What is known to be broken in an MCP server or API operation, with the check that found it.", "repo": null, "install": ["https://apidefects.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 859 ms · 1 tools · free to try: `check_defects` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/eset-protect-mcp", "name": "ESET PROTECT", "kind": "mcp", "official": null, "desc": "MCP server for ESET PROTECT's ESET Connect API - device, EDR, vulnerability, patch, and user data.", "repo": "https://github.com/WYRE-AI/eset-protect-mcp", "install": ["oci:ghcr.io/wyre-ai/eset-protect-mcp:v1.0.2"], "stars": 0, "pushed": "2026-11-12T16:57:28Z", "license": "NOASSERTION", "plat": "eset protect", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.jellewas/eu-audit-mcp", "name": "EU Audit Trail", "kind": "mcp", "official": null, "desc": "Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.", "repo": "https://github.com/jellewas/eu-audit-mcp", "install": ["pypi:eu-audit-mcp"], "stars": 0, "pushed": "2026-07-24T14:04:15Z", "license": "Apache-2.0", "plat": "eu audit trail", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sebastianfoerste/eu-reg-mcp", "name": "EU Regulatory Grounding", "kind": "mcp", "official": null, "desc": "Cited ESMA MiCAR register search and change tracking, white paper linting, EU AI Act classification", "repo": "https://github.com/sebastianfoerste/eu-reg-mcp", "install": ["pypi:eu-reg-mcp"], "stars": 0, "pushed": "2026-11-12T07:25:16Z", "license": "MIT", "plat": "eu regulatory", "live": "Not checked (runs locally)"}, {"id": "mcp:eu.riskrouter/evidence-log", "name": "eu.riskrouter/evidence-log", "kind": "mcp", "official": null, "desc": "Tamper-evident evidence log: signed heads, proofs, and recording salted digests of your records.", "repo": null, "install": ["https://api.riskrouter.eu/mcp"], "stars": null, "pushed": null, "license": null, "plat": "evidence-log", "live": "Live · 3084 ms · 8 tools · free to try: `get_checkpoint` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.eurogpsr/eu-ai-act", "name": "EuroComply EU AI Act", "kind": "mcp", "official": null, "desc": "Classify AI systems by EU AI Act risk tier, estimate fines, write Art. 50 notices, list deadlines.", "repo": null, "install": ["https://eurogpsr.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1072 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:com.evolize/accessibility-scanner", "name": "Evolize", "kind": "mcp", "official": null, "desc": "Accessibility scans with evidence, public reports, and fresh checks after fixes.", "repo": null, "install": ["https://evolize.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1745 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:ai.excessionlabs/site", "name": "Excession Labs: CVE intelligence and security research", "kind": "mcp", "official": null, "desc": "Search CVEs, source software/version evidence, KEV, EPSS and public security research.", "repo": null, "install": ["https://excessionlabs.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "excession labs", "live": "Live · 2648 ms · 10 tools · free to try: `search_site` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/collusion-detection-sentinel-mcp", "name": "Execute collusion-detection-sentinel-mcp", "kind": "mcp", "official": null, "desc": "Premium agentic endpoint for collusion-detection-sentinel-mcp.", "repo": null, "install": ["https://api.m2mcent.com/collusion-detection-sentinel-mcp/sse"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 451 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/diesel-anti-theft-mcp", "name": "Execute diesel-anti-theft-mcp", "kind": "mcp", "official": null, "desc": "Premium agentic endpoint for diesel-anti-theft-mcp.", "repo": null, "install": ["https://api.m2mcent.com/diesel-anti-theft-mcp/sse"], "stars": null, "pushed": null, "license": null, "plat": "diesel", "live": "Live · 404 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/dilithium-signature-verifier-mcp", "name": "Execute dilithium-signature-verifier-mcp", "kind": "mcp", "official": null, "desc": "Premium agentic endpoint for dilithium-signature-verifier-mcp.", "repo": null, "install": ["https://api.m2mcent.com/dilithium-signature-verifier-mcp/sse"], "stars": null, "pushed": null, "license": null, "plat": "dilithium", "live": "Live · 381 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.exploit-intel/eip-mcp", "name": "Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database", "kind": "mcp", "official": null, "desc": "Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)", "repo": null, "install": ["pypi:eip-mcp", "https://mcp.exploit-intel.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "exploit intelligence platform", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-exploit-db-exploit-database-proof-of-concept", "name": "Exploit-DB New Exploits & Proof-of-Concepts — buy per-query in-session (exploitdb)", "kind": "mcp", "official": null, "desc": "Exploit-DB: new public exploits & PoCs, daily. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/exploitdb-exploit-db-new-public-exploits-pocs-e3345b/http"], "stars": null, "pushed": null, "license": null, "plat": "exploit-db", "live": "Live · 1731 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.ExposureGuard/exposureguard-mcp", "name": "ExposureGuard", "kind": "mcp", "official": null, "desc": "Domain security scanning for AI agents. A-F grades, 8 checks, fix snippets.", "repo": "https://github.com/ExposureGuard/exposureguard-mcp", "install": ["pypi:exposureguard-mcp"], "stars": 0, "pushed": "2026-04-18T14:25:29Z", "license": null, "plat": "domain", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.zvmzaretsky/fabtally-guard", "name": "FabTally Guard", "kind": "mcp", "official": null, "desc": "Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.", "repo": "https://github.com/zvmzaretsky/fabtally-guard-mcp", "install": ["https://guard.fabtally.com/mcp"], "stars": 0, "pushed": "2026-08-01T04:28:13Z", "license": "MIT", "plat": "", "live": "Live · 1762 ms · 4 tools · free to try: `deps_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.fairquery/fairquery-agent-trust-mcp", "name": "Fairquery Agent Trust & Data Safety", "kind": "mcp", "official": null, "desc": "PII/secret redaction, email checks, sanctions screening and OSV vulnerability lookups for AI agents.", "repo": "https://github.com/fairquery/fairquery-agent-trust-mcp", "install": ["npm:@fairquery/agent-trust-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ygfalcon/falcon-shield", "name": "Falcon Shield", "kind": "mcp", "official": null, "desc": "Pre-sign Solana tx guard for agents: ALLOW/WARN/BLOCK verdict, x402 USDC pay-per-call.", "repo": null, "install": ["https://falcon-shield.falcon-sol.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "solana", "live": "Live · 770 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.fallax/fallax", "name": "Fallax", "kind": "mcp", "official": null, "desc": "Fallax is a phishing simulation and security awareness training platform. Read your results.", "repo": null, "install": ["https://app.fallax.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "fallax", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.zinoodev85/fatalguard", "name": "FatalGuard", "kind": "mcp", "official": null, "desc": "Read-only MCP server inside WordPress: PHP error logs, debug.log and fatal errors.", "repo": "https://github.com/zinoodev85/fatalguard", "install": ["https://{site}/wp-json/fatalguard/v1/mcp"], "stars": 0, "pushed": "2026-11-10T20:21:09Z", "license": "GPL-2.0", "plat": "wordpress", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.fedlin/fedlin-mcp-server", "name": "FEDLIN Scanners", "kind": "mcp", "official": null, "desc": "Exposes FEDLIN's public security scanners as agent-callable tools over Streamable HTTP.", "repo": "https://github.com/fedlinllc/fedlin-mcp-server", "install": ["https://mcp.fedlin.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "fedlin", "live": "Live · 984 ms · 4 tools · free to try: `get_agent_exposure_scanner` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.fhi-llc-1118.polished-truth-c514/fhi-x402-security-tools", "name": "FHI MCP Server Security Audit", "kind": "mcp", "official": null, "desc": "Free payment guide and Base-USDC x402 MCP security, package, domain, and SEC tools.", "repo": null, "install": ["https://polished-truth-c514.fhi-llc-1118.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Live · 1748 ms · 7 tools (checked 2026-11-13)"}, {"id": "mcp:io.fidro/fidro", "name": "Fidro", "kind": "mcp", "official": null, "desc": "Signup fraud checks: score emails and IPs, look up IPs and manage your blocklist.", "repo": null, "install": ["https://fidro.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "fidro", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.filltrust/questions", "name": "FillTrust security questionnaire corpus", "kind": "mcp", "official": null, "desc": "Guidance for answering vendor security questionnaires. Every result carries the page it came from.", "repo": null, "install": ["https://www.filltrust.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vendor security questionnaires", "live": "Down · HTTP 502 (checked 2026-11-14)"}, {"id": "mcp:io.github.findip-net/findip-mcp", "name": "FindIP", "kind": "mcp", "official": null, "desc": "IP intelligence lookups and FindIP Shield visitor risk signals for AI assistants.", "repo": "https://github.com/findip-net/findip-mcp", "install": ["npm:@findip/mcp"], "stars": 0, "pushed": "2026-11-09T14:44:20Z", "license": "MIT", "plat": "ip intelligence", "live": "Not checked (runs locally)"}, {"id": "mcp:com.808bits/fips-cmvp", "name": "FIPS 140 certificate tracker", "kind": "mcp", "official": null, "desc": "Every NIST FIPS 140 certificate, plus the modules-in-process queue NIST publishes only as a page.", "repo": "https://github.com/808bits/fips-mcp", "install": ["https://fips.808bits.com/mcp"], "stars": 0, "pushed": "2026-09-03T23:08:45Z", "license": "MIT", "plat": "nist", "live": "Live · 1033 ms · 6 tools · free to try: `fips_search` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.fixedin/fixedin", "name": "FixedIn", "kind": "mcp", "official": null, "desc": "Actively exploited? End of life? Which version fixes it? CVE verdicts for server software.", "repo": null, "install": ["https://fixedin.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "server software", "live": "Live · 1748 ms · 3 tools · free to try: `list_products` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.lightsmite/fixlane", "name": "Fixlane", "kind": "mcp", "official": null, "desc": "Known security incidents in developer software, with reviewed fix procedures.", "repo": "https://github.com/lightsmite/fixlane-plugin", "install": ["https://fixlane.poparecon.com/mcp"], "stars": 0, "pushed": "2026-11-11T01:05:54Z", "license": "MIT", "plat": "", "live": "Live · 2006 ms · 5 tools · free to try: `get_fix_prompt` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.flawpilot/mcp", "name": "FlawPilot", "kind": "mcp", "official": null, "desc": "Scan websites and code for security, performance and SEO issues from your AI assistant.", "repo": null, "install": ["https://mcp.flawpilot.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.vasilicasijarvis/flowsentry", "name": "FlowSentry", "kind": "mcp", "official": null, "desc": "Security scanner for n8n workflows + live MCP Trust-Check. 18 rules, OWASP mapped. Paid x402 API.", "repo": "https://github.com/vasilicasijarvis/flowsentry", "install": ["https://flowsentry-agentpay2.vercel.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.OlsOls4/fraudkit", "name": "FraudKit", "kind": "mcp", "official": null, "desc": "Fraud risk score for signups and orders from email, IP, phone and user-agent", "repo": "https://github.com/OlsOls4/webkit-api", "install": ["https://fraudkit-fraud-risk-score-for-signups-orders.p.rapidapi.com/mcp"], "stars": 0, "pushed": "2026-10-15T17:29:21Z", "license": null, "plat": "fraudkit", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:dev.freysa.economic-agent-369/freysa-intelligence", "name": "Freysa Security", "kind": "mcp", "official": null, "desc": "Security intelligence for AI agents. 27 x402 endpoints: honeypot, forensics, CAPTCHA, preflight.", "repo": null, "install": ["https://economic-agent-369.freysa.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai agents", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.frogeye-ai/mcp", "name": "Frogeye Security Scanner", "kind": "mcp", "official": null, "desc": "Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.", "repo": "https://github.com/frogeye-ai/mcp", "install": ["https://mcp.frogeye.ai/sse", "https://mcp.frogeye.ai/mcp"], "stars": 0, "pushed": "2026-05-05T10:36:45Z", "license": null, "plat": "", "live": "Down · HTTP 500 (checked 2026-11-13)"}, {"id": "mcp:com.frontsentinel/domain-security", "name": "Front Sentinel", "kind": "mcp", "official": null, "desc": "Read-only security checks for dApp domains: registry lock, DNSSEC, CAA, SRI, SEAL DNS controls", "repo": null, "install": ["https://frontsentinel.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2417 ms · 4 tools · free to try: `check_sri` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Garitalab5/garita-mcp", "name": "Garita MCP", "kind": "mcp", "official": null, "desc": "30 security tools + the Vigia agent to audit MCP servers before you connect.", "repo": "https://github.com/Garitalab5/garita-mcp-server", "install": ["https://garita-mcp-server.onrender.com/mcp"], "stars": 0, "pushed": "2026-11-11T16:34:24Z", "license": "MIT", "plat": "", "live": "Live · 1239 ms · 30 tools · `check_package_authenticity` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.geekwala/dependency-scanner", "name": "GeekWala Dependency Scanner", "kind": "mcp", "official": null, "desc": "Check dependencies for known CVEs with EPSS and CISA KEV context. Read-only; free API token.", "repo": null, "install": ["https://www.geekwala.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "geekwala", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.alphaparkinc/genpark-prompt-injection-canary-leak-sentinel-skill", "name": "GenPark Prompt Injection Canary Leak Sentinel", "kind": "mcp", "official": null, "desc": "HMAC-signed zero-width invisible canary token generator and output response leak auditor", "repo": "https://github.com/alphaparkinc/genpark-prompt-injection-canary-leak-sentinel-skill", "install": ["mcpb:https://github.com/Alpha-Park/genpark-prompt-injection-canary-leak-sentinel-skill/releases/download/v1.0.1/genpark-prompt-injection-canary-leak-sentinel-skill.mcpb"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.alphaparkinc/genpark-sql-injection-ast-taint-analyzer-skill", "name": "GenPark SQL Injection AST Taint Analyzer", "kind": "mcp", "official": null, "desc": "Dynamic SQL AST taint tracking and static vulnerability auditor detecting tautology injections", "repo": "https://github.com/alphaparkinc/genpark-sql-injection-ast-taint-analyzer-skill", "install": ["mcpb:https://github.com/Alpha-Park/genpark-sql-injection-ast-taint-analyzer-skill/releases/download/v1.0.1/genpark-sql-injection-ast-taint-analyzer-skill.mcpb"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.krishnaGauss/geo-shield", "name": "GEO Shield", "kind": "mcp", "official": null, "desc": "Detects hidden AI prompt injection, AI recommendation poisoning, sneaky redirects and hidden spam.", "repo": "https://github.com/krishnaGauss/MCP_WebSafe", "install": ["npm:geo-shield-mcp"], "stars": 0, "pushed": "2026-11-12T11:13:47Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ghostchars/ghostchars", "name": "Ghostchars", "kind": "mcp", "official": null, "desc": "Find and remove invisible Unicode: zero-width, tag smuggling, bidi, homoglyphs. Offline.", "repo": "https://github.com/ghostchars/ghostchars", "install": ["npm:ghostchars"], "stars": 0, "pushed": "2026-09-29T18:50:42Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.mike-tusa.glyphguard/glyphguard", "name": "GlyphGuard", "kind": "mcp", "official": null, "desc": "Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.", "repo": null, "install": ["https://glyphguard.mike-tusa.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 594 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Jayanng/gmi-security-mcp", "name": "gmi-security-mcp", "kind": "mcp", "official": null, "desc": "Triage semgrep findings with GMI Inference, with cost shown before every run.", "repo": "https://github.com/Jayanng/gmi-security-mcp", "install": ["pypi:gmi-security-mcp"], "stars": 0, "pushed": "2026-11-12T10:36:36Z", "license": "MIT", "plat": "semgrep", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/data-go-vulnerability-golang-security", "name": "Go Vulnerability Database Tracker — buy per-query in-session (govulnwatch)", "kind": "mcp", "official": null, "desc": "Go vulns: CVEs per module, fixed versions. $0.01/query. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/govulnwatch-go-vulnerability-database-tracker-dac615/http"], "stars": null, "pushed": null, "license": null, "plat": "go vulnerability database", "live": "Live · 1782 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.dontdeployonfriday/golive-check", "name": "Go-Live Check", "kind": "mcp", "official": null, "desc": "Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching.", "repo": null, "install": ["https://dontdeployonfriday.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2028 ms · 4 tools · free to try: `explain_finding` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.UsamaSarwar121/gomobsec-mcp", "name": "GoMobSec", "kind": "mcp", "official": null, "desc": "Scan Android and iOS apps for security issues: findings, MASVS mapping and pentest reports.", "repo": "https://github.com/UsamaSarwar121/gomobsec-mcp", "install": ["pypi:gomobsec-mcp", "https://mcp.gomobsec.ai/mcp"], "stars": 0, "pushed": "2026-11-12T09:17:34Z", "license": "MIT", "plat": "gomobsec", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/greynoise", "name": "Greynoise", "kind": "mcp", "official": null, "desc": "GreyNoise Community MCP — internet scanner classification (free tier with key)", "repo": "https://github.com/pipeworx-io/mcp-greynoise", "install": ["npm:@pipeworx/mcp-greynoise", "https://gateway.pipeworx.io/greynoise/mcp"], "stars": 0, "pushed": "2026-11-09T14:05:50Z", "license": "MIT", "plat": "greynoise", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AbduljabbarBXR/grim-mcp", "name": "grim-mcp", "kind": "mcp", "official": null, "desc": "Security audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.", "repo": null, "install": ["npm:grim-mcp", "pypi:grim-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ronin93/grindfree-agent-security", "name": "GrindFree Agent Security", "kind": "mcp", "official": null, "desc": "Pay-per-call agent security (x402): injection, tools, shell/SQL, memory, leaks, docs, safe web reads", "repo": "https://github.com/ronin93/grindfree-agent-security", "install": ["npm:@grindfree/agent-security-mcp"], "stars": 0, "pushed": "2026-11-12T05:17:52Z", "license": "MIT", "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:com.grisoco/audits", "name": "Grisoco AI security audits", "kind": "mcp", "official": null, "desc": "Smart-contract security audits for EVM chains and DAML: quote, run and fetch reports.", "repo": null, "install": ["https://grisoco.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "evm, daml", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.guardcue/guardcue", "name": "GuardCue", "kind": "mcp", "official": null, "desc": "Checks a site built with AI tools for security problems and gives the fix in plain English.", "repo": null, "install": ["https://api.guardcue.com/api/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.solvionholdings/guardlayer", "name": "GuardLayer", "kind": "mcp", "official": null, "desc": "Security checks for Next.js + Supabase apps: code scan, read-only live DB check, fix confirmation.", "repo": "https://github.com/solvionholdings/guardlayer-plugin", "install": ["https://www.guardlayer.io/api/mcp"], "stars": 0, "pushed": "2026-11-11T18:37:54Z", "license": "MIT", "plat": "next.js + supabase", "live": "Live · 1484 ms · 3 tools · free to try: `get_supabase_snapshot_sql` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pitroldev/guarita", "name": "Guarita", "kind": "mcp", "official": null, "desc": "Authorized security scans, evidence, fix prompts and retests for AI-built web apps.", "repo": null, "install": ["https://api.guarita.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai web apps", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.antonio-castellon/mcp-glp-audit-proxy", "name": "GxP Gateway Audit", "kind": "mcp", "official": null, "desc": "Audits MCP and HTTPS calls. Tamper-evident trail for GLP.", "repo": "https://github.com/antonio-castellon/mcp-glp-audit-proxy", "install": ["pypi:mcp-glp-audit-proxy"], "stars": 0, "pushed": "2026-11-04T21:54:51Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Hacktualiz/hackaiz", "name": "Hackaiz", "kind": "mcp", "official": null, "desc": "Analyze authorized assets and read security findings through your Hackaiz account.", "repo": null, "install": ["https://hackaiz.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "hackaiz", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.bobnetsec/hacker-bob-public-records", "name": "Hacker Bob public records", "kind": "mcp", "official": null, "desc": "Read-only public CVE records, capability metadata, and agent instructions from Hacker Bob.", "repo": "https://github.com/bobnetsec/www", "install": ["https://hackerbob.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "hacker bob", "live": "Live · 736 ms · 22 tools · `get_asset` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.alialrikabi313/hares", "name": "Hares — MCP security scanner", "kind": "mcp", "official": null, "desc": "Multi-layer security scanner for MCP servers and agent skills (injection, exfiltration)", "repo": "https://github.com/alialrikabi313/hares", "install": ["npm:@alihashim313/hares"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.troyhunt/hibp", "name": "Have I Been Pwned", "kind": "mcp", "official": null, "desc": "Breach intelligence API: email search, domain monitoring, passwords and stealer logs.", "repo": null, "install": ["https://haveibeenpwned.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "have i been pwned", "live": "Live · 1407 ms · 17 tools · free to try: `hibp_get_latest_breach` answered without a key (checked 2026-11-13)"}, {"id": "mcp:xyz.heisto/arena", "name": "Heisto", "kind": "mcp", "official": null, "desc": "Prompt-injection Guard checks and public AI red-teaming arena data from Heisto on Solana.", "repo": "https://github.com/heisto-dev/heisto-mcp", "install": ["https://heisto.xyz/mcp"], "stars": 0, "pushed": "2026-11-13T16:03:04Z", "license": "MIT", "plat": "solana", "live": "Live · 3936 ms · 5 tools · `guard_check` asked for an API key (checked 2026-11-14)"}, {"id": "mcp:ai.helixar/mcp", "name": "Helixar Security", "kind": "mcp", "official": null, "desc": "Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.", "repo": "https://github.com/Helixar-AI/helixar-mcp", "install": ["https://mcp.helixar.ai/mcp"], "stars": 0, "pushed": "2026-11-03T21:04:51Z", "license": "Apache-2.0", "plat": "helixar security", "live": "Live · 2153 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:fr.hermetics/rgpd", "name": "Hermetics RGPD", "kind": "mcp", "official": null, "desc": "EU data protection law for AI agents: GDPR, AI Act, EDPB, CJEU and national law, with status.", "repo": null, "install": ["https://hermetics.fr/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.xbt786/hipaa-agent", "name": "HIPAA Agent", "kind": "mcp", "official": null, "desc": "HIPAA compliance AI agent — scan, grade, SRA, and generate compliance docs.", "repo": "https://github.com/xbt786/hipaa-agent-ai.git", "install": ["https://hipaaagent.ai/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "hipaa compliance", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.srotzin/hive-mcp-vault", "name": "Hive Vault", "kind": "mcp", "official": null, "desc": "A2A ZK wallet recovery — guardian swarm, no seed phrase, HiveLaw enforcement", "repo": "https://github.com/srotzin/hive-mcp-vault", "install": ["https://hive-mcp-vault.onrender.com/mcp"], "stars": 0, "pushed": "2026-10-17T01:30:16Z", "license": "MIT", "plat": "hive vault", "live": "Live · 927 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:com.hostsherlock/mcp", "name": "HostSherlock", "kind": "mcp", "official": null, "desc": "Check SPF, DKIM, DMARC and MX of any domain, and read the DMARC reports of domains you monitor.", "repo": null, "install": ["https://mcp.hostsherlock.com/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "hostsherlock", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:ai.yourhuman/human-for-ai", "name": "Human for AI", "kind": "mcp", "official": null, "desc": "Ask a human for legal review, confirmation, a signature, or a physical-world act", "repo": null, "install": ["https://yourhuman.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 987 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.JcJamet/ia-qa-security", "name": "IA-QA Security — 30 tools", "kind": "mcp", "official": null, "desc": "Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.", "repo": "https://github.com/ia-qa-com/mcp", "install": ["https://www.ia-qa.com/mcp/security"], "stars": 0, "pushed": "2026-11-09T22:39:21Z", "license": "MIT", "plat": "", "live": "Live · 2282 ms · 30 tools · free to try: `http_status_lookup` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.jlivingston-Cipher/iamf-sentinel-mcp", "name": "IAMF Sentinel", "kind": "mcp", "official": null, "desc": "MCP server for the iamf-sentinel IAMF conformance validator and the iamf-loom packager", "repo": "https://github.com/jlivingston-Cipher/iamf-sentinel-mcp", "install": ["pypi:iamf-sentinel-mcp"], "stars": 0, "pushed": "2026-11-12T01:23:20Z", "license": "Apache-2.0", "plat": "iamf", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dcvalentino69-ux/innovalyxx-sovereign-edge", "name": "Innovalyxx Sovereign Edge", "kind": "mcp", "official": null, "desc": "Verified cyber-physical AI tools. 25 MCP tools, x402-payable on Base.", "repo": "https://github.com/dcvalentino69-ux/innovalyxx-platform", "install": ["https://edge.innovalyxx.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Nomadu27/insaits", "name": "InsAIts - AI Communication Security Monitor", "kind": "mcp", "official": null, "desc": "Runtime AI-to-AI security monitor. 23 anomaly types, OWASP MCP Top 10 coverage.", "repo": "https://github.com/Nomadu27/InsAIts", "install": ["pypi:insa-its"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.cybermax-tools.cybermax/insidewell-api", "name": "Insidewell", "kind": "mcp", "official": null, "desc": "Insider trading API + MCP: SEC Form 4 buys/sells, cluster buys. Keys $19/mo; 100 free/day.", "repo": "https://gitlab.com/CyberMax.tools/agent-tools", "install": ["https://insidewell-api.cybermaxtools.com/mcp?via=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "sec", "live": "Live · 643 ms · 3 tools · free to try: `data_status` answered without a key (checked 2026-11-13)"}, {"id": "mcp:org.internetsecure/security-monitor", "name": "InternetSecure", "kind": "mcp", "official": null, "desc": "Security grades, SSL/TLS, headers and uptime for your domains, plus a CI deploy gate.", "repo": null, "install": ["https://internetsecure.org/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ci deploy gate", "live": "Live · 1170 ms · 10 tools · `get_scan` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.intesta/registry", "name": "Intesta", "kind": "mcp", "official": null, "desc": "Trust registry for agents: check_trust verdict A0-A4, signed fact passports, honest refusals.", "repo": null, "install": ["https://intesta.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "intesta", "live": "Live · 2454 ms · 6 tools · free to try: `list_entities` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.intesta/intesta-mcp", "name": "Intesta — trust registry lookup", "kind": "mcp", "official": null, "desc": "One-call trust check for any domain (A0-A4, verdict, signed) + fact passports; same tools as remote", "repo": "https://github.com/agentlabbusiness/intesta-mcp", "install": ["pypi:intesta-mcp"], "stars": 0, "pushed": "2026-09-14T21:25:50Z", "license": "MIT", "plat": "intesta", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.0xsims/rubric-mcp", "name": "io.github.0xsims/rubric-mcp", "kind": "mcp", "official": null, "desc": "Attested evidence tools for AI agents: sanctions screening, agent/wallet records, paid via x402.", "repo": "https://github.com/0xsims/rubric-mcp", "install": ["npm:@rubric-protocol/mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.0xsims/rubric-mcp-server", "name": "io.github.0xsims/rubric-mcp-server", "kind": "mcp", "official": null, "desc": "Attest agent decisions and verify records on a public ledger. Evidence, not just data.", "repo": "https://github.com/0xsims/rubric-mcp-py", "install": ["pypi:rubric_mcp_server"], "stars": null, "pushed": null, "license": null, "plat": "public ledger", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.abyssbugg-labs/sourcery", "name": "io.github.abyssbugg-labs/sourcery", "kind": "mcp", "official": null, "desc": "Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.", "repo": "https://github.com/abyssbugg-labs/sourcery-agent-bundle", "install": ["npm:@abyssbugg/sourcery"], "stars": 0, "pushed": "2026-10-01T03:00:11Z", "license": "MIT", "plat": "sourcery", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.abyssbugg/sourcery", "name": "io.github.abyssbugg/sourcery", "kind": "mcp", "official": null, "desc": "Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.", "repo": "https://github.com/abyssbugg/sourcery-agent-bundle", "install": ["npm:@abyssbugg/sourcery"], "stars": 0, "pushed": "2026-10-01T03:00:11Z", "license": "MIT", "plat": "sourcery", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.adamgraymon/agent-skill-security-escrow-auditor", "name": "io.github.adamgraymon/agent-skill-security-escrow-auditor", "kind": "mcp", "official": null, "desc": "ERC-8183 Agent Skill, Prompt & MCP Plugin Anti-Trojan Auditor & USDC Escrow on Base.", "repo": "https://github.com/adamgraymon/Own_adam", "install": ["https://own-adam.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "base", "live": "Live · 527 ms · 12 tools · free to try: `verify_onchain_escrow_status` answered without a key (checked 2026-11-15)"}, {"id": "mcp:io.github.adamgraymon/solidity-smart-contract-escrow-auditor", "name": "io.github.adamgraymon/solidity-smart-contract-escrow-auditor", "kind": "mcp", "official": null, "desc": "Autonomous ERC-8183 Solidity Smart Contract Security Auditor & USDC Escrow on Base Mainnet.", "repo": "https://github.com/adamgraymon/Own_adam", "install": ["https://own-adam.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "base", "live": "Live · 527 ms · 12 tools · free to try: `verify_onchain_escrow_status` answered without a key (checked 2026-11-15)"}, {"id": "mcp:io.github.aitools420/onchain-safety-mcp", "name": "io.github.aitools420/onchain-safety-mcp", "kind": "mcp", "official": null, "desc": "Token-safety for AI agents: rug/honeypot verdict + score across PulseChain, Monad, Base & BSC", "repo": "https://github.com/aitools420/onchain-safety-mcp", "install": ["npm:@wickpics/onchain-safety-mcp"], "stars": 0, "pushed": "2026-07-03T22:16:07Z", "license": "MIT", "plat": "onchain-safety", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ajeermahmood/bouncer-gates", "name": "io.github.ajeermahmood/bouncer-gates", "kind": "mcp", "official": null, "desc": "Stops secrets, cross-tenant queries and unsafe migrations before they merge.", "repo": "https://github.com/ajeermahmood/bouncer-gates", "install": ["npm:bouncer-gates"], "stars": 0, "pushed": "2026-10-20T17:20:11Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.apeirontrade/provenance-mcp", "name": "io.github.apeirontrade/provenance-mcp", "kind": "mcp", "official": null, "desc": "Wash-traffic risk checks for Algorand x402 endpoints before your agent trusts or pays them.", "repo": "https://github.com/apeirontrade/provenance-mcp", "install": ["npm:provenance-mcp", "mcpb:https://github.com/apeirontrade/provenance-mcp/releases/download/v0.1.1/provenance-mcp.mcpb"], "stars": 0, "pushed": "2026-09-18T13:36:36Z", "license": "MIT", "plat": "algorand", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.aristiun/aribot", "name": "io.github.aristiun/aribot", "kind": "mcp", "official": null, "desc": "Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.", "repo": "https://github.com/aristiun/aribot-mcp", "install": ["https://mcp.aribot.ayurak.com/mcp"], "stars": 0, "pushed": "2026-07-13T13:22:06Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.attestd-io/attestd-mcp", "name": "io.github.attestd-io/attestd-mcp", "kind": "mcp", "official": null, "desc": "CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm).", "repo": "https://github.com/attestd-io/attestd-mcp", "install": ["npm:@attestd/mcp"], "stars": 0, "pushed": "2026-10-08T19:11:27Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Baneado98/ci-sentinel", "name": "io.github.Baneado98/ci-sentinel", "kind": "mcp", "official": null, "desc": "Multi-CI security scanner with a live threat-intel feed of compromised CI components", "repo": "https://github.com/Baneado98/ci-sentinel", "install": ["https://ci-sentinel.vercel.app/mcp"], "stars": 0, "pushed": "2026-06-24T09:59:47Z", "license": "MIT", "plat": "ci components", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.bighippoman/license-compliance", "name": "io.github.bighippoman/license-compliance", "kind": "mcp", "official": null, "desc": "Scan npm dependencies for license compliance issues. Catch GPL contamination.", "repo": "https://github.com/bighippoman/license-compliance-mcp", "install": ["npm:license-compliance-mcp"], "stars": 0, "pushed": "2026-03-06T09:30:06Z", "license": "MIT", "plat": "npm", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.brian-mitchell-sec/workspace-tools", "name": "io.github.brian-mitchell-sec/workspace-tools", "kind": "mcp", "official": null, "desc": "Research honeypot. Logs connections and tool arguments; injects instructions. Read README first.", "repo": "https://github.com/brian-mitchell-sec/workspace-tools-mcp", "install": ["https://vandorla.com/mcp"], "stars": 0, "pushed": "2026-08-06T03:56:20Z", "license": "MIT", "plat": "", "live": "Down · HTTP 502 (checked 2026-11-13)"}, {"id": "mcp:io.github.burademirung/protectwith-kb", "name": "io.github.burademirung/protectwith-kb", "kind": "mcp", "official": null, "desc": "AI-security knowledge as MCP: standards-mapped tools (OWASP, NIST, MITRE) for AI agents.", "repo": "https://github.com/burademirung/protectwithai", "install": ["https://protectwith-kb.burademirung.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "owasp", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.caglarbozkurt/heimdall", "name": "io.github.caglarbozkurt/heimdall", "kind": "mcp", "official": null, "desc": "Scan an MCP server or agent config for injection, exfiltration, and risky capabilities.", "repo": "https://github.com/caglarbozkurt/mcp-heimdall", "install": ["npm:mcp-heimdall-scan"], "stars": 0, "pushed": "2026-07-06T16:19:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cdonoyan/shuka", "name": "io.github.cdonoyan/shuka", "kind": "mcp", "official": null, "desc": "Universal trust attestation for AI agents: create, verify, and negotiate Shuka trust proofs.", "repo": "https://github.com/cdonoyan/shuka-agent", "install": ["npm:@shukashake/agent"], "stars": 0, "pushed": "2026-10-27T21:00:39Z", "license": "MIT", "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.chrischall/simplisafe-mcp", "name": "io.github.chrischall/simplisafe-mcp", "kind": "mcp", "official": null, "desc": "Check SimpliSafe system state and sensors, review events, arm/disarm, and control smart locks", "repo": "https://github.com/chrischall/simplisafe-mcp", "install": ["npm:simplisafe-mcp"], "stars": 0, "pushed": "2026-11-10T11:15:31Z", "license": "MIT", "plat": "simplisafe", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CloudCorpRecords/dnsprobe", "name": "io.github.CloudCorpRecords/dnsprobe", "kind": "mcp", "official": null, "desc": "DNS and email-security diagnostics via the keyless intodns.ai API: scans, SPF, DMARC, headers.", "repo": "https://github.com/CloudCorpRecords/dnsprobe", "install": ["npm:@reneturcios/dnsprobe", "oci:ghcr.io/cloudcorprecords/dnsprobe:0.1.0"], "stars": 0, "pushed": "2026-11-02T09:46:34Z", "license": "MIT", "plat": "dns and email security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CloudCorpRecords/hookcheck", "name": "io.github.CloudCorpRecords/hookcheck", "kind": "mcp", "official": null, "desc": "Persistence hook auditor: scan repos for auto-exec hooks, flag Shai-Hulud patterns.", "repo": "https://github.com/CloudCorpRecords/hookcheck", "install": ["npm:@reneturcios/hookcheck", "oci:ghcr.io/cloudcorprecords/hookcheck:0.1.18"], "stars": 0, "pushed": "2026-10-27T23:00:23Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CloudCorpRecords/threatkb", "name": "io.github.CloudCorpRecords/threatkb", "kind": "mcp", "official": null, "desc": "Local MITRE ATT&CK queries: techniques, tactics, mitigations, and detections from a STIX file.", "repo": "https://github.com/CloudCorpRecords/threatkb", "install": ["npm:@reneturcios/threatkb", "oci:ghcr.io/cloudcorprecords/threatkb:0.1.0"], "stars": 0, "pushed": "2026-11-02T06:45:22Z", "license": "MIT", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CloudCorpRecords/trustverdict", "name": "io.github.CloudCorpRecords/trustverdict", "kind": "mcp", "official": null, "desc": "Trust verification for agents and packages: safety scans, signed scores, identity and badges.", "repo": "https://github.com/CloudCorpRecords/trustverdict", "install": ["npm:@reneturcios/trustverdict", "oci:ghcr.io/cloudcorprecords/trustverdict:0.1.0"], "stars": 0, "pushed": "2026-11-03T15:47:40Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.coderifts/api-governance", "name": "io.github.coderifts/api-governance", "kind": "mcp", "official": null, "desc": "Signed, offline-verifiable contract-change authorization. Only a granted change can proceed.", "repo": "https://github.com/coderifts/api-governance", "install": ["https://app.coderifts.com/mcp"], "stars": 0, "pushed": "2026-11-07T06:25:30Z", "license": "MIT", "plat": "", "live": "Live · 1430 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.compl-i-agent/csf", "name": "io.github.compl-i-agent/csf", "kind": "mcp", "official": null, "desc": "NIST CSF 2.0 - Professional cybersecurity framework with 35 tools and 12 prompts", "repo": "https://github.com/compligent/mcp-platform", "install": ["npm:@compligent-mcp/csf"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.craigmbrown/blindoracle", "name": "io.github.craigmbrown/blindoracle", "kind": "mcp", "official": null, "desc": "Trust layer for x402 A2A trades: reputation, pre-hire checks, escrow, disputes, delegation chains", "repo": "https://github.com/craigmbrown/blindoracle-mcp", "install": ["https://api.craigmbrown.com/v2/?src=mcp_official_registry"], "stars": 0, "pushed": "2026-11-07T14:00:23Z", "license": "Apache-2.0", "plat": "", "live": "Live · 3659 ms · 54 tools · `reputation.lookup` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.CSOAI-ORG/keystone-verify-proxy-mcp", "name": "io.github.CSOAI-ORG/keystone-verify-proxy-mcp", "kind": "mcp", "official": null, "desc": "VM-side verify proxy for keystone attestations", "repo": null, "install": ["pypi:keystone-verify-proxy-mcp"], "stars": null, "pushed": null, "license": null, "plat": "keystone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CSOAI-ORG/security-scanner-ai-mcp", "name": "io.github.CSOAI-ORG/security-scanner-ai-mcp", "kind": "mcp", "official": null, "desc": "Security Scanner Ai MCP Server by MEOK AI Labs", "repo": "https://github.com/CSOAI-ORG/security-scanner-ai-mcp", "install": ["pypi:security-scanner-ai-mcp"], "stars": 0, "pushed": "2026-11-13T10:13:32Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cx-anand-nandeshwar/dlp-mcp", "name": "io.github.cx-anand-nandeshwar/dlp-mcp", "kind": "mcp", "official": null, "desc": "The DLP MCP provides the compliance violation in the one drive, google drive documents.", "repo": "https://github.com/cx-anand-nandeshwar/security-mcp-marketplace", "install": ["https://{api_host}/api/dlp/mcp/{tenant_id}"], "stars": 0, "pushed": "2026-07-08T20:26:54Z", "license": "Apache-2.0", "plat": "onedrive, google drive", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.DarkKitty-w/lock-autopsy", "name": "io.github.DarkKitty-w/lock-autopsy", "kind": "mcp", "official": null, "desc": "On-chain token lock & vesting auditor: cancelable, revocable, transferable flags.", "repo": "https://github.com/DarkKitty-w/lock-autopsy", "install": ["npm:lock-autopsy"], "stars": 0, "pushed": "2026-10-31T10:00:26Z", "license": "MIT", "plat": "on-chain tokens", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.datahogo/datahogo", "name": "io.github.datahogo/datahogo", "kind": "mcp", "official": null, "desc": "Scan a project for security issues locally with the open-source Data Hogo engine.", "repo": "https://github.com/datahogo/datahogo", "install": ["npm:@datahogo/mcp"], "stars": 0, "pushed": "2026-07-12T19:28:44Z", "license": "AGPL-3.0", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.denial-web/agent-immune", "name": "io.github.denial-web/agent-immune", "kind": "mcp", "official": null, "desc": "AI agent security: prompt injection detection, semantic memory, output scanning, prompt hardening", "repo": "https://github.com/denial-web/agent-immune", "install": ["pypi:agent-immune"], "stars": 0, "pushed": "2026-07-24T08:09:17Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dir-ai/repotector", "name": "io.github.dir-ai/repotector", "kind": "mcp", "official": null, "desc": "The repo guardian AI agents handshake with before they touch your code.", "repo": "https://github.com/dir-ai/repotector", "install": ["npm:repotector"], "stars": 0, "pushed": "2026-07-18T20:36:17Z", "license": "MIT", "plat": "code security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dl-eigenart/agentshield-mcp", "name": "io.github.dl-eigenart/agentshield-mcp", "kind": "mcp", "official": null, "desc": "Detect prompt injection, jailbreak, and social-engineering attacks in LLM agents.", "repo": "https://github.com/dl-eigenart/agentshield-platform", "install": ["npm:@eigenart/agentshield-mcp"], "stars": 0, "pushed": "2026-05-11T16:18:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dth0108/bies-guardian", "name": "io.github.dth0108/bies-guardian", "kind": "mcp", "official": null, "desc": "Deterministic sealed verdicts on public claims and startup ideas (0-LLM claim-safety guardian).", "repo": null, "install": ["https://bies.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.eason4kim-rocket/looktwice-mcp", "name": "io.github.eason4kim-rocket/looktwice-mcp", "kind": "mcp", "official": null, "desc": "Email, EU VAT, IBAN, and domain validation plus evidence-backed U.S. CPSC recall screening.", "repo": "https://github.com/eason4kim-rocket/looktwice-mcp", "install": ["npm:looktwice-mcp"], "stars": 0, "pushed": "2026-08-15T06:06:45Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.eltociear/contract-guard-mcp", "name": "io.github.eltociear/contract-guard-mcp", "kind": "mcp", "official": null, "desc": "EVM contract/token risk check + ERC20 approval (proxy, EIP-7702, unlimited-allowance). Zero deps.", "repo": "https://github.com/eltociear/contract-guard-mcp", "install": ["oci:ghcr.io/eltociear/contract-guard-mcp:mcp-1.1.0"], "stars": 0, "pushed": "2026-08-19T05:09:13Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.engrossa/ipnex", "name": "io.github.engrossa/ipnex", "kind": "mcp", "official": null, "desc": "Cited, confidence-stamped patent intelligence over US university tech-transfer out-licensing.", "repo": null, "install": ["https://api.ipnex.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "us universities", "live": "Live · 1520 ms · 2 tools · free to try: `search_licensable_ip` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.eobi/nemesis-shield", "name": "io.github.eobi/nemesis-shield", "kind": "mcp", "official": null, "desc": "Positive-security for apps, APIs, LLMs and edge, plus fraud scoring and identity/AML screening.", "repo": "https://github.com/eobi/nemesis_shield_sdks", "install": ["npm:@nemesis-shield-autogon/mcp"], "stars": 0, "pushed": "2026-10-09T00:44:59Z", "license": "MIT", "plat": "llms", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.f-tiger/agiscorecard-web3-calls", "name": "io.github.f-tiger/agiscorecard-web3-calls", "kind": "mcp", "official": null, "desc": "Decode supported token calls and flag recipient or amount mismatches; no wallet or safety verdict.", "repo": "https://github.com/f-tiger/agi-site", "install": ["https://calls.agiscorecard.com/mcp"], "stars": 0, "pushed": "2026-11-13T13:57:15Z", "license": null, "plat": "", "live": "Live · 1373 ms · 3 tools · free to try: `search` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.FinishKit/mcp", "name": "io.github.FinishKit/mcp", "kind": "mcp", "official": null, "desc": "FinishKit MCP: scan GitHub repos for security vulnerabilities, deployment blockers, and quality", "repo": "https://github.com/FinishKit/mcp", "install": ["npm:@finishkit/mcp"], "stars": 0, "pushed": "2026-03-30T08:26:38Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.forgemeshlabs/x402-scan-mcp", "name": "io.github.forgemeshlabs/x402-scan-mcp", "kind": "mcp", "official": null, "desc": "x402 Endpoint Scanner — a free local health probe for x402 paid endpoints as an MCP server.", "repo": "https://github.com/forgemeshlabs/x402-scan-mcp", "install": ["npm:@forgemeshlabs/x402-scan-mcp"], "stars": 0, "pushed": "2026-11-13T08:27:16Z", "license": "MIT", "plat": "forgemesh", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.fpetitit/mcpcheckup", "name": "io.github.fpetitit/mcpcheckup", "kind": "mcp", "official": null, "desc": "Scans remote MCP servers for protocol, security, and TLS issues; exposes scan tools via MCP.", "repo": "https://github.com/fpetitit/mcpcheck", "install": ["https://mcpcheckup.xyz/api/mcp"], "stars": 0, "pushed": "2026-06-28T15:22:54Z", "license": "MIT", "plat": "mcp checkup", "live": "Down · HTTP 503 (checked 2026-11-13)"}, {"id": "mcp:io.github.fraudlabspro/mcp-fraudlabspro", "name": "io.github.fraudlabspro/mcp-fraudlabspro", "kind": "mcp", "official": null, "desc": "Fraud Prevention MCP server using FraudLabs Pro API.", "repo": "https://github.com/fraudlabspro/mcp-fraudlabspro", "install": ["pypi:mcp-fraudlabspro"], "stars": 0, "pushed": "2026-10-26T04:15:54Z", "license": "MIT", "plat": "fraudlabs pro", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.freshfos/dropcoin-validation", "name": "io.github.freshfos/dropcoin-validation", "kind": "mcp", "official": null, "desc": "EU compliance checks for AI agents: sanctions, company, VAT ID, IBAN, email. Pay per call.", "repo": null, "install": ["https://validation-api.dropcoin.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "eu", "live": "Live · 1588 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.geekmarine/mcp-ssl-inspector", "name": "io.github.geekmarine/mcp-ssl-inspector", "kind": "mcp", "official": null, "desc": "Audits TLS/SSL handshake latency, HSTS headers, and HTTPS availability on the edge.", "repo": "https://github.com/geekmarine/mcp-ssl-inspector", "install": ["https://mcp-ssl-inspector.stubby76.workers.dev/mcp"], "stars": 0, "pushed": "2026-09-30T10:13:35Z", "license": null, "plat": "ssl", "live": "Live · 470 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Goatincrypto/aegis-x402-mcp", "name": "io.github.Goatincrypto/aegis-x402-mcp", "kind": "mcp", "official": null, "desc": "On-chain token security, honeypot simulation, KYA wallet trust, and x402 PreFlight audits on Base.", "repo": "https://github.com/Goatincrypto/aegis-x402-mcp", "install": ["npm:aegis-x402-mcp", "https://aegisaudit.org/mcp"], "stars": 0, "pushed": "2026-11-13T00:57:03Z", "license": "MIT", "plat": "base", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Gorgon-Cyber/gorgon-scout", "name": "io.github.Gorgon-Cyber/gorgon-scout", "kind": "mcp", "official": null, "desc": "Run AI-driven web-app and API security scans (DAST) from Claude or any MCP agent. Windows.", "repo": "https://github.com/Gorgon-Cyber/gorgon-scout-mcp", "install": ["mcpb:https://github.com/Gorgon-Cyber/gorgon-scout-mcp/releases/download/v1.0.38/gorgon-scout.mcpb"], "stars": 0, "pushed": "2026-08-07T09:54:24Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.governmyai/mcp-server", "name": "io.github.governmyai/mcp-server", "kind": "mcp", "official": null, "desc": "AI compliance obligations across EU AI Act, ISO 42001, Colorado AI Act, NIST, HIPAA, SOX, FTC", "repo": "https://github.com/governmyai/mcp-server", "install": ["npm:@governmyai/mcp-server"], "stars": 0, "pushed": "2026-04-25T18:22:22Z", "license": "MIT", "plat": "ai compliance", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.holistis/cra-check", "name": "io.github.holistis/cra-check", "kind": "mcp", "official": null, "desc": "Free read-only check of a public GitHub repo for eight security signals related to the EU CRA.", "repo": "https://github.com/holistis/tokenizen", "install": ["https://api.tokenizen.nl/mcp"], "stars": 0, "pushed": "2026-11-13T01:20:50Z", "license": "MIT", "plat": "github", "live": "Live · 2091 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.homeofe/supply-chain-guard", "name": "io.github.homeofe/supply-chain-guard", "kind": "mcp", "official": null, "desc": "Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.", "repo": "https://github.com/homeofe/supply-chain-guard", "install": ["npm:supply-chain-guard"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.infoinlet-marketplace/mcp-codeaudit", "name": "io.github.infoinlet-marketplace/mcp-codeaudit", "kind": "mcp", "official": null, "desc": "Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.", "repo": "https://github.com/infoinlet-marketplace/marketplace", "install": ["npm:@infoinlet/mcp-codeaudit"], "stars": null, "pushed": null, "license": null, "plat": "osv", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.itcustomsolution/approval-gate-mcp", "name": "io.github.itcustomsolution/approval-gate-mcp", "kind": "mcp", "official": null, "desc": "Fail-closed human approval gates for AI agent actions. Default-deny, TTL expiry, audit log.", "repo": "https://github.com/itcustomsolution/approval-gate-mcp", "install": ["npm:@itcustomsolution/approval-gate-mcp"], "stars": 0, "pushed": "2026-11-13T01:10:28Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.itsoft7/egrul-mcp", "name": "io.github.itsoft7/egrul-mcp", "kind": "mcp", "official": null, "desc": "Проверка организаций, ИП и физлиц по данным ЕГРЮЛ/ЕГРИП ФНС: санкции, иноагенты, банкротство.", "repo": "https://github.com/itsoft7/egrul", "install": ["https://egrul.org/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "егрюл/егрип фнс", "live": "Live · 2352 ms · 39 tools · `bik_lookup` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.itsryanarmani/aigovernancetools", "name": "io.github.itsryanarmani/aigovernancetools", "kind": "mcp", "official": null, "desc": "Compare AI governance, risk and compliance software.", "repo": "https://github.com/itsryanarmani/directory", "install": ["https://aigovernancetools.fyi/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1896 ms · 11 tools · free to try: `get_listing` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.jdhart81/agent-compute-ledger", "name": "io.github.jdhart81/agent-compute-ledger", "kind": "mcp", "official": null, "desc": "Compute-is-carbon energy/carbon ledger for agent work with Landauer-limit validation.", "repo": "https://github.com/jdhart81/viridis-agent-fleet", "install": ["https://mcp.viridisconservation.com/compute-ledger/mcp"], "stars": 0, "pushed": "2026-11-13T03:06:52Z", "license": "Apache-2.0", "plat": "", "live": "Live · 958 ms · 13 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.jdhart81/agent-offset-clearinghouse", "name": "io.github.jdhart81/agent-offset-clearinghouse", "kind": "mcp", "official": null, "desc": "Verified conservation credits matched to agent compute emissions — the conservation flywheel of the ", "repo": "https://github.com/jdhart81/viridis-agent-fleet", "install": ["https://mcp.viridisconservation.com/offsets/mcp"], "stars": 0, "pushed": "2026-11-13T03:06:52Z", "license": "Apache-2.0", "plat": "", "live": "Live · 1598 ms · 19 tools · free to try: `describe_agent` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.jdhart81/disclosure-compiler", "name": "io.github.jdhart81/disclosure-compiler", "kind": "mcp", "official": null, "desc": "Deterministic cited disclosure drafts with verified GHG lineage and audit hashes.", "repo": "https://github.com/jdhart81/viridis-agent-fleet", "install": ["https://mcp.viridisconservation.com/disclosure-compiler/mcp"], "stars": 0, "pushed": "2026-11-13T03:06:52Z", "license": "Apache-2.0", "plat": "", "live": "Live · 1417 ms · 5 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.jdhart81/eco-funding", "name": "io.github.jdhart81/eco-funding", "kind": "mcp", "official": null, "desc": "Ecological complexity valuation with re-runnable receipts and pledge-pool simulation. Read-only.", "repo": "https://github.com/jdhart81/viridis-eco-funding", "install": ["https://mcp.viridisconservation.com/eco-funding/mcp"], "stars": 0, "pushed": "2026-11-07T18:38:28Z", "license": "Apache-2.0", "plat": "", "live": "Live · 977 ms · 5 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.jdhart81/ghg-ledger", "name": "io.github.jdhart81/ghg-ledger", "kind": "mcp", "official": null, "desc": "Deterministic Scope 1/2/3 GHG inventories with bundled factors and audit hashes.", "repo": "https://github.com/jdhart81/viridis-agent-fleet", "install": ["https://mcp.viridisconservation.com/ghg-ledger/mcp"], "stars": 0, "pushed": "2026-11-13T03:06:52Z", "license": "Apache-2.0", "plat": "", "live": "Live · 1391 ms · 6 tools · free to try: `describe_agent` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.joe-watkins/magentaa11y", "name": "io.github.joe-watkins/magentaa11y", "kind": "mcp", "official": null, "desc": "MCP server providing accessibility criteria from MagentaA11y", "repo": "https://github.com/joe-watkins/magentaa11y-mcp", "install": ["npm:magentaa11y-mcp"], "stars": null, "pushed": null, "license": null, "plat": "magentaa11y", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.joepangallo/mcp-audit-server", "name": "io.github.joepangallo/mcp-audit-server", "kind": "mcp", "official": null, "desc": "Thin MCP and CLI proxy for AI agent and MCP security auditing via a hosted backend", "repo": "https://github.com/joepangallo/mcp-audit-server", "install": ["npm:ledd-mcp-audit-server"], "stars": 0, "pushed": "2026-10-11T15:54:13Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.joepangallo/mcp-server-security-audit", "name": "io.github.joepangallo/mcp-server-security-audit", "kind": "mcp", "official": null, "desc": "Scan websites for security vulnerabilities, headers, TLS, and email security.", "repo": "https://github.com/joepangallo/agent-audit", "install": ["npm:mcp-server-security-audit"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.joepangallo/web-recon-agent", "name": "io.github.joepangallo/web-recon-agent", "kind": "mcp", "official": null, "desc": "Owned-target web security assessment MCP server for authenticated, high-friction apps.", "repo": "https://github.com/joepangallo/web-recon-agent", "install": ["npm:mcp-web-recon-agent"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.joeyough/mcpcheck", "name": "io.github.joeyough/mcpcheck", "kind": "mcp", "official": null, "desc": "Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.", "repo": "https://github.com/joeyough/mcpcheck", "install": ["https://mcpcheck.netlify.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "mcp servers", "live": "Live · 1196 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.josephibra/shadowgate-mcp", "name": "io.github.josephibra/shadowgate-mcp", "kind": "mcp", "official": null, "desc": "Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.", "repo": "https://github.com/josephibra/shadowgate-mcp", "install": ["https://shadowgate-mcp.mcp.xpay.sh/mcp"], "stars": 0, "pushed": "2026-05-18T19:58:45Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.jyswee/a2a-trustgate", "name": "io.github.jyswee/a2a-trustgate", "kind": "mcp", "official": null, "desc": "A2A TrustGate: 4-gate firewall that screens every AI-agent action before it runs. 50 tools.", "repo": "https://github.com/jyswee/a2a-trustgate", "install": ["npm:a2a-trustgate", "https://mcp.a2ainfrastructure.com/sse"], "stars": 0, "pushed": "2026-08-08T08:05:09Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kennysarnoski-jarvis/aris-kg", "name": "io.github.kennysarnoski-jarvis/aris-kg", "kind": "mcp", "official": null, "desc": "Current CVEs, advisories, framework releases and reference code from a 15M-concept graph.", "repo": "https://github.com/kennysarnoski-jarvis/aris-kg", "install": ["npm:aris-kg"], "stars": 0, "pushed": "2026-11-07T15:55:33Z", "license": "MIT", "plat": "cves", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kimmawla/vuln-triage-mcp", "name": "io.github.kimmawla/vuln-triage-mcp", "kind": "mcp", "official": null, "desc": "Tells your AI agent which vulnerabilities to fix first, using OSV.dev, FIRST EPSS, and CISA KEV.", "repo": "https://github.com/kimmawla/vuln-triage-mcp", "install": ["pypi:vuln-triage-mcp"], "stars": 0, "pushed": "2026-11-04T21:35:21Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Kjopstad-IT/rqwstr", "name": "io.github.Kjopstad-IT/rqwstr", "kind": "mcp", "official": null, "desc": "AI-native HTTP security testing MCP server — 17 tools with raw HTTP/1.1 + HTTP/2 control", "repo": "https://github.com/Kjopstad-IT/rqwstr-mcp", "install": ["mcpb:https://github.com/Kjopstad-IT/rqwstr-mcp/releases/download/v1.1.0/rqwstr_1.1.0_universal.mcpb"], "stars": 0, "pushed": "2026-10-21T17:06:26Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.KNambiarDJsc/meridian-mcp", "name": "io.github.KNambiarDJsc/meridian-mcp", "kind": "mcp", "official": null, "desc": "Local-first compliance scanner for DPDPA 2023/2025, RBI FREE-AI, SEBI AI/ML & EU AI Act.", "repo": "https://github.com/KNambiarDJsc/Meridian", "install": ["pypi:meridian-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kota1026/bridgeguard-mcp", "name": "io.github.kota1026/bridgeguard-mcp", "kind": "mcp", "official": null, "desc": "BridgeGuard MCP Server - Cross-chain bridge security audit tools for AI coding agents. Scan bri...", "repo": "https://github.com/kota1026/quantum-shield", "install": ["npm:bridgeguard-mcp"], "stars": 0, "pushed": "2026-08-29T02:00:21Z", "license": "MIT", "plat": "bridgeguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kota1026/defiguard-mcp", "name": "io.github.kota1026/defiguard-mcp", "kind": "mcp", "official": null, "desc": "DeFiGuard MCP Server - DeFi protocol risk analysis tools for AI coding agents. Analyze token co...", "repo": "https://github.com/kota1026/quantum-shield", "install": ["npm:defiguard-mcp"], "stars": 0, "pushed": "2026-08-29T02:00:21Z", "license": "MIT", "plat": "defiguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kota1026/quantumguard-mcp", "name": "io.github.kota1026/quantumguard-mcp", "kind": "mcp", "official": null, "desc": "Post-quantum cryptography security scanner. Detect ECDSA/RSA vulnerabilities, NIST compliance.", "repo": "https://github.com/kota1026/quantum-shield", "install": ["npm:quantumguard-mcp"], "stars": 0, "pushed": "2026-08-29T02:00:21Z", "license": "MIT", "plat": "quantumguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kota1026/smartguard-mcp", "name": "io.github.kota1026/smartguard-mcp", "kind": "mcp", "official": null, "desc": "SmartGuard MCP Server - AI-powered smart contract security audit tools for Claude Code, Cursor,...", "repo": "https://github.com/kota1026/quantum-shield", "install": ["npm:smartguard-mcp"], "stars": 0, "pushed": "2026-08-29T02:00:21Z", "license": "MIT", "plat": "smartguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kota1026/vaultguard-mcp", "name": "io.github.kota1026/vaultguard-mcp", "kind": "mcp", "official": null, "desc": "VaultGuard MCP Server - Yearn V3 / DeFi vault security and analysis tools for AI coding agents....", "repo": "https://github.com/kota1026/quantum-shield", "install": ["npm:vaultguard-mcp"], "stars": 0, "pushed": "2026-08-29T02:00:21Z", "license": "MIT", "plat": "vaultguard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lambdasec/frame-mcp", "name": "io.github.lambdasec/frame-mcp", "kind": "mcp", "official": null, "desc": "MCP server for the Frame security scanner: scan, verify, fix, exploit, packs and separation logic.", "repo": "https://github.com/lambdasec/frame-mcp", "install": ["pypi:frame-mcp"], "stars": 0, "pushed": "2026-11-13T01:39:23Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lazymac2x/domain-intel", "name": "io.github.lazymac2x/domain-intel", "kind": "mcp", "official": null, "desc": "Cloudflare Workers MCP server: domain-intel", "repo": "https://github.com/lazymac2x/domain-intel-api", "install": ["https://api.lazy-mac.com/domain-intel/mcp"], "stars": 0, "pushed": "2026-04-17T07:00:28Z", "license": null, "plat": "cloudflare workers", "live": "Live · 871 ms · 4 tools · free to try: `phishing_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Lokeshwaranramu/quantaseal", "name": "io.github.Lokeshwaranramu/quantaseal", "kind": "mcp", "official": null, "desc": "Quantum-safe vault, encryption & compliance for AI agents. NIST FIPS 203/204 ML-KEM-768 + ML-DSA-65.", "repo": "https://github.com/QuantaSeal/quantaseal.git", "install": ["npm:@quantaseal/mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "io.github.lokeshwaranramu/quantaseal", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lordbasilaiassistant-sudo/base-security-scanner-mcp", "name": "io.github.lordbasilaiassistant-sudo/base-security-scanner-mcp", "kind": "mcp", "official": null, "desc": "MCP server to scan smart contracts on Base for honeypots, rug pulls, and vulnerabilities.", "repo": "https://github.com/lordbasilaiassistant-sudo/base-security-scanner-mcp", "install": ["npm:base-security-scanner-mcp"], "stars": null, "pushed": null, "license": null, "plat": "base", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lordbasilaiassistant-sudo/contract-scanner", "name": "io.github.lordbasilaiassistant-sudo/contract-scanner", "kind": "mcp", "official": null, "desc": "Smart contract security scanner — vulnerabilities, risk scores, and calldata decoding", "repo": "https://github.com/lordbasilaiassistant-sudo/mcp-servers", "install": ["npm:@thryx/contract-scanner-mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "smart contracts", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.makosdDavid/package-risk", "name": "io.github.makosdDavid/package-risk", "kind": "mcp", "official": null, "desc": "Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.", "repo": "https://github.com/makosdDavid/package-risk-mcp", "install": ["npm:@makosdav/package-risk-mcp"], "stars": 0, "pushed": "2026-08-14T08:17:11Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.markoskarllos-netizen/aetherintel-marketplace", "name": "io.github.markoskarllos-netizen/aetherintel-marketplace", "kind": "mcp", "official": null, "desc": "Free OFAC sanctions/text/health-check tools; paid x402 agent+wallet audit tools.", "repo": "https://github.com/markoskarllos-netizen/aetherintel-marketplace", "install": [], "stars": null, "pushed": null, "license": null, "plat": "ofac", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MarkovianProtocol/provenance", "name": "io.github.MarkovianProtocol/provenance", "kind": "mcp", "official": null, "desc": "Stamp or notarize data into a public witnessed transparency log. Proves timing, not truth.", "repo": "https://github.com/MarkovianProtocol/markovian-protocol", "install": ["https://api.markovianprotocol.com/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "io.github.markovianprotocol/provenance", "live": "Down · HTTP 530 (checked 2026-11-13)"}, {"id": "mcp:io.github.mastrophot/contract-security-scanner", "name": "io.github.mastrophot/contract-security-scanner", "kind": "mcp", "official": null, "desc": "MCP smart contract scanner with NEAR-focused security context.", "repo": "https://github.com/mastrophot/near-mcp-contract-security", "install": ["npm:mcp-contract-security"], "stars": 0, "pushed": "2026-03-16T14:14:16Z", "license": "MIT", "plat": "near", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.middleBrick/mcp-server", "name": "io.github.middleBrick/mcp-server", "kind": "mcp", "official": null, "desc": "Scan APIs for OWASP Top 10, LLM, and GraphQL security vulnerabilities.", "repo": "https://github.com/middleBrick/mcp-server", "install": ["npm:@middlebrick/mcp-server"], "stars": 0, "pushed": "2026-04-03T05:35:45Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.MitchSingh/402shield", "name": "io.github.MitchSingh/402shield", "kind": "mcp", "official": null, "desc": "x402 payment security and pre-execution transaction risk screening for autonomous AI agents.", "repo": "https://github.com/MitchSingh/402shield", "install": ["https://four02shield.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 503 (checked 2026-11-13)"}, {"id": "mcp:io.github.mrfentmen/abuseipdb-mcp", "name": "io.github.mrfentmen/abuseipdb-mcp", "kind": "mcp", "official": null, "desc": "MCP server for AbuseIPDB: IP abuse reports, reputation. Free key.", "repo": "https://github.com/mrfentmen/awesome-mcps", "install": ["npm:abuseipdb-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "abuseipdb", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/analysis-mcp", "name": "io.github.mrfentmen/analysis-mcp", "kind": "mcp", "official": null, "desc": "Offline security-artifact analysis: endpoint and secret mining, IDOR diffs, JWT triage", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/analysis-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/apparmor-mcp", "name": "io.github.mrfentmen/apparmor-mcp", "kind": "mcp", "official": null, "desc": "AppArmor MCP: parse profiles, validate capabilities, file rules and commas.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/apparmor-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "apparmor", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/auditd-mcp", "name": "io.github.mrfentmen/auditd-mcp", "kind": "mcp", "official": null, "desc": "auditd MCP: parse Linux audit rules, validate watches, syscalls, permissions and keys.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/auditd-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "linux auditd", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/cisa-kev-mcp", "name": "io.github.mrfentmen/cisa-kev-mcp", "kind": "mcp", "official": null, "desc": "Use this MCP server to CISA Known Exploited Vulnerabilities catalog search. Tools include search...", "repo": "https://github.com/mrfentmen/cisa-kev-mcp", "install": ["npm:cisa-kev-mcp"], "stars": 0, "pushed": "2026-08-08T23:33:34Z", "license": null, "plat": "cisa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/cve-circl-mcp", "name": "io.github.mrfentmen/cve-circl-mcp", "kind": "mcp", "official": null, "desc": "CVE Search: latest CVEs and vendor or product lookups from CIRCL - keyless.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/cve-circl-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "circl", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/cveawg-mcp", "name": "io.github.mrfentmen/cveawg-mcp", "kind": "mcp", "official": null, "desc": "CVE Services: authoritative CVE records - des MCP: real tools for real work.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/cveawg-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "cve", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/cwe-mcp", "name": "io.github.mrfentmen/cwe-mcp", "kind": "mcp", "official": null, "desc": "MITRE CWE weakness records: descriptions, mitigations, consequences and the weakness hierarchy.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/cwe-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "mitre", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/dnstwister-mcp", "name": "io.github.mrfentmen/dnstwister-mcp", "kind": "mcp", "official": null, "desc": "DNS twister domain threat intelligence: fuzz domains for typosquatting, check whois.", "repo": "https://github.com/mrfentmen/dnstwister-mcp", "install": ["npm:dnstwister-mcp"], "stars": null, "pushed": null, "license": null, "plat": "dnstwister", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/greynoise-mcp", "name": "io.github.mrfentmen/greynoise-mcp", "kind": "mcp", "official": null, "desc": "MCP server for GreyNoise: IP noise classification, tags. Free key.", "repo": "https://github.com/mrfentmen/awesome-mcps", "install": ["npm:greynoise-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "greynoise", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/haveibeenpwned-mcp", "name": "io.github.mrfentmen/haveibeenpwned-mcp", "kind": "mcp", "official": null, "desc": "The Have I Been Pwned breach catalogue: every known data breach, one breach in detail and the", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/haveibeenpwned-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "have i been pwned", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/ipdata-mcp", "name": "io.github.mrfentmen/ipdata-mcp", "kind": "mcp", "official": null, "desc": "ipdata.co IP intelligence: geolocation, ASN, company, threat and timezone lookups.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:ipdata-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "ipdata.co", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/nessus-mcp", "name": "io.github.mrfentmen/nessus-mcp", "kind": "mcp", "official": null, "desc": "Nessus MCP: parse scans, validate hosts, findings, severities and plugin ids.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/nessus-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "nessus", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/openscap-mcp", "name": "io.github.mrfentmen/openscap-mcp", "kind": "mcp", "official": null, "desc": "OpenSCAP MCP: parse XCCDF and OVAL results, validate results, scores and ids.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/openscap-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "openscap", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/ossec-mcp", "name": "io.github.mrfentmen/ossec-mcp", "kind": "mcp", "official": null, "desc": "OSSEC MCP: parse rules, validate ids, levels, groups and descriptions.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/ossec-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "ossec", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/osv-mcp", "name": "io.github.mrfentmen/osv-mcp", "kind": "mcp", "official": null, "desc": "MCP server for OSV open source vulnerability data and package security checks.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:osv-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "osv", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/oval-mcp", "name": "io.github.mrfentmen/oval-mcp", "kind": "mcp", "official": null, "desc": "OVAL MCP: parse definitions, validate ids, definitions and tests.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/oval-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "oval", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/selinux-mcp", "name": "io.github.mrfentmen/selinux-mcp", "kind": "mcp", "official": null, "desc": "SELinux MCP: parse type enforcement policies, validate types, classes and rules.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/selinux-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "selinux", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/selinux-policy-mcp", "name": "io.github.mrfentmen/selinux-policy-mcp", "kind": "mcp", "official": null, "desc": "SELinux Policy MCP: read, check, lint, scaffold and run code.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/selinux-policy-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "selinux", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/snort-mcp", "name": "io.github.mrfentmen/snort-mcp", "kind": "mcp", "official": null, "desc": "Snort MCP: parse IDS rules, validate headers, actions, sids and revisions.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/snort-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "snort", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/unicode-security-mcp", "name": "io.github.mrfentmen/unicode-security-mcp", "kind": "mcp", "official": null, "desc": "Local checks for Unicode confusables, mixed scripts, invisible controls, and suspicious identifiers.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:unicode-security-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "unicode", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/virustotal-mcp", "name": "io.github.mrfentmen/virustotal-mcp", "kind": "mcp", "official": null, "desc": "MCP server for VirusTotal: file, URL, domain, IP reports. Free key.", "repo": "https://github.com/mrfentmen/awesome-mcps", "install": ["npm:virustotal-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "virustotal", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.NELPROINC/nel-veil", "name": "io.github.NELPROINC/nel-veil", "kind": "mcp", "official": null, "desc": "Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures.", "repo": "https://github.com/NELPROINC/nel-veil-mcp", "install": ["npm:nel-veil-mcp"], "stars": 0, "pushed": "2026-09-04T00:53:28Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.NOTTIBOY137/open-registry-poc", "name": "io.github.NOTTIBOY137/open-registry-poc", "kind": "mcp", "official": null, "desc": "PoC: Open Registry supply chain — unvetted server listing (security research)", "repo": "https://github.com/NOTTIBOY137/mcp-open-registry-poc", "install": ["npm:@nottiboy1337/mcp-open-registry-poc"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.NOTTIBOY137/update-hijack-demo", "name": "io.github.NOTTIBOY137/update-hijack-demo", "kind": "mcp", "official": null, "desc": "Demo: Server update hijack PoC (clean copy for video)", "repo": "https://github.com/NOTTIBOY137/mcp-update-hijack-demo", "install": ["npm:@nottiboy1337/mcp-update-hijack-demo"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.NOTTIBOY137/update-hijack-poc", "name": "io.github.NOTTIBOY137/update-hijack-poc", "kind": "mcp", "official": null, "desc": "PoC benign MCP server for update-hijack security research", "repo": "https://github.com/NOTTIBOY137/mcp-update-hijack-poc", "install": ["npm:@nottiboy1337/mcp-update-hijack-poc"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Olum289/agentlock", "name": "io.github.Olum289/agentlock", "kind": "mcp", "official": null, "desc": "Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.", "repo": "https://github.com/Olum289/agentlock", "install": ["https://app.agentlock.net/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "agentlock", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.OraclesTech/guardian-mcp", "name": "io.github.OraclesTech/guardian-mcp", "kind": "mcp", "official": null, "desc": "Runtime AI-threat screening for coding agents: analyze, scan tool calls/outputs & docs (paid).", "repo": null, "install": ["pypi:ethicore-guardian-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.r00tify/crashdx", "name": "io.github.r00tify/crashdx", "kind": "mcp", "official": null, "desc": "Diagnoses Apple .ips crash reports: ranks likely causes with cited evidence, not just a stack trace.", "repo": "https://github.com/r00tify/crashdx", "install": ["mcpb:https://github.com/r00tify/crashdx/releases/download/v0.1.0/crashdx-mcp-v0.1.0.mcpb"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.RCOLKITT/vaspera-hardening", "name": "io.github.RCOLKITT/vaspera-hardening", "kind": "mcp", "official": null, "desc": "Enterprise certification for codebases with multi-agent security, reliability, and quality audits", "repo": "https://github.com/RCOLKITT/hardening-mcp", "install": ["npm:vaspera-hardening-mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.RealSpap/authority-risk-mcp", "name": "io.github.RealSpap/authority-risk-mcp", "kind": "mcp", "official": null, "desc": "Read-only tools for AI agents: who can change a smart contract, how fast. Signed data, testnet.", "repo": "https://github.com/RealSpap/authority-risk-oracle-showcase", "install": ["pypi:authority-risk-mcp", "npm:authority-risk-mcp"], "stars": 0, "pushed": "2026-11-13T07:15:19Z", "license": "CC-BY-4.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rezearcher/cve-triage", "name": "io.github.rezearcher/cve-triage", "kind": "mcp", "official": null, "desc": "x402 CVE triage MCP: EPSS + CISA KEV -> exploit priority, $0.01 per query.", "repo": null, "install": ["https://x402-cve-triage.sigrunner.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.rezearcher/tech-risk", "name": "io.github.rezearcher/tech-risk", "kind": "mcp", "official": null, "desc": "MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable", "repo": "https://github.com/rezearcher/x402-data-api", "install": ["pypi:greyridge-x402-tools", "https://x402-data-api.sigrunner.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-13T00:40:03Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rijul170/alertlogic-mcp", "name": "io.github.rijul170/alertlogic-mcp", "kind": "mcp", "official": null, "desc": "MCP server for Alert Logic MDR — incident response, log search, SOAR, and SOC workflows", "repo": "https://github.com/rijul170/alertlogic-mcp", "install": ["pypi:alertlogic-mcp"], "stars": 0, "pushed": "2026-07-26T18:58:13Z", "license": "MIT", "plat": "alert logic", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rijul170/falcon-mcp", "name": "io.github.rijul170/falcon-mcp", "kind": "mcp", "official": null, "desc": "Community extension of CrowdStrike falcon-mcp with near-complete Falcon API coverage", "repo": "https://github.com/rijul170/falcon-mcp", "install": ["pypi:falcon-mcp-extended"], "stars": 0, "pushed": "2026-09-01T10:28:52Z", "license": "MIT", "plat": "crowdstrike falcon", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rijul170/qualys-mcp", "name": "io.github.rijul170/qualys-mcp", "kind": "mcp", "official": null, "desc": "Full Qualys portal management over MCP: VMDR, PC, WAS, Cloud Agent, Container Security & more", "repo": "https://github.com/rijul170/qualys-mcp", "install": ["pypi:qualys-mcp-full"], "stars": 0, "pushed": "2026-07-14T01:15:38Z", "license": "MIT", "plat": "qualys", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rikocr8orh8/regulatory-signals", "name": "io.github.rikocr8orh8/regulatory-signals", "kind": "mcp", "official": null, "desc": "Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.", "repo": "https://github.com/rikocr8orh8/regulatorysignals.com", "install": ["npm:@regulatorysignals/mcp"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.robertoyanguas-ops/assay", "name": "io.github.robertoyanguas-ops/assay", "kind": "mcp", "official": null, "desc": "A2A & MCP Pre-Flight Security: SHA-256 tool schema rug-pull detection and liveness grades.", "repo": null, "install": ["https://assay-207908449630.us-central1.run.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 643 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.robertoyanguas-ops/cve-intel-mcp", "name": "io.github.robertoyanguas-ops/cve-intel-mcp", "kind": "mcp", "official": null, "desc": "Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and re", "repo": null, "install": ["https://cve-intel-72343955726.us-central1.run.app/mcp/cve-intel"], "stars": null, "pushed": null, "license": null, "plat": "osv.dev", "live": "Live · 569 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.rog0x/dep", "name": "io.github.rog0x/dep", "kind": "mcp", "official": null, "desc": "License check, outdated deps, security for AI agents", "repo": "https://github.com/rog0x/mcp-dep-tools", "install": ["npm:@rog0x/mcp-dep-tools"], "stars": 0, "pushed": "2026-03-21T20:22:09Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Roshan6335/mcpsentry", "name": "io.github.Roshan6335/mcpsentry", "kind": "mcp", "official": null, "desc": "Security scanner and runtime proxy for MCP servers.", "repo": null, "install": ["npm:@roshan6335/mcpsentry"], "stars": null, "pushed": null, "license": null, "plat": "mcpsentry", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.RudrenduPaul/paceproof", "name": "io.github.RudrenduPaul/paceproof", "kind": "mcp", "official": null, "desc": "Verifies Ed25519-signed attestation records and builds audit reports via MCP tools.", "repo": "https://github.com/RudrenduPaul/PaceProof", "install": ["npm:paceproof-cli"], "stars": 0, "pushed": "2026-11-04T01:58:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.RudrenduPaul/tenantguard", "name": "io.github.RudrenduPaul/tenantguard", "kind": "mcp", "official": null, "desc": "Scans self-hosted multi-tenant AI-agent platforms for tenant-isolation gaps via an MCP tool.", "repo": "https://github.com/RudrenduPaul/TenantGuard", "install": ["pypi:tenantguard-cli"], "stars": 0, "pushed": "2026-09-25T04:57:56Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.runsec-io/mcp", "name": "io.github.runsec-io/mcp", "kind": "mcp", "official": null, "desc": "RunSec MCP server for workspace security scanning and remediation workflows.", "repo": null, "install": ["npm:@runsec/mcp"], "stars": null, "pushed": null, "license": null, "plat": "runsec", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.secureprivacy/secure-privacy-mcp", "name": "io.github.secureprivacy/secure-privacy-mcp", "kind": "mcp", "official": null, "desc": "An MCP server that automatically integrate GDPR-compliant cookie consent banners into websites", "repo": "https://github.com/secureprivacy/secure-privacy-mcp.git", "install": ["npm:secure-privacy-mcp"], "stars": 0, "pushed": "2025-12-05T00:28:45Z", "license": null, "plat": "gdpr", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.securityscan-api/securityscan", "name": "io.github.securityscan-api/securityscan", "kind": "mcp", "official": null, "desc": "Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.", "repo": "https://github.com/securityscan-api/securitystack-mcp", "install": ["pypi:securityscan-mcp"], "stars": 0, "pushed": "2026-08-30T15:56:53Z", "license": "Apache-2.0", "plat": "securityscan", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sentrysurface/sentrysurface", "name": "io.github.sentrysurface/sentrysurface", "kind": "mcp", "official": null, "desc": "Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.", "repo": "https://github.com/sentrysurface/sentrysurface-mcp", "install": ["https://api.sentrysurface.io/mcp/mcp"], "stars": null, "pushed": null, "license": null, "plat": "sentrysurface", "live": "Down · HTTP 502 (checked 2026-11-13)"}, {"id": "mcp:io.github.sercanmetalore/sanctions-screening-mcp", "name": "io.github.sercanmetalore/sanctions-screening-mcp", "kind": "mcp", "official": null, "desc": "MASAK + OFAC/UN/EU yaptırım ve PEP tarama MCP sunucusu — Türkçe transliterasyon, fuzzy matching,…", "repo": "https://github.com/sercanmetalore/API-MCP", "install": ["https://mcp.boykaf.com/sanctions-screening/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 503 (checked 2026-11-13)"}, {"id": "mcp:io.github.shieldly-io/mcp", "name": "io.github.shieldly-io/mcp", "kind": "mcp", "official": null, "desc": "AI-Powered AWS security analysis: scan IAM policies and CloudFormation for risks and escalation.", "repo": "https://github.com/shieldly-io/mcp", "install": ["npm:@shieldly/mcp"], "stars": 0, "pushed": "2026-07-18T08:35:08Z", "license": "MIT", "plat": "shieldly", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.soufianetahiri/mception", "name": "io.github.soufianetahiri/mception", "kind": "mcp", "official": null, "desc": "Audits other MCP servers for security risks. Returns safe / caution / unsafe / inconclusive.", "repo": null, "install": ["pypi:mception"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stillmarcus24/stillos-kya", "name": "io.github.stillmarcus24/stillos-kya", "kind": "mcp", "official": null, "desc": "Counterparty due-diligence infrastructure: OFAC screening, on-chain risk, signed verdicts.", "repo": "https://github.com/stillmarcus24/stillos-kya", "install": ["npm:stillos-kya", "https://stillos-kya-edge.stillos.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-01T18:41:34Z", "license": null, "plat": "ofac", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.stillmarcus24/stillos-notary", "name": "io.github.stillmarcus24/stillos-notary", "kind": "mcp", "official": null, "desc": "Signed, x402-paid StillOS notary tools: claim verdicts, OFAC screening, distress scoring.", "repo": "https://github.com/stillmarcus24/stillos-notary", "install": ["npm:stillos-notary"], "stars": 0, "pushed": "2026-09-23T17:12:15Z", "license": "MIT", "plat": "solana", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.subhajitlucky/codebase-doctor", "name": "io.github.subhajitlucky/codebase-doctor", "kind": "mcp", "official": null, "desc": "Read-only codebase audits for coding agents: secrets, RLS, deps, review verdicts. No writes.", "repo": "https://github.com/subhajitlucky/codebase-doctor", "install": ["npm:codebase-doctor"], "stars": 0, "pushed": "2026-11-04T12:42:41Z", "license": "MIT", "plat": "codebase doctor", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sukrutkrdg/warden402-mcp", "name": "io.github.sukrutkrdg/warden402-mcp", "kind": "mcp", "official": null, "desc": "Pre-execution security for AI agents on Base: guard token/tx/address + per-agent spend firewall.", "repo": "https://github.com/sukrutkrdg/warden402.xyz", "install": ["npm:warden402-mcp"], "stars": 0, "pushed": "2026-10-10T12:09:25Z", "license": "MIT", "plat": "ai agents on base", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.SymbioticSec/mcp", "name": "io.github.SymbioticSec/mcp", "kind": "mcp", "official": null, "desc": "Symbiotic CLI MCP Server for security scanning and analysis", "repo": "https://github.com/SymbioticSec/mcp", "install": ["npm:@symbioticsec/symbiotic-mcp-server"], "stars": 0, "pushed": "2025-12-15T13:46:17Z", "license": "MIT", "plat": "symbiotic cli", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.thegridwork/aiact", "name": "io.github.thegridwork/aiact", "kind": "mcp", "official": null, "desc": "Scan codebases for AI usage, classify risk, generate EU AI Act compliance reports.", "repo": "https://github.com/thegridwork/aiact", "install": ["npm:gridwork-aiact"], "stars": 0, "pushed": "2026-04-12T11:32:19Z", "license": null, "plat": "codebases", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Thezenmonster/agentscore", "name": "io.github.Thezenmonster/agentscore", "kind": "mcp", "official": null, "desc": "MCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.", "repo": "https://github.com/Thezenmonster/agentscores", "install": ["npm:@agentscore-xyz/mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.trencinodin-stack/arcstone-mcp-sidecar", "name": "io.github.trencinodin-stack/arcstone-mcp-sidecar", "kind": "mcp", "official": null, "desc": "Deterministic execution boundary and reference MCP sidecar for Arcstone Security Stack", "repo": "https://github.com/trencinodin-stack/arcstone-mcp-sidecar", "install": [], "stars": 0, "pushed": "2026-11-07T00:39:28Z", "license": "Apache-2.0", "plat": "arcstone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vardior9/apiiro", "name": "io.github.vardior9/apiiro", "kind": "mcp", "official": null, "desc": "Ship software securely with an AI AppSec Agent", "repo": null, "install": [], "stars": null, "pushed": null, "license": null, "plat": "apiiro", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vdineshk/ai-compliance-monitor", "name": "io.github.vdineshk/ai-compliance-monitor", "kind": "mcp", "official": null, "desc": "Regulatory intelligence for AI agents across jurisdictions", "repo": "https://github.com/vdineshk/ai-compliance-monitor", "install": ["https://ai-compliance-monitor.sgdata.workers.dev/mcp"], "stars": 0, "pushed": "2026-04-10T22:55:15Z", "license": null, "plat": "", "live": "Live · 2379 ms · 4 tools · free to try: `check_obligations` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.vpatser1/mcp-server-security-scanner", "name": "io.github.vpatser1/mcp-server-security-scanner", "kind": "mcp", "official": null, "desc": "Scan MCP configs for 30+ CVEs, prompt injection, tool poisoning; validate OAuth configs", "repo": null, "install": ["npm:mcp-server-security-scanner"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.YottaMeta/yotta-verify-mcp", "name": "io.github.YottaMeta/yotta-verify-mcp", "kind": "mcp", "official": null, "desc": "Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload.", "repo": "https://github.com/YottaMeta/yotta-verify-mcp", "install": ["npm:@yottameta/yotta-verify-mcp"], "stars": 0, "pushed": "2026-11-06T16:11:19Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.heronapp/heron", "name": "io.heronapp/heron", "kind": "mcp", "official": null, "desc": "Signed security scores for what an AI agent runs and reads: skills, MCP servers, prompts, tokens.", "repo": null, "install": ["https://heronapp.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 526 (checked 2026-11-13)"}, {"id": "mcp:io.skimguard/skimguard", "name": "io.skimguard/skimguard", "kind": "mcp", "official": null, "desc": "Ask whether a location has recent credit-card-skimmer detections, from a consumer sensor network.", "repo": null, "install": ["https://mcp.skimguard.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 11896 ms · 17 tools · `skimguard_my_scanner_health` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/aml", "name": "io.tooloracle/aml", "kind": "mcp", "official": null, "desc": "AMLOracle — 12-tool AML/CFT MCP: 87k sanctions names, PEP screening, adverse media, SAR/STR.", "repo": "https://github.com/ToolOracle/aml", "install": ["https://tooloracle.io/aml/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "io.tooloracle/aml", "live": "Live · 42073 ms · 12 tools (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/ampel", "name": "io.tooloracle/ampel", "kind": "mcp", "official": null, "desc": "AmpelOracle — 50-tool compliance traffic-light: Go/Caution/Stop signals for ESG, MiCA, AML.", "repo": "https://github.com/ToolOracle/ampel", "install": ["https://tooloracle.io/ampel/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "io.tooloracle/ampel", "live": "Live · 42067 ms · 50 tools (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/dependencyoracle", "name": "io.tooloracle/dependencyoracle", "kind": "mcp", "official": null, "desc": "DependencyOracle - 10 ICT dependency tools: SBOM, supply chain, third-party graph.", "repo": "https://github.com/ToolOracle/dependencyoracle", "install": ["https://tooloracle.io/dependency/mcp/"], "stars": 0, "pushed": "2026-04-05T16:54:43Z", "license": "NOASSERTION", "plat": "io.tooloracle/dependencyoracle", "live": "Live · 21474 ms · 10 tools (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/dora", "name": "io.tooloracle/dora", "kind": "mcp", "official": null, "desc": "DORAOracle — 15 tools for DORA Art.5-32: risk register, ICT incidents, TLPT, third-party.", "repo": "https://github.com/ToolOracle/dora", "install": ["https://tooloracle.io/dora/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "io.tooloracle/dora", "live": "Live · 61317 ms · 15 tools (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/quantum", "name": "io.tooloracle/quantum", "kind": "mcp", "official": null, "desc": "QuantumOracle — 18 post-quantum crypto tools: Kyber, Dilithium, hybrid schemes, migration.", "repo": "https://github.com/ToolOracle/quantum", "install": ["https://tooloracle.io/quantum/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "crypto", "live": "Down · URLError: <urlopen error timed out> (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/tlpt", "name": "io.tooloracle/tlpt", "kind": "mcp", "official": null, "desc": "TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.", "repo": "https://github.com/ToolOracle/tlpt", "install": ["https://tooloracle.io/tlpt/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "tiber-eu tlpt framework: scope, threat i", "live": "Down · URLError: <urlopen error timed out> (checked 2026-11-13)"}, {"id": "mcp:io.tooloracle/zkevidenceoracle", "name": "io.tooloracle/zkevidenceoracle", "kind": "mcp", "official": null, "desc": "ZKEvidenceOracle - 14 zero-knowledge proof tools for compliance evidence: Groth16, PLONK.", "repo": "https://github.com/ToolOracle/zkevidenceoracle", "install": ["https://tooloracle.io/zk/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "groth16, plonk", "live": "Down · URLError: <urlopen error timed out> (checked 2026-11-13)"}, {"id": "mcp:com.ip99/ip99", "name": "IP99 IP risk & geolocation", "kind": "mcp", "official": null, "desc": "Free IP risk and geolocation lookup: proxy, VPN and datacenter detection. No API key.", "repo": null, "install": ["https://ip99.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ip99", "live": "Live · 5878 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.ipmusk/mcp", "name": "IPMusk", "kind": "mcp", "official": null, "desc": "Residential and static proxies: check usage, build proxy URLs, open tickets, get payment links.", "repo": null, "install": ["https://ipmusk.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ipmusk", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/ironscales-mcp", "name": "Ironscales", "kind": "mcp", "official": null, "desc": "MCP server for Ironscales phishing incident management — incidents, mailboxes, and reporting.", "repo": "https://github.com/WYRE-AI/ironscales-mcp", "install": ["oci:ghcr.io/wyre-ai/ironscales-mcp:v1.2.3"], "stars": 0, "pushed": "2026-11-12T16:57:07Z", "license": "Apache-2.0", "plat": "ironscales", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/ironscales-mcp", "name": "Ironscales", "kind": "mcp", "official": null, "desc": "MCP server for Ironscales phishing incident management — incidents, mailboxes, and reporting.", "repo": "https://github.com/wyre-technology/ironscales-mcp", "install": ["oci:ghcr.io/wyre-technology/ironscales-mcp:v1.2.1"], "stars": 0, "pushed": "2026-11-12T16:57:07Z", "license": "Apache-2.0", "plat": "ironscales", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/island-mcp", "name": "Island Browser", "kind": "mcp", "official": null, "desc": "MCP server for Island Browser's Admin Actions, Audit, Compromised Credential, and Device APIs.", "repo": "https://github.com/WYRE-AI/island-mcp", "install": ["oci:ghcr.io/wyre-ai/island-mcp:v1.0.3"], "stars": 0, "pushed": "2026-11-12T16:58:24Z", "license": "NOASSERTION", "plat": "island browser", "live": "Not checked (runs locally)"}, {"id": "mcp:com.a2awire/benchmark-access-change-request-recertify-2026-09-15-b578285f", "name": "IT Security — Access Change Request Recertify — Alder Court Partners (b578285f)", "kind": "mcp", "official": null, "desc": "Free to compete: testnet faucet funds everything. 12 synthetic access change request exception…", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/benchmarks/access-change-request-recertify-2026-09-15-b578285f/http"], "stars": null, "pushed": null, "license": null, "plat": "access change request", "live": "Live · 1272 ms · 29 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.jithox/eu-sanctions-preflight", "name": "Jithox EU Counterparty Sanctions Preflight", "kind": "mcp", "official": null, "desc": "Read-only EU sanctions preflight: screen names/IDs against EU list. Evidence, not a verdict.", "repo": null, "install": ["https://sanctions.mcp.jithox.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "eu sanctions", "live": "Down · URLError: <urlopen error timed out> (checked 2026-11-13)"}, {"id": "mcp:sh.jsmon/mcp", "name": "Jsmon", "kind": "mcp", "official": null, "desc": "Discover exposed assets, leaked secrets, APIs & client-side vulns across your attack surface", "repo": null, "install": ["https://mcp.jsmon.sh/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.immoney1/kaal-agent-safety", "name": "Kaal Agent Safety (x402 paid MCP)", "kind": "mcp", "official": null, "desc": "Paid MCP tools for URL payment-safety scanning and provider recommendations; USDC on Base via x402.", "repo": "https://github.com/immoney1/kaal-agent-safety", "install": ["https://places-wayne-experiment-facial.trycloudflare.com/mcp"], "stars": 0, "pushed": "2026-10-27T15:53:36Z", "license": null, "plat": "x402", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:so.kadent/kadent-scan", "name": "Kadent Scan", "kind": "mcp", "official": null, "desc": "Free, read-only security scanner for remote MCP servers, before you connect them.", "repo": null, "install": ["https://mcp.kadent.so/scan/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 515 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.kaidn/kaidn-mcp", "name": "Kaidn", "kind": "mcp", "official": null, "desc": "Explain fraud verdicts with evidence, surface account rings, and see who has burned other operators.", "repo": "https://github.com/Kaidn-io/kaidn-mcp", "install": ["npm:@kaidn/mcp"], "stars": 0, "pushed": "2026-09-05T09:55:56Z", "license": "MIT", "plat": "kaidn", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.TylerKnvpp/kairos", "name": "Kairos Timer", "kind": "mcp", "official": null, "desc": "Run the Kairos timer from your assistant, read the ledger, and draft invoices at month end.", "repo": "https://github.com/TylerKnvpp/time-api", "install": ["https://time-api-f6m3.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "mcp servers", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:app.katla/katla", "name": "Katla", "kind": "mcp", "official": null, "desc": "GDPR/CCPA cookie consent: scan sites for cookies, track consent rates, generate privacy policies.", "repo": null, "install": ["https://api.katla.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.robertkeus/keep-me-secure-mcp", "name": "Keep Me Secure", "kind": "mcp", "official": null, "desc": "Tells your coding agent whether your installed packages need patching, with advice on what to do.", "repo": "https://github.com/robertkeus/keep-me-secure-mcp", "install": ["oci:ghcr.io/robertkeus/keep-me-secure-mcp:v1.7.0", "https://mcp.keepmesecure.dev/mcp"], "stars": 0, "pushed": "2026-11-11T09:55:23Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.kernelscan/kernelscan", "name": "KernelScan", "kind": "mcp", "official": null, "desc": "Linux kernel CVE analyzer: upload a .config, get a CycloneDX VEX report of affecting CVEs.", "repo": null, "install": ["https://kernelscan.io/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "linux kernel cve", "live": "Live · 3120 ms · 11 tools · `list_products` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.cybermax-tools.cybermax/kevscope-api", "name": "Kevscope", "kind": "mcp", "official": null, "desc": "CVE patch-priority API + MCP: CISA KEV, EPSS, CVSS, SSVC. Keys $19/mo; 200 free calls/day.", "repo": "https://gitlab.com/CyberMax.tools/agent-tools", "install": ["https://kevscope-api.cybermaxtools.com/mcp?via=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 479 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:dev.workers.cybermax-tools.cybermax/kevscope-chatgpt", "name": "Kevscope CVE Check", "kind": "mcp", "official": null, "desc": "Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.", "repo": "https://gitlab.com/CyberMax.tools/agent-tools", "install": ["https://gpt-kevscope.cybermaxtools.com/mcp?via=mcp-registry"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 391 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.cyligence-karim/killerskills", "name": "KillerSkills", "kind": "mcp", "official": null, "desc": "Security verdicts for agent skills and MCP servers, from sandbox runs, before you install them.", "repo": "https://github.com/cyligence-karim/vet-skills", "install": ["npm:vet-skills"], "stars": 0, "pushed": "2026-11-13T03:01:21Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.kindnod/consent", "name": "Kindnod cookie consent", "kind": "mcp", "official": null, "desc": "GDPR cookie banner any coding agent can install with no account: provision, snippet, scan, verify.", "repo": null, "install": ["https://kindnod.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "gdpr", "live": "Live · 2604 ms · 5 tools · free to try: `check_install` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Kloudle/cloud-security-scanner", "name": "Kloudle Cloud Security Scanner", "kind": "mcp", "official": null, "desc": "AWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs", "repo": null, "install": ["https://mcp.kloudle.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "aws", "live": "Live · 1036 ms · 2 tools · free to try: `search` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.wyre-technology/knowbe4-mcp", "name": "KnowBe4", "kind": "mcp", "official": null, "desc": "MCP server for KnowBe4 security awareness training — users, groups, training, phishing campaigns.", "repo": "https://github.com/wyre-technology/knowbe4-mcp", "install": ["oci:ghcr.io/wyre-technology/knowbe4-mcp:v1.1.4"], "stars": 0, "pushed": "2026-11-12T16:59:52Z", "license": "Apache-2.0", "plat": "knowbe4", "live": "Not checked (runs locally)"}, {"id": "mcp:com.kodemsecurity/kodem", "name": "Kodem", "kind": "mcp", "official": null, "desc": "Ask about your Kodem Security data and act on findings in plain language, with your permissions.", "repo": null, "install": ["https://api.kodemsecurity.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "kodem", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.datakoot/koot-briefings", "name": "Koot by Datakoot", "kind": "mcp", "official": null, "desc": "One-call briefings for AI agents: dependency risk (KEV/EPSS), SEC companies, domains, US places.", "repo": "https://github.com/datakoot/koot-mcp", "install": ["https://koot.datakoot.com/mcp"], "stars": 0, "pushed": "2026-10-09T08:14:36Z", "license": "MIT", "plat": "sec", "live": "Live · 540 ms · 8 tools (checked 2026-11-13)"}, {"id": "mcp:dev.korzen/bot-protection", "name": "Korzen Bot Protection", "kind": "mcp", "official": null, "desc": "Ask why Korzen Bot Protection blocked a request, what attacked your site and which AIs read it.", "repo": null, "install": ["https://korzen.dev/bot-protection/mcp"], "stars": null, "pushed": null, "license": null, "plat": "korzen bot protection", "live": "Responds, sign-in needed (checked 2026-11-14)"}, {"id": "mcp:io.github.bugsbuny243/koschei", "name": "Koschei", "kind": "mcp", "official": null, "desc": "Run agent-written code under a capability policy: see what a program can touch before it runs.", "repo": "https://github.com/bugsbuny243/koschei-lang", "install": ["pypi:koschei-lang"], "stars": 0, "pushed": "2026-11-13T09:59:49Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:eu.krakenshield/krakenshield", "name": "KrakenShield", "kind": "mcp", "official": null, "desc": "Quick HTTPS/SSL check of any website, cybersecurity glossary and KrakenShield prices.", "repo": null, "install": ["https://api.krakenshield.eu/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 3613 ms · 3 tools · free to try: `search_cyber_knowledge` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.namiq/lattice", "name": "Lattice: CVE, MITRE ATT&CK and detection graph for security agents", "kind": "mcp", "official": null, "desc": "CVE, KEV, MITRE ATT&CK, CWE and detection graph for AI agents; every link names its source.", "repo": null, "install": ["https://lattice.namiq.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "lattice", "live": "Live · 1813 ms · 10 tools · `graph_search` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:co.launchtrust/launchtrust", "name": "LaunchTrust", "kind": "mcp", "official": null, "desc": "Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.", "repo": "https://github.com/mustafasalimerek-bit/launchtrust-mcp", "install": ["https://mcp.launchtrust.co/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 700 ms · 9 tools · `list_my_apps` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.quietworklabs.ledgerbell/ledgerbell", "name": "Ledgerbell onchain alerts", "kind": "mcp", "official": null, "desc": "Webhook alerts for EVM wallets, contract admin changes, Safe queues and custom events.", "repo": null, "install": ["https://ledgerbell.quietworklabs.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "evm", "live": "Live · 787 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:dev.workers.rjhsignaltech.ai/licence-audit", "name": "Licence audit, page read and endpoint check (AI-operated)", "kind": "mcp", "official": null, "desc": "AI-operated. Free previews: licences, page reads, endpoint checks. Paid full versions over x402.", "repo": null, "install": ["https://omnia-sell.rjhsignaltech.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.weiseer/license-checker", "name": "license-checker", "kind": "mcp", "official": null, "desc": "OSS license metadata + compatibility checker MCP server.", "repo": "https://github.com/weiseer/license-checker-mcp", "install": ["npm:@weiseer/license-checker-mcp"], "stars": 0, "pushed": "2026-06-01T09:28:35Z", "license": null, "plat": "license-checker", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rccaoki-wq/license-guard", "name": "LicenseGuard", "kind": "mcp", "official": null, "desc": "Check if a dependency's license obligates you, based on how you ship. npm, PyPI, Go.", "repo": "https://github.com/rccaoki-wq/license-guard", "install": ["oci:ghcr.io/rccaoki-wq/license-guard:1.1.0", "https://license-guard.rcc-aoki.workers.dev/mcp"], "stars": 0, "pushed": "2026-08-27T01:36:22Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/liongard-mcp", "name": "Liongard", "kind": "mcp", "official": null, "desc": "MCP server for Liongard — inspectors, environments, metrics, detections, and timeline data.", "repo": "https://github.com/WYRE-AI/liongard-mcp", "install": ["oci:ghcr.io/wyre-ai/liongard-mcp:v2.3.10"], "stars": 0, "pushed": "2026-11-12T16:57:11Z", "license": "Apache-2.0", "plat": "liongard", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.beepboop2025/liquilens-evidence-carrier", "name": "LiquiLens Evidence Carrier", "kind": "mcp", "official": null, "desc": "Offline verification of local evidence carriers, fleet briefs, and hash-only trade-safety receipts.", "repo": "https://github.com/beepboop2025/liquilens-evidence-carrier", "install": ["mcpb:https://github.com/beepboop2025/liquilens-evidence-carrier/releases/download/v0.20.1/liquilens-evidence-carrier-mcp-0.20.1.mcpb"], "stars": 0, "pushed": "2026-11-12T04:39:08Z", "license": "Apache-2.0", "plat": "liquilens", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.beepboop2025/liquilens-trade-safety-gateway", "name": "LiquiLens Trade Safety Gateway", "kind": "mcp", "official": null, "desc": "Read-only checks for proposed orders against evidence and policy; no trading or payment authority.", "repo": "https://github.com/beepboop2025/liquilens-evidence-carrier", "install": ["https://trade-safety.liquilens.in/mcp"], "stars": 0, "pushed": "2026-11-12T04:39:08Z", "license": "Apache-2.0", "plat": "liquilens", "live": "Down · HTTP 400 (checked 2026-11-13)"}, {"id": "mcp:io.github.joshghent/loginllama", "name": "LoginLlama", "kind": "mcp", "official": null, "desc": "Ask questions about your login security data: risk scores, blocked logins, Tor, VPN and bot traffic.", "repo": null, "install": ["https://loginllama.app/api/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1694 ms · 5 tools · `get_login_stats` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/logsentinel", "name": "LogSentinel", "kind": "mcp", "official": null, "desc": "Anthropic logs audit filter and cybersecurity threat analyzer.", "repo": null, "install": ["https://logsentinel-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "anthropic", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.logtriage-cyber/logtriage", "name": "LogTriage", "kind": "mcp", "official": null, "desc": "Security log tools: Windows/Entra error codes, log explainer, IP blocklists, attack scans", "repo": null, "install": ["https://api.logtriage.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2333 ms · 5 tools · free to try: `check_ip_blocklists` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.lorglabs/lorg-check", "name": "Lorg Check", "kind": "mcp", "official": null, "desc": "Is this token a trap? Is this address safe to pay? Signed verdicts on Base and Ethereum.", "repo": null, "install": ["https://api.lorglabs.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Dansgit2b/lumen-presign-check", "name": "Lumen Pre-Sign Check", "kind": "mcp", "official": null, "desc": "Use before signing an EVM tx or EIP-712 message: risk flags + verdict. Informational, no simulation", "repo": "https://github.com/Dansgit2b/lumenworks-x402-api", "install": ["https://lumenworks-x402-decoder.onrender.com/mcp/presign"], "stars": 0, "pushed": "2026-10-11T03:15:20Z", "license": "MIT", "plat": "evm", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:co.macrocyber/attack-surface", "name": "MacroCyber", "kind": "mcp", "official": null, "desc": "Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.", "repo": null, "install": ["https://macrocyber.co/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 813 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:com.mactechsolutionsllc.www/cmmc", "name": "MacTech CMMC / NIST 800-171", "kind": "mcp", "official": null, "desc": "NIST 800-171 controls and 800-171A objectives, crosswalks, exact SPRS scoring, POA&M generation.", "repo": null, "install": ["https://www.mactechsolutionsllc.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "mactech cmmc / nist 800-171", "live": "Live · 1403 ms · 13 tools · free to try: `lookup_control` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.mactechsolutionsllc.www/stig", "name": "MacTech STIG", "kind": "mcp", "official": null, "desc": "2,029 DISA STIG rules with official check/fix text, CCI mappings, and .ckl checklist export.", "repo": null, "install": ["https://www.mactechsolutionsllc.com/api/mcp/stig"], "stars": null, "pushed": null, "license": null, "plat": "mactech stig", "live": "Live · 1623 ms · 4 tools · free to try: `export_stig_checklist` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.twojlogin/mailhunter-pro", "name": "MailHunterPro", "kind": "mcp", "official": null, "desc": "Read-only queries on local phishing scan results: findings, IOCs, SPF/DKIM/DMARC.", "repo": "https://github.com/twojlogin/MailHunterPro", "install": [], "stars": 0, "pushed": "2026-11-11T05:18:24Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:app.malinois/scan", "name": "Malinois", "kind": "mcp", "official": null, "desc": "Check a live app you own for public databases, leaked keys and exposed files.", "repo": null, "install": ["https://malinois.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 911 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:com.malwaretracker/mcp", "name": "MalwareTracker Document Malware & AI Safety Scanner", "kind": "mcp", "official": null, "desc": "Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.", "repo": "https://github.com/tylabs/malwaretracker-mcp", "install": ["pypi:malwaretracker-mcp", "https://api.malwaretracker.com/mcp"], "stars": 0, "pushed": "2026-11-13T00:44:52Z", "license": "MIT", "plat": "malwaretracker", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mcp-fortress/mcp-fortress", "name": "MCP Fortress", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.", "repo": null, "install": ["https://server.smithery.ai/@mcp-fortress/mcp-fortress-server/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:dev.gtfo/mcp-killchain-stage1-weather", "name": "MCP Kill-Chain Research — Stage 1 (Identity ≠ Behavior)", "kind": "mcp", "official": null, "desc": "Security research: MCP registries verify identity, not tool behavior. See gtfo.dev.", "repo": null, "install": ["https://ailm.gtfo.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1039 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:dev.modelmarket/mcp-security", "name": "MCP security checks — WARDEN and HISTOR", "kind": "mcp", "official": null, "desc": "Scan MCP tool definitions for poisoning, look up server history, count tool-list tokens. Free.", "repo": "https://github.com/alexar76/warden", "install": ["https://modelmarket.dev/tools/mcp/security"], "stars": 0, "pushed": "2026-11-12T19:22:22Z", "license": "MIT", "plat": "", "live": "Live · 1016 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.petrovicistefan/mcp-security-guard", "name": "MCP Security Guard", "kind": "mcp", "official": null, "desc": "Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10).", "repo": "https://github.com/petrovicistefan/mcp-security-guard", "install": ["npm:mcp-security-guard"], "stars": 0, "pushed": "2026-11-09T17:28:00Z", "license": "MIT", "plat": "owasp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.dfkunstler/mcp-server-for-oscal", "name": "MCP Server for OSCAL", "kind": "mcp", "official": null, "desc": "AI agent tools for Open Security Controls Assessment Language (OSCAL)", "repo": "https://github.com/dfkunstler/mcp-server-for-oscal", "install": ["pypi:mcp-server-for-oscal"], "stars": 0, "pushed": "2026-10-26T22:20:14Z", "license": "Apache-2.0", "plat": "oscal", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.sophiacave/mcp-shield", "name": "MCP Shield", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F.", "repo": "https://github.com/sophiacave/mcp-shield", "install": ["npm:@sophiacave/mcp-shield"], "stars": 0, "pushed": "2026-06-09T20:17:13Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.marcepalacios12/mcp-poisoning-scanner", "name": "MCP Tool Poisoning Scanner", "kind": "mcp", "official": null, "desc": "Scan MCP servers for tool poisoning, hidden instructions and silent tool changes. Runs on Apify.", "repo": null, "install": ["https://mcp.apify.com/?tools=bigochelo/mcp-poisoning-scanner"], "stars": null, "pushed": null, "license": null, "plat": "apify", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.nabrahma/mcp-ztgateway", "name": "MCP Zero-Trust Gateway", "kind": "mcp", "official": null, "desc": "Security gateway: verifies what MCP servers really do, then confines each call. Needs Docker.", "repo": null, "install": ["pypi:mcp-ztgateway"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.diegoperezg7/mcp-guard-scan", "name": "mcp-guard", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers: tool poisoning, shadowing, permissions, secrets, transport.", "repo": "https://github.com/diegoperezg7/mcp-guard-scan", "install": ["npm:mcp-guard-scan"], "stars": 0, "pushed": "2026-11-04T11:30:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CodingSelim/mcp-scan", "name": "mcp-scan", "kind": "mcp", "official": null, "desc": "Passive security scanner: audits MCP servers against the OWASP MCP Top 10, graded A-F.", "repo": "https://github.com/CodingSelim/mcp-scan", "install": ["npm:owasp-mcp-scan"], "stars": 0, "pushed": "2026-10-10T07:43:44Z", "license": "MIT", "plat": "owasp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.saagpatel/mcp-trust", "name": "mcp-trust", "kind": "mcp", "official": null, "desc": "Check the danger grade of any public MCP server before you connect.", "repo": "https://github.com/saagpatel/mcp-trust", "install": ["pypi:mcp-trust"], "stars": 0, "pushed": "2026-11-08T16:10:31Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.mcpscores/onchain-toolkit", "name": "MCPFax On-Chain Toolkit", "kind": "mcp", "official": null, "desc": "The on-chain facts you need in the seconds before you transact.", "repo": null, "install": ["https://onchain-toolkit.bowling-anthony.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1123 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:com.mcpscores/agent-reliability-scores", "name": "MCPFax Reliability", "kind": "mcp", "official": null, "desc": "Before you pay an endpoint you cannot vouch for: credit grade, drift and preflight.", "repo": null, "install": ["https://mcpfax-reliability.bowling-anthony.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 545 ms · 7 tools (checked 2026-11-13)"}, {"id": "mcp:com.mcplookup/mcp", "name": "MCPLookup", "kind": "mcp", "official": null, "desc": "Look up independent trust ratings and security, maintenance, and adoption evidence for MCP servers.", "repo": "https://github.com/mcplookupdev/mcplookup-mcp", "install": ["npm:@mcplookup/mcp", "https://mcplookup.com/mcp"], "stars": 0, "pushed": "2026-08-17T00:29:36Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:tech.mcpprobe/scanner", "name": "mcpprobe", "kind": "mcp", "official": null, "desc": "Read-only MCP security data: check catalogue, public scan status and your own scan reports.", "repo": "https://github.com/mcpprobe-dev/mcpprobe", "install": ["https://mcpprobe.tech/mcp"], "stars": 0, "pushed": "2026-11-12T20:12:43Z", "license": "Apache-2.0", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:app.merron/ai-act-check", "name": "Merron", "kind": "mcp", "official": null, "desc": "Inspect selected project excerpts and screen user-confirmed facts for bounded EU AI Act readiness.", "repo": null, "install": ["https://merron.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "eu ai act", "live": "Live · 1802 ms · 4 tools · free to try: `merron_get_questions` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.meweapps/deeptech-scanners", "name": "MeWeApps Deep-Tech Scanners", "kind": "mcp", "official": null, "desc": "Free PQC TLS, CRA disclosure, green claims, battery passport, CRISPR, REACH and URDF scanners.", "repo": null, "install": ["https://meweapps.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1545 ms · 8 tools · free to try: `battery_passport_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.mfsmai/sentinel", "name": "MFSMAI Sentinel", "kind": "mcp", "official": null, "desc": "Risk checks for BNB Chain tokens, wallets and ERC-8004 AI agents before you pay or trade.", "repo": null, "install": ["https://api-sentinel.mfsmai.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 400 (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-windows-security-update-microsoft-cvrf", "name": "Microsoft Windows Security Updates (MSRC CVRF) — buy per-query in-session (msrcwatch)", "kind": "mcp", "official": null, "desc": "MSRC Windows updates: CVE rollups, Patch Tuesday. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/msrcwatch-microsoft-msrc-security-updates-99ddab/http"], "stars": null, "pushed": null, "license": null, "plat": "microsoft", "live": "Live · 2043 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:lat.rta/mitracore", "name": "mitracore — trust layer for agent work", "kind": "mcp", "official": null, "desc": "Verify the artifact, meter the cost, enforce the mandate — one call.", "repo": "https://github.com/mrpkk/mitracore", "install": ["https://rta.lat/mitracore/mcp"], "stars": 0, "pushed": "2026-11-12T14:19:03Z", "license": "MIT", "plat": "mitracore", "live": "Live · 3902 ms · 5 tools · free to try: `suite_status` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/mitre-cwe", "name": "Mitre Cwe", "kind": "mcp", "official": null, "desc": "MITRE CWE API MCP.", "repo": "https://github.com/pipeworx-io/mcp-mitre-cwe", "install": ["npm:@pipeworx/mcp-mitre-cwe", "https://gateway.pipeworx.io/mitre-cwe/mcp"], "stars": 0, "pushed": "2026-11-09T14:20:22Z", "license": "MIT", "plat": "mitre cwe", "live": "Not checked (runs locally)"}, {"id": "mcp:com.mobilevalidate/mcp", "name": "MobileValidate", "kind": "mcp", "official": null, "desc": "Check phone numbers (WhatsApp, Telegram, carrier, spam reputation) and e-mail addresses.", "repo": "https://github.com/brntech/mobilevalidate-sdk", "install": ["npm:@mobilevalidate/mcp", "https://mcp.mobilevalidate.com/mcp"], "stars": 0, "pushed": "2026-11-08T04:29:19Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wmujahid428-web/muj428-trust-layer", "name": "MUJ428 Trust Layer — Bind Approved Intent to Verified Effect", "kind": "mcp", "official": null, "desc": "Payment-rail-independent intent-to-effect integrity for consequential agent actions.", "repo": "https://github.com/wmujahid428-web/muj428-a2a-revenue-engine", "install": ["https://agents.muj428.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1286 ms · 2 tools · free to try: `get_evidence_signal_requirements` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.wmujahid428-web/trust-layer", "name": "MUJ428 Trust Layer — VERIFY BEFORE ACT", "kind": "mcp", "official": null, "desc": "MUJ428 verifies intent and evidence before consequential AI-agent actions.", "repo": "https://github.com/wmujahid428-web/muj428-a2a-revenue-engine", "install": ["https://wepmhfjzckclvywolrek.supabase.co/functions/v1/trust-layer-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1438 ms · 14 tools · free to try: `get_trust_heartbeat` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.n0n4/guardian", "name": "N0N4 Guardian", "kind": "mcp", "official": null, "desc": "C2PA sign/verify for AI agents, prompt-injection scanning, and signed M2M custody handoffs.", "repo": null, "install": [], "stars": null, "pushed": null, "license": null, "plat": "n0n4 guardian", "live": "Not checked (runs locally)"}, {"id": "mcp:net.bigfloppy.vibescan/vibescan", "name": "net.bigfloppy.vibescan/vibescan", "kind": "mcp", "official": null, "desc": "Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.", "repo": "https://github.com/wminno/vibescan", "install": ["https://vibescan.bigfloppy.net/mcp"], "stars": 0, "pushed": "2026-10-30T13:12:25Z", "license": null, "plat": "github", "live": "Live · 1694 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.getlarkwright/netops-field-notes-mcp", "name": "NetOps Field Notes", "kind": "mcp", "official": null, "desc": "Config drift, CIS/PCI checks, 802.1X diagnosis, certs inside configs, topology, change pre-flight.", "repo": "https://github.com/getlarkwright/netops-field-notes-mcp", "install": ["oci:ghcr.io/getlarkwright/netops-field-notes-mcp:0.1.1"], "stars": 0, "pushed": "2026-11-07T15:25:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.artnames/nexart-mcp-server", "name": "NexArt MCP Server", "kind": "mcp", "official": null, "desc": "Verify NexArt evidence and opt in to confidential AI recording and authorised Node certification.", "repo": "https://github.com/artnames/nexart-mcp-server", "install": ["npm:@nexart/mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.nizh/nizh", "name": "Nizh", "kind": "mcp", "official": null, "desc": "Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.", "repo": null, "install": ["https://mcp.nizh.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "nizh", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.licklider-ai/nomue-mcp", "name": "nomue Record Verifier", "kind": "mcp", "official": null, "desc": "Local verification of nomue Protocol Records; current release supports the Release 1 Welch bundle.", "repo": "https://github.com/licklider-ai/nomue-mcp", "install": ["npm:@licklider/nomue-mcp"], "stars": 0, "pushed": "2026-09-18T02:55:42Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.licklider-ai/nomue-verifier-mcp", "name": "nomue Record Verifier", "kind": "mcp", "official": null, "desc": "Local verification of nomue Protocol Records; current release supports the Release 1 Welch bundle.", "repo": "https://github.com/licklider-ai/nomue-verifier-mcp", "install": ["npm:@licklider/nomue-verifier-mcp"], "stars": 0, "pushed": "2026-09-18T02:55:42Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/nvd", "name": "Nvd", "kind": "mcp", "official": null, "desc": "NVD MCP — wraps the NIST National Vulnerability Database API.…", "repo": "https://github.com/pipeworx-io/mcp-nvd", "install": ["npm:@pipeworx/mcp-nvd", "https://gateway.pipeworx.io/nvd/mcp"], "stars": 0, "pushed": "2026-11-09T14:25:48Z", "license": "MIT", "plat": "nist national vulnerability database", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.BorgDevelopment/odin-mcp", "name": "Odin", "kind": "mcp", "official": null, "desc": "Read Odin security findings and remediation, link fix pull requests and track retests.", "repo": null, "install": ["npm:@borgresearch/odin-mcp", "https://odin.borghq.io/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "odin", "live": "Not checked (runs locally)"}, {"id": "mcp:com.offseq/radar", "name": "OffSeq Threat Radar", "kind": "mcp", "official": null, "desc": "Live CVE, CISA KEV and exploit intelligence, SBOM scans, patch prioritization and IOC checks.", "repo": null, "install": ["https://radar.offseq.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.chusmias258-dev/omega-x402-mcp", "name": "Omega x402 Security, Biomed & Escrow Intelligence MCP", "kind": "mcp", "official": null, "desc": "7 x402 v2 pay-per-call MCP tools for FDA/ChEMBL, token rug scan, Base escrow & wallet forensics.", "repo": null, "install": ["https://agy-x402-gateway.omega-x402-edge.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Live · 322 ms · 7 tools (checked 2026-11-13)"}, {"id": "mcp:com.theonchaindiary/onchain-diary", "name": "Onchain Diary", "kind": "mcp", "official": null, "desc": "Search and read Web3 security education articles and a 230-term glossary from Onchain Diary.", "repo": null, "install": ["https://theonchaindiary.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1948 ms · 4 tools · free to try: `read_article` answered without a key (checked 2026-11-13)"}, {"id": "mcp:trade.onyxprotocol/onyx-aml", "name": "Onyx AML", "kind": "mcp", "official": null, "desc": "Crypto address risk checks for agents: USDT/USDC blacklists, sanctions, scam lists, poisoning", "repo": null, "install": ["https://onyxprotocol.trade/mcp"], "stars": null, "pushed": null, "license": null, "plat": "crypto", "live": "Live · 1535 ms · 8 tools (checked 2026-11-13)"}, {"id": "mcp:com.opzyai/pro", "name": "Opzyai Pro", "kind": "mcp", "official": null, "desc": "Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.", "repo": null, "install": ["https://www.opzyai.com/api/mcp/pro/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.opzyai/mcp", "name": "Opzyai Security Check", "kind": "mcp", "official": null, "desc": "Local-first security check for AI coding agents: secrets, .env exposure, git-history leaks, CVEs.", "repo": null, "install": ["npm:@opzyai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.opzyai/scan", "name": "Opzyai Vibe Check", "kind": "mcp", "official": null, "desc": "Free no-account URL security scan: 0-100 Launch Readiness score for any live site in ~15 seconds.", "repo": null, "install": ["https://www.opzyai.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.orioncmd.api/checks", "name": "OrionCMD Checks", "kind": "mcp", "official": null, "desc": "Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit (x402).", "repo": null, "install": ["https://api.orioncmd.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1418 ms · 14 tools (checked 2026-11-13)"}, {"id": "mcp:co.ostorlab/mcp", "name": "Ostorlab", "kind": "mcp", "official": null, "desc": "Query and act on your Ostorlab scans, vulnerabilities, tickets and assets.", "repo": null, "install": ["https://api.ostorlab.co/apis/mcp/{api_key}/"], "stars": null, "pushed": null, "license": null, "plat": "ostorlab", "live": "Live · 2025 ms · 268 tools · `get_scan` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/osv", "name": "Osv", "kind": "mcp", "official": null, "desc": "OSV.dev (Open Source Vulnerabilities) MCP.", "repo": "https://github.com/pipeworx-io/mcp-osv", "install": ["npm:@pipeworx/mcp-osv", "https://gateway.pipeworx.io/osv/mcp"], "stars": 0, "pushed": "2026-11-09T14:30:21Z", "license": "MIT", "plat": "osv", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.fairquery/osv-dependency-vulnerability-check", "name": "OSV Dependency Vulnerability Check", "kind": "mcp", "official": null, "desc": "Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.", "repo": "https://github.com/fairquery/osv-dependency-vulnerability-check", "install": ["https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check"], "stars": null, "pushed": null, "license": null, "plat": "osv.dev", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.alikup-ai/otgate-opcua", "name": "otgate — OT policy gateway", "kind": "mcp", "official": null, "desc": "Gates an LLM agent's writes to an OPC UA server on ranges, rate of change and live interlocks.", "repo": "https://github.com/alikup-ai/otgate", "install": ["pypi:otgate"], "stars": 0, "pushed": "2026-11-10T08:31:32Z", "license": "Apache-2.0", "plat": "opc ua", "live": "Not checked (runs locally)"}, {"id": "mcp:ws.overflo/overflows", "name": "overflo.ws", "kind": "mcp", "official": null, "desc": "Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.", "repo": null, "install": ["https://mcp.overflo.ws/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2244 ms · 7 tools · free to try: `find_package` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.joshluberisse/ovrin-mcp", "name": "Ovrin", "kind": "mcp", "official": null, "desc": "Secure Linux sandboxes for AI agents, as MCP tools.", "repo": "https://github.com/joshluberisse/OvrinPlatform", "install": ["pypi:ovrin-mcp", "https://mcp.ovrin.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/owasp", "name": "Owasp", "kind": "mcp", "official": null, "desc": "OWASP MCP — keyless.", "repo": "https://github.com/pipeworx-io/mcp-owasp", "install": ["npm:@pipeworx/mcp-owasp", "https://gateway.pipeworx.io/owasp/mcp"], "stars": 0, "pushed": "2026-11-09T14:30:41Z", "license": "MIT", "plat": "owasp", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.ownyourmind/oym-substrate", "name": "Own Your Mind DeAI assessments", "kind": "mcp", "official": null, "desc": "Signed, independent scores and claim checks for decentralised AI projects. Read-only, no auth.", "repo": null, "install": ["https://agent-trust.ownyourmind.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1819 ms · 7 tools · free to try: `get_returns_breakdown` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.imal1ice/ownerwatch-mcp", "name": "ownerwatch", "kind": "mcp", "official": null, "desc": "Read-only: who controls EVM contracts. Owners, proxy admins, Safes, timelocks, roles.", "repo": "https://github.com/imal1ice/ownerwatch-mcp", "install": ["pypi:ownerwatch-mcp"], "stars": 0, "pushed": "2026-11-11T12:05:41Z", "license": "MIT", "plat": "evm", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.workers.x402-bazaar-rank-worker.x402-bazaar-rank/cve-package-domain-security", "name": "P0: CVE, package and domain checks", "kind": "mcp", "official": null, "desc": "CVE with EPSS and CISA KEV, package risk, software EOL, domain and IP reports, pay per call", "repo": null, "install": ["https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/mcp/cve-package-domain-security"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 4524 ms · 9 tools · free to try: `check_infra` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.soumik15630m/paritydiff", "name": "ParityDiff", "kind": "mcp", "official": null, "desc": "Inspect API contract changes, review private evidence, and request validated migration drafts.", "repo": "https://github.com/Paritydiff-Parity-Diff/mcp", "install": ["npm:@paritydiff/mcp"], "stars": 0, "pushed": "2026-11-13T08:39:00Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:dev.patchlabs/patchlabs", "name": "PatchLabs", "kind": "mcp", "official": null, "desc": "Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes.", "repo": "https://github.com/manra399/patchlabs", "install": ["https://api.patchlabs.dev/mcp"], "stars": 0, "pushed": "2026-11-13T05:15:24Z", "license": null, "plat": "ai-built apps", "live": "Live · 1522 ms · 6 tools · `list_apps` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:dev.monowire/patchwire", "name": "Patchwire", "kind": "mcp", "official": null, "desc": "Hourly security advisories for JS, AI and web3 packages: ranges, fixes and exploit conditions.", "repo": null, "install": ["https://patchwire.monowire.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2645 ms · 5 tools · free to try: `list_feed` answered without a key (checked 2026-11-13)"}, {"id": "mcp:online.patroltech/patroltech", "name": "PatrolTech", "kind": "mcp", "official": null, "desc": "Security patrol management: missed rounds, suspicious scans, incidents and checkpoint setup.", "repo": "https://github.com/PatrolTech/mcp-server", "install": ["https://mcp.patroltech.online/mcp"], "stars": 0, "pushed": "2026-11-10T14:25:33Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:studio.patronus/control-plane", "name": "Patronus Security", "kind": "mcp", "official": null, "desc": "Scan text, documents, websites, and MCP metadata for prompt injection and sensitive-data risks.", "repo": null, "install": ["https://control.patronus.studio/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "patronus security", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.TonytheTiger22/payperscreen", "name": "PayPerScreen", "kind": "mcp", "official": null, "desc": "Sanctions, crypto wallet, email and IP screening for agents. Pay per check in USDC via x402.", "repo": "https://github.com/TonytheTiger22/payperscreen", "install": ["npm:payperscreen-mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:co.pentatrail/ctem", "name": "PentaTrail CTEM", "kind": "mcp", "official": null, "desc": "PentaTrail ASM/CTEM: attack surface discovery, asset inventory, findings by threat level", "repo": null, "install": ["https://api.pentatrail.co/mcp"], "stars": null, "pushed": null, "license": null, "plat": "pentatrail", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.entradox/perimeter-watch-scanner", "name": "Perimeter Watch", "kind": "mcp", "official": null, "desc": "Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools", "repo": "https://github.com/entradox/perimeter-watch-scanner", "install": ["https://perimeter-watch-api-production.up.railway.app/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "perimeter watch", "live": "Live · 1472 ms · 6 tools · free to try: `pw_watch_status` answered without a key (checked 2026-11-13)"}, {"id": "mcp:app.theona/person-enrichment", "name": "Person Enrichment", "kind": "mcp", "official": null, "desc": "Identify a person from partial information and return a profile with a confidence score per field.", "repo": null, "install": ["https://api.theona.ai/mcp/person-enrichment"], "stars": null, "pushed": null, "license": null, "plat": "person enrichment", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Project-Gifted1/pg1-threat-intel", "name": "PG1 Sovereign Threat Intelligence", "kind": "mcp", "official": null, "desc": "Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.", "repo": "https://github.com/Project-Gifted1/pg1-ai-agent", "install": ["https://pg1-ai-agent.vercel.app/api/mcp"], "stars": 0, "pushed": "2026-11-12T09:42:55Z", "license": "NOASSERTION", "plat": "", "live": "Down · HTTP 402 (checked 2026-11-13)"}, {"id": "mcp:io.github.Br0ski777/pii-detector", "name": "PII Detector API", "kind": "mcp", "official": null, "desc": "Detect PII in text: emails, phones, SSNs, credit cards, IPs. Regex + Luhn. x402.", "repo": "https://github.com/Br0ski777/pii-detector-x402", "install": ["https://pii-detector.api.klymax402.com/mcp"], "stars": 0, "pushed": "2026-09-02T19:57:01Z", "license": "MIT", "plat": "", "live": "Down · URLError: <urlopen error [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1082)> (checked 2026-11-13)"}, {"id": "mcp:club.pilotex/kyc", "name": "Pilotex KYC", "kind": "mcp", "official": null, "desc": "KYC verification on autopilot for Bybit, MEXC and Bitget. 150 countries, pay per result.", "repo": null, "install": ["https://pilotex.club/mcp"], "stars": null, "pushed": null, "license": null, "plat": "pilotex kyc", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.julian-martin89/pkg-oracle", "name": "pkg-oracle — Dependency Trust Oracle", "kind": "mcp", "official": null, "desc": "Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.", "repo": null, "install": ["https://mcp-snowy-dew-9447.fly.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 819 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:co.youraitools/pkgguard", "name": "PkgGuard", "kind": "mcp", "official": null, "desc": "Dependency scan for agents: known CVEs and malicious packages via OSV.dev. By Crypto Money Maker", "repo": null, "install": ["npm:@agentgate-builder/pkgguard", "https://api.youraitools.co/pkgguard/mcp"], "stars": null, "pushed": null, "license": null, "plat": "agent", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.HoneyBearTech/plex-director-mcp", "name": "Plex Director", "kind": "mcp", "official": null, "desc": "Ask about and manage your own Plex, Radarr, Sonarr, Prowlarr and download clients.", "repo": "https://github.com/HoneyBearTech/plex-director-mcp", "install": ["oci:docker.io/honeybeartech/plex-director-mcp:1.4.0"], "stars": 0, "pushed": "2026-11-12T23:14:08Z", "license": "MIT", "plat": "legal documents", "live": "Not checked (runs locally)"}, {"id": "mcp:com.portscan/port-scanner", "name": "Port Scanner API", "kind": "mcp", "official": null, "desc": "Scan the open TCP ports of your own public IP. Fast (32) or deep (65535). No key, no signup.", "repo": null, "install": ["https://api.portscan.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1584 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.pourdev/pour", "name": "pour", "kind": "mcp", "official": null, "desc": "WCAG 2.2 accessibility audits for agents: findings, focus order and page screenshots.", "repo": "https://github.com/pourdev/pour-cli", "install": ["npm:pour-cli"], "stars": null, "pushed": null, "license": null, "plat": "wcag 2.2 accessibility audits", "live": "Not checked (runs locally)"}, {"id": "mcp:agency.kesey/pretrip", "name": "Pre-Trip compliance scanner", "kind": "mcp", "official": null, "desc": "Screen regulated-health marketing copy against source-cited rulesets, all 50 states.", "repo": null, "install": ["npm:pretrip-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.allthepossibles/preflight", "name": "Preflight", "kind": "mcp", "official": null, "desc": "Scans an MCP server for security gaps before your agent connects. Free tier, no signup.", "repo": null, "install": ["https://preflight.allthepossibles.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 929 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.dainidude/preflight", "name": "Preflight", "kind": "mcp", "official": null, "desc": "Pay-per-call smart-contract security: scans, tx simulation, and token risk via x402 (USDC on Base).", "repo": "https://github.com/dainidude/preflight-x402", "install": ["https://preflight--preflight-api-mcp.modal.run/mcp"], "stars": 0, "pushed": "2026-11-13T23:39:03Z", "license": "MIT", "plat": "base", "live": "Live · 3952 ms · 4 tools · `preflight_check` asked for payment (checked 2026-11-14)"}, {"id": "mcp:io.github.josediegorobles/preflight-checks", "name": "Preflight Checks (x402)", "kind": "mcp", "official": null, "desc": "Deterministic pre-execution verification tools for AI agents with x402 USDC pay-per-call on Base", "repo": "https://github.com/josediegorobles/preflight-x402", "install": ["npm:@joserobles/preflight-mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:xyz.canisell/prescan", "name": "Prescan", "kind": "mcp", "official": null, "desc": "Agent security pre-checks: prompt-injection scan, MCP tool-poisoning scan, x402 endpoint check.", "repo": null, "install": ["https://prescan.canisell.xyz/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1561 ms · 6 tools · free to try: `about` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.probe402/probe402-check", "name": "probe402-check", "kind": "mcp", "official": null, "desc": "Ask probe402's public record about an x402 or MPP endpoint before an agent pays it.", "repo": "https://github.com/probe402/probe402-check", "install": ["npm:probe402-check"], "stars": 0, "pushed": "2026-10-01T14:07:30Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.oroboros-design.angel/prompt-sanitizer", "name": "Prompt Sanitizer — prompt-injection scan for untrusted content", "kind": "mcp", "official": null, "desc": "Scan web pages, mails, PDFs and tool output for prompt injection before your agent reads them.", "repo": "https://github.com/daoudandiaye98-alt/mcp-prompt-sanitizer", "install": ["https://angel.oroboros-design.com/mcp/prompt-sanitizer"], "stars": null, "pushed": null, "license": null, "plat": "prompt sanitizer", "live": "Live · 973 ms · 3 tools (checked 2026-11-15)"}, {"id": "mcp:com.proofoftype/input", "name": "Proof of Type Input", "kind": "mcp", "official": null, "desc": "Add a text box that proves a human typed it, not AI. Code for any framework; verify proof tokens.", "repo": "https://github.com/yogev77/proofoftype-input", "install": ["https://www.proofoftype.com/mcp"], "stars": 0, "pushed": "2026-10-11T21:16:40Z", "license": "MIT", "plat": "", "live": "Live · 1050 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.eason4kim-rocket/purify-feeds-mcp", "name": "Purify Security Feeds", "kind": "mcp", "official": null, "desc": "Query CISA KEV / EPSS vulnerability feeds with full per-record provenance and auditable versions", "repo": "https://github.com/eason4kim-rocket/purify-feeds-mcp", "install": ["oci:ghcr.io/eason4kim-rocket/purify-feeds-mcp:1.0.1"], "stars": 0, "pushed": "2026-07-09T09:52:47Z", "license": "MIT", "plat": "cisa", "live": "Not checked (runs locally)"}, {"id": "mcp:coffee.pwned/pwned-coffee", "name": "pwned.coffee", "kind": "mcp", "official": null, "desc": "Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks.", "repo": null, "install": ["https://pwned.coffee/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1485 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.renaat-s/pyresec-agent", "name": "PYRESEC - AI Code Security Auditing", "kind": "mcp", "official": null, "desc": "AI code security audits via x402 USDC: $0.01 scans, $0.50 audits, $5 auto-fixes. SAST/SCA.", "repo": "https://github.com/renaat-s/pyresec-agent", "install": ["https://pyresec-agent-519576377065.us-central1.run.app/mcp"], "stars": 0, "pushed": "2026-11-04T15:06:19Z", "license": "MIT", "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.github.quantumsequrity/qnsqy", "name": "QNSQY", "kind": "mcp", "official": null, "desc": "Linux only, local: post-quantum CBOM scan, encrypt to public keys, verify. Takes no secrets", "repo": null, "install": ["npm:qnsqy"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Evozim/quantum-shield", "name": "Quantum-Shield", "kind": "mcp", "official": null, "desc": "Post-quantum cryptographic library protecting data packets.", "repo": null, "install": ["https://quantum-shield-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 766 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:com.quietfailures/quiet-failures", "name": "Quiet Failures", "kind": "mcp", "official": null, "desc": "Open weekly security base rates (CC BY 4.0), plus live DMARC, takeover and WHOIS checks.", "repo": null, "install": ["https://mcp.quietfailures.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 3113 ms · 6 tools · free to try: `list_base_rates` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Tristan-tech-ai/quiver-risk-brain", "name": "Quiver Risk Brain", "kind": "mcp", "official": null, "desc": "Verifiable, deterministic risk math for autonomous agents; re-runnable proof on every answer.", "repo": null, "install": ["https://quiver-production-c3a8.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "quiver risk brain", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:com.redthreadsec/redthread", "name": "Redthread", "kind": "mcp", "official": null, "desc": "Attack paths, scan findings and shadow AI for AI-native apps and their clouds; vet MCP servers.", "repo": null, "install": ["https://app.redthreadsec.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.regsentry/tracking-inspector", "name": "RegSentry Website Tracking Inspector", "kind": "mcp", "official": null, "desc": "Inspect authorized website tracking, compare consent observations, and get remediation guidance.", "repo": null, "install": ["https://regsentry.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1341 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:com.regulane/compliance", "name": "Regulane compliance check", "kind": "mcp", "official": null, "desc": "Check code against secure-coding rules mapped to ISO 27001 and the DPDP Act. Free, no account.", "repo": "https://github.com/siddhantmallah/regulane-agent-plugin", "install": ["https://regulane.com/api/mcp"], "stars": 0, "pushed": "2026-10-26T17:21:36Z", "license": "MIT", "plat": "", "live": "Live · 3025 ms · 2 tools · free to try: `get_compliance_rules` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.R2Rlabs/hyperliquid-reins", "name": "Reins", "kind": "mcp", "official": null, "desc": "Risk limits and an audit log for AI agents trading Hyperliquid, enforced outside the model.", "repo": "https://github.com/R2Rlabs/reins", "install": ["npm:@r2rlabs/reins"], "stars": 0, "pushed": "2026-10-02T18:08:57Z", "license": "MIT", "plat": "reins", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nzdsf2-gif/relayshield-free-mcp", "name": "RelayShield Scam Checks", "kind": "mcp", "official": null, "desc": "Free scam checks for links, wallets, emails, and breach exposure. No signup.", "repo": null, "install": ["https://relayshieldadmin-relayshield-free-mcp.hf.space/mcp"], "stars": null, "pushed": null, "license": null, "plat": "relayshield", "live": "Live · 1187 ms · 4 tools · free to try: `check_email` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.nzdsf2-gif/relayshield-mcp", "name": "RelayShield Security Intelligence", "kind": "mcp", "official": null, "desc": "Breach, SIM swap, infostealer, domain lookalikes, MCP registry risk, prompt-injection detection.", "repo": "https://github.com/relayshield/relayshield-mcp", "install": ["pypi:relayshield-mcp"], "stars": 0, "pushed": "2026-11-11T01:23:40Z", "license": null, "plat": "relayshield", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.eltociear/repo-security-scanner", "name": "Repo Security Scanner — Malicious Code & Supply Chain", "kind": "mcp", "official": null, "desc": "Audit GitHub repos for malicious and supply-chain code before you depend on them.", "repo": "https://github.com/eltociear/my-molt-agent", "install": ["https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.resetparatodos/verifica", "name": "RESET Verifica", "kind": "mcp", "official": null, "desc": "Deterministic Mexican/LatAm verification + sanctions & PEP screening for AI agents. Pay via x402.", "repo": null, "install": ["https://mcp.resetparatodos.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "reset verifica", "live": "Live · 1731 ms · 29 tools · `screening_listas` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.robersonai/roberson", "name": "Roberson", "kind": "mcp", "official": null, "desc": "Likeness rights, cleared: a use of a person's face, voice or persona, checked against their terms.", "repo": null, "install": ["https://mcp.robersonai.com/workspace/mcp"], "stars": null, "pushed": null, "license": null, "plat": "roberson", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.rowattest/rowattest", "name": "RowAttest", "kind": "mcp", "official": null, "desc": "Runs an eight-stage isolation test against your staging Supabase and issues a signed attestation.", "repo": null, "install": ["https://app.rowattest.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "rowattest", "live": "Live · 934 ms · 7 tools · `list_projects` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:ru.scanbase/scanbase", "name": "ru.scanbase/scanbase", "kind": "mcp", "official": null, "desc": "Website compliance checks for Russian personal data law 152-FZ: score, violations, fix instructions.", "repo": null, "install": ["npm:scanbase-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.raphaelbgr/rugshield", "name": "RugShield", "kind": "mcp", "official": null, "desc": "Solana checks and free panel quote via MCP; paid parallel advisor panel via HTTP. USDC x402.", "repo": null, "install": ["https://getrugshield.com/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 999 ms · 5 tools (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-rust-security-crate-vulnerability", "name": "Rust Crate Security Advisories — buy per-query in-session (rustsecwatch)", "kind": "mcp", "official": null, "desc": "Rust crate vulns: CVEs, patched versions. $0.01/query. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/rustsecwatch-rustsec-crate-security-advisories-0f9271/http"], "stars": null, "pushed": null, "license": null, "plat": "rust crates", "live": "Live · 1666 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:dev.rosti/rosti", "name": "Rösti Threat Intel", "kind": "mcp", "official": null, "desc": "Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev", "repo": null, "install": ["https://mcp.rosti.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "rösti threat intel", "live": "Live · 3656 ms · 11 tools · free to try: `list_sources` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.workers.safe-or-scam.scam-check/safe-or-scam", "name": "Safe or Scam", "kind": "mcp", "official": null, "desc": "Crypto scam checks (tokens, sites, wallets), chain reads, web page to Markdown, email checks.", "repo": null, "install": ["https://scam-check.safe-or-scam.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2468 ms · 8 tools · free to try: `check_website` answered without a key (checked 2026-11-13)"}, {"id": "mcp:sh.safeguard/safeguard", "name": "Safeguard", "kind": "mcp", "official": null, "desc": "Software supply chain security: SBOMs, vulnerabilities, fixes, policies and compliance data.", "repo": null, "install": ["https://mcp.safeguard.sh/mcp"], "stars": null, "pushed": null, "license": null, "plat": "safeguard", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.safetoclone/safetoclone", "name": "SafeToClone", "kind": "mcp", "official": null, "desc": "Safety grade (A to F) for any public GitHub repo, in plain English, before you install it.", "repo": null, "install": ["https://safetoclone.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Live · 2036 ms · 2 tools · free to try: `get_safety_scores` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Jugmaster/said-protocol", "name": "SAID Protocol", "kind": "mcp", "official": null, "desc": "Check a Solana wallet before you pay it, a token before you buy it. Agent identity and reputation.", "repo": "https://github.com/SAID-Protocol/said-api", "install": ["https://api.saidprotocol.com/mcp"], "stars": 0, "pushed": "2026-11-10T19:30:52Z", "license": null, "plat": "solana", "live": "Live · 1272 ms · 3 tools · free to try: `check_token` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.macaroonnetwork/sanctions-pep-screening-v1", "name": "Sanctions & PEP Screening", "kind": "mcp", "official": null, "desc": "Screen a name in one call against US OFAC SDN, the EU Consolidated Financial Sanctions List, UK…", "repo": "https://github.com/kevmoz/macaroonnetwork-mcp", "install": ["pypi:macaroonnetwork-mcp-sanctions-pep-screening-v1"], "stars": 0, "pushed": "2026-09-16T13:23:28Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.fairquery/sanctions-watchlist-screener", "name": "Sanctions Screening (OFAC, EU, UK, UN)", "kind": "mcp", "official": null, "desc": "Fuzzy-screen people and company names against OFAC SDN, EU, UK and UN sanctions lists.", "repo": "https://github.com/fairquery/sanctions-watchlist-screener", "install": ["https://mcp.apify.com/?tools=fetch-actor-details,fairquery/sanctions-watchlist-screener"], "stars": null, "pushed": null, "license": null, "plat": "ofac", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.mcpsbom/sbom-mcp", "name": "SBOMApp - SBOM Generator & Vulnerability Scanner", "kind": "mcp", "official": null, "desc": "Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.", "repo": "https://github.com/mcpsbom/sbomapp-mcp-server", "install": ["https://mcp.sbomapp.com/mcp"], "stars": 0, "pushed": "2026-02-27T12:52:32Z", "license": null, "plat": "git repos", "live": "Down · URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issue (checked 2026-11-13)"}, {"id": "mcp:nl.scamchecker/scamchecker", "name": "Scamchecker.nl", "kind": "mcp", "official": null, "desc": "Check a suspicious email, SMS, WhatsApp message or link for scam signals (Netherlands, Belgium).", "repo": "https://github.com/smrht/scamchecker-mcp", "install": ["https://scamchecker.nl/mcp"], "stars": 0, "pushed": "2026-10-15T06:57:55Z", "license": "NOASSERTION", "plat": "scamchecker.nl", "live": "Live · 538 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:ai.scamverify/mcp", "name": "ScamVerify Threat Verification", "kind": "mcp", "official": null, "desc": "AI-powered scam and threat verification for phone numbers, URLs, texts, and emails.", "repo": "https://github.com/scamverifyai/scamverify-ai", "install": ["https://scamverify.ai/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:com.scanlabsai/scanner", "name": "ScanLabsAI Security Scanner", "kind": "mcp", "official": null, "desc": "Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes", "repo": null, "install": ["npm:@scanlabsai/mcp-server", "https://scanlabsai.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.scannd/scannd", "name": "Scannd", "kind": "mcp", "official": null, "desc": "Trigger security scans and read reports/vulnerabilities via the hosted Scannd API. Free: 2 scans/mo.", "repo": "https://github.com/zachforrest/webscannerio", "install": ["npm:scannd-mcp"], "stars": null, "pushed": null, "license": null, "plat": "scannd", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Misterio070/scanpay", "name": "ScanPay — Code Security Oracle", "kind": "mcp", "official": null, "desc": "Deterministic code security scan + tx preflight, paid in USDC via x402.", "repo": "https://github.com/Misterio070/scanpay", "install": ["https://scanpay-ob3w.onrender.com/mcp", "https://scanpay-ob3w.onrender.com/sse"], "stars": 0, "pushed": "2026-10-28T14:32:26Z", "license": null, "plat": "", "live": "Live · 789 ms · 7 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Varpost/scout", "name": "Scout Security", "kind": "mcp", "official": null, "desc": "Deterministic, zero-token security scanner your AI agent calls to find and re-verify issues.", "repo": "https://github.com/Varpost/Scout", "install": ["pypi:scout-security"], "stars": 0, "pushed": "2026-10-14T03:19:02Z", "license": null, "plat": "scout security", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.williamblakecunningham-max/screenverity-mcp", "name": "ScreenVerity", "kind": "mcp", "official": null, "desc": "Free U.S. exclusion, debarment and licence screening with a signed receipt of the lists checked.", "repo": "https://github.com/williamblakecunningham-max/screenverity-mcp", "install": ["npm:screenverity-mcp"], "stars": 0, "pushed": "2026-08-26T00:44:13Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.sealsecurity/mcp", "name": "Seal Security", "kind": "mcp", "official": null, "desc": "Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports.", "repo": null, "install": ["https://mcp.sealsecurity.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "seal security", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.2cstudiodev-web/sealguard", "name": "SealGuard", "kind": "mcp", "official": null, "desc": "Check Solana wallets and transactions for risky approvals and scam tokens; find SOL to take back.", "repo": "https://github.com/2cstudiodev-web/sealguard", "install": ["https://guard.2cstudio.app/mcp"], "stars": 0, "pushed": "2026-11-13T05:44:55Z", "license": "MIT", "plat": "solana", "live": "Live · 813 ms · 4 tools · `check_transaction` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:pro.sebbi/governance", "name": "sebbi.pro - the proof layer for AI", "kind": "mcp", "official": null, "desc": "Prove AI decisions in Bitcoin: 755 compliance checks, bank fraud proof, AI payment checks. Free.", "repo": null, "install": ["https://sebbi.pro/mcp"], "stars": null, "pushed": null, "license": null, "plat": "bitcoin", "live": "Live · 1045 ms · 20 tools · free to try: `sebbi_find_checks` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.SecondedOracle/seconded-mcp", "name": "SECONDED", "kind": "mcp", "official": null, "desc": "The oracle for agents. Verify trades, tokens and messages before your agent acts.", "repo": null, "install": ["mcpb:https://github.com/SecondedOracle/seconded-mcp-releases/releases/download/v0.4.5/seconded-mcp_0.4.5.mcpb"], "stars": null, "pushed": null, "license": null, "plat": "seconded", "live": "Not checked (runs locally)"}, {"id": "mcp:us.secscan/secscan", "name": "SecScan", "kind": "mcp", "official": null, "desc": "Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.", "repo": null, "install": ["https://secscan.us/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "web app", "live": "Live · 1153 ms · 12 tools · `get_account` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/section508", "name": "Section 508 Evidence MCP", "kind": "mcp", "official": null, "desc": "WCAG + Section 508 audits that produce the deliverable federal buyers actually require", "repo": null, "install": [], "stars": null, "pushed": null, "license": null, "plat": "wcag", "live": "Not checked (runs locally)"}, {"id": "mcp:com.securealy/mcp", "name": "Securealy", "kind": "mcp", "official": null, "desc": "Grade a URL as an attacker and a customer would see it; scan a repo; check Supabase, Stripe, Vercel.", "repo": "https://github.com/securealy/securealy", "install": ["npm:securealy-mcp"], "stars": 0, "pushed": "2026-10-24T00:40:03Z", "license": "Apache-2.0", "plat": "supabase", "live": "Not checked (runs locally)"}, {"id": "mcp:il.co.sentinelone-edr/securecloud", "name": "SecureCloud", "kind": "mcp", "official": null, "desc": "SentinelOne EDR and IT security services in Israel: catalog, prices, quotes and checkout links.", "repo": null, "install": ["https://www.sentinelone-edr.co.il/mcp"], "stars": null, "pushed": null, "license": null, "plat": "sentinelone", "live": "Live · 2276 ms · 7 tools · free to try: `list_products` answered without a key (checked 2026-11-15)"}, {"id": "mcp:icu.secureit/security-checks", "name": "secureIT Sicherheits-Checks", "kind": "mcp", "official": null, "desc": "Kostenlose Sicherheits-Checks ohne Konto: SPF/DKIM/DMARC, Mails, Links, Webseiten, Passwort-Leaks.", "repo": null, "install": ["https://secureit.icu/mcp"], "stars": null, "pushed": null, "license": null, "plat": "secureit sicherheits-checks", "live": "Live · 3731 ms · 17 tools · free to try: `passwort_leak_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.securenow/securenow", "name": "SecureNow", "kind": "mcp", "official": null, "desc": "Production security for Node.js apps: investigate live attacks, block IPs, tune detections.", "repo": "https://github.com/securenow-ai/securenow-npm", "install": ["npm:securenow", "https://api.securenow.ai/mcp"], "stars": 0, "pushed": "2026-04-14T17:59:16Z", "license": "ISC", "plat": "node.js", "live": "Not checked (runs locally)"}, {"id": "mcp:online.securestamp/action-proof", "name": "SecureStamp Action Proof — Cross-Cloud Public Beta (Unverified)", "kind": "mcp", "official": null, "desc": "UNVERIFIED: cross-cloud beta; sandbox by default; production opt-in via customer Guardian.", "repo": "https://github.com/sergioortizlatorre2/securestamp", "install": ["npm:@securestamp/execution-guardian-mcp", "https://mcp.securestamp.online/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/security-feeds", "name": "Security Feeds", "kind": "mcp", "official": null, "desc": "Security Feeds MCP.", "repo": "https://github.com/pipeworx-io/mcp-security-feeds", "install": ["npm:@pipeworx/mcp-security-feeds", "https://gateway.pipeworx.io/security-feeds/mcp"], "stars": 0, "pushed": "2026-11-09T14:40:21Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.datakoot/cve-vulnerability-lookup", "name": "Security Intel MCP", "kind": "mcp", "official": null, "desc": "CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.", "repo": "https://github.com/datakoot/security-intel-mcp", "install": ["https://security.datakoot.com/mcp"], "stars": 0, "pushed": "2026-10-24T06:27:37Z", "license": "MIT", "plat": "", "live": "Live · 593 ms · 5 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.selflabbs/security-intel-mcp", "name": "Security Intel MCP", "kind": "mcp", "official": null, "desc": "CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.", "repo": "https://github.com/selflabbs/security-intel-mcp", "install": ["https://security.selflabbs.com/mcp"], "stars": 0, "pushed": "2026-10-24T06:27:37Z", "license": "MIT", "plat": "nvd, osv", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.varvararatta/security_mcp", "name": "Security Mcp", "kind": "mcp", "official": null, "desc": "MCP server for Security", "repo": "https://github.com/varvararatta/botfactory-mcp", "install": ["https://security-mcp.mcpize.run/mcp"], "stars": 0, "pushed": "2026-07-27T16:15:17Z", "license": null, "plat": "", "live": "Down · ValueError: {'code': -32603, 'message': 'Internal error', 'data': 'failed to read from stdout: EOF'} (checked 2026-11-13)"}, {"id": "mcp:net.apisecurityscan/securityscan", "name": "SecurityScan", "kind": "mcp", "official": null, "desc": "Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.", "repo": "https://github.com/securityscan-api/securityscan-api", "install": ["https://apisecurityscan.net/mcp"], "stars": null, "pushed": null, "license": null, "plat": "github", "live": "Live · 1269 ms · 8 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/securitytrails", "name": "Securitytrails", "kind": "mcp", "official": null, "desc": "SecurityTrails MCP — wraps SecurityTrails API (securitytrails.com)", "repo": "https://github.com/pipeworx-io/mcp-securitytrails", "install": ["npm:@pipeworx/mcp-securitytrails", "https://gateway.pipeworx.io/securitytrails/mcp"], "stars": 0, "pushed": "2026-11-09T14:40:23Z", "license": "MIT", "plat": "securitytrails", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ovladon/seenrelay", "name": "SeenRelay", "kind": "mcp", "official": null, "desc": "Avoid redundant expensive validation. CHECK recent evidence; OBSERVE fresh independent results.", "repo": "https://github.com/ovladon/seenrelay", "install": ["https://seenrelay.com/mcp"], "stars": 0, "pushed": "2026-11-09T05:43:24Z", "license": "NOASSERTION", "plat": "", "live": "Live · 865 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:ai.sekura/sekura", "name": "Sekura", "kind": "mcp", "official": null, "desc": "Scan a GitHub repository for vulnerabilities, with proof for every finding, from your coding agent.", "repo": "https://github.com/sekuraai/sekura-plugins", "install": ["https://sekura.ai/mcp"], "stars": 0, "pushed": "2026-11-08T01:55:04Z", "license": "MIT", "plat": "github", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Cope-Labs/selvo", "name": "selvo", "kind": "mcp", "official": null, "desc": "Linux CVE prioritisation: 16 MCP tools for scan, fleet, runtime, and PR-able fix discovery.", "repo": "https://github.com/Cope-Labs/selvo", "install": ["pypi:selvo"], "stars": null, "pushed": null, "license": null, "plat": "linux", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/sentinelone-mcp", "name": "SentinelOne (Purple)", "kind": "mcp", "official": null, "desc": "Multitenant Streamable HTTP wrapper for the SentinelOne purple-mcp server.", "repo": "https://github.com/WYRE-AI/sentinelone-mcp", "install": ["oci:ghcr.io/wyre-ai/sentinelone-mcp:v1.0.11"], "stars": 0, "pushed": "2026-11-12T16:54:24Z", "license": "Apache-2.0", "plat": "sentinelone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/sentinelone-mcp", "name": "SentinelOne (Purple)", "kind": "mcp", "official": null, "desc": "Multitenant Streamable HTTP wrapper for the SentinelOne purple-mcp server.", "repo": "https://github.com/wyre-technology/sentinelone-mcp", "install": ["oci:ghcr.io/wyre-technology/sentinelone-mcp:v1.0.6"], "stars": 0, "pushed": "2026-11-12T16:54:24Z", "license": "Apache-2.0", "plat": "sentinelone", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.maxgerhardson/sentrik", "name": "Sentrik", "kind": "mcp", "official": null, "desc": "Governance runtime for AI-generated code. Enforce compliance and security standards.", "repo": "https://github.com/maxgerhardson/sentrik-community", "install": ["npm:sentrik"], "stars": 0, "pushed": "2026-07-22T23:07:11Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.sentrint/sentrint", "name": "Sentrint", "kind": "mcp", "official": null, "desc": "Code security scanner for founders and small teams: leaked secrets, missing RLS, injection, CVEs", "repo": null, "install": ["https://sentrint.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "sentrint", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/seon", "name": "Seon", "kind": "mcp", "official": null, "desc": "SEON MCP — wraps the SEON fraud / digital-footprint enrichment APIs (seon.io)", "repo": "https://github.com/pipeworx-io/mcp-seon", "install": ["npm:@pipeworx/mcp-seon", "https://gateway.pipeworx.io/seon/mcp"], "stars": 0, "pushed": "2026-11-09T14:41:10Z", "license": "MIT", "plat": "seon", "live": "Not checked (runs locally)"}, {"id": "mcp:com.testedtemplates/ops-guardrails", "name": "Server and secret guardrails", "kind": "mcp", "official": null, "desc": "Local checks for sudo, systemd, sshd, ufw, and secret leaks before an agent applies them.", "repo": null, "install": ["https://testedtemplates.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1133 ms · 4 tools · free to try: `sample_findings` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.serverscan/mcp", "name": "ServerScan", "kind": "mcp", "official": null, "desc": "PCI ASV scan prices, SAQ check, free payment page check, PCI guides and scan-failure fixes.", "repo": null, "install": ["https://www.serverscan.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1223 ms · 6 tools · free to try: `search_guides` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.setlatch/setlatch", "name": "SetLatch", "kind": "mcp", "official": null, "desc": "Privacy requests (DSARs) for every site you run: triage, app look-ups, tasks and the audit trail.", "repo": null, "install": ["https://setlatch.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "setlatch", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.ceadigital/agent-compliance-notary", "name": "SHA-256 Hash-Chained AI Agent Compliance & Decision Notary", "kind": "mcp", "official": null, "desc": "Tamper-evident SHA-256 hash-chained decision notary for EU AI Act, NIST AI RMF & SOC2.", "repo": null, "install": ["https://ceadigital.io/mcp/notary"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1183 ms · 28 tools · `fdic_bank_health` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.saagpatel/shadow-mcp", "name": "shadow-mcp", "kind": "mcp", "official": null, "desc": "Local MCP server that inventories and risk-grades MCP servers configured on this machine.", "repo": "https://github.com/saagpatel/shadow-mcp", "install": ["pypi:shadow-mcp"], "stars": 0, "pushed": "2026-11-08T12:33:45Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:com.uxcontinuum/ship-check", "name": "Ship Check", "kind": "mcp", "official": null, "desc": "Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.", "repo": null, "install": ["https://uxcontinuum.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2439 ms · 12 tools · free to try: `list_services` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.shiplatch/scanner", "name": "ShipLatch", "kind": "mcp", "official": null, "desc": "Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers", "repo": null, "install": ["https://shiplatch.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "shiplatch", "live": "Live · 1832 ms · 3 tools · free to try: `list_checks` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Egarter/shippable", "name": "Shippable", "kind": "mcp", "official": null, "desc": "Find leaks in AI-built apps: open Supabase/Firebase data, exposed keys, unsafe edge functions", "repo": null, "install": ["npm:shippable-dev"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:co.ship-safe/scanner", "name": "ShipSafe — Independent security verification", "kind": "mcp", "official": null, "desc": "Independent security review for AI-built apps: exposed secrets, broken auth, unsafe data access.", "repo": null, "install": ["npm:@ship-safe/mcp", "https://ship-safe.co/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:online.huxin/signcheck", "name": "SigLint — HTTP Message Signature Doctor", "kind": "mcp", "official": null, "desc": "RFC 9421 / Web Bot Auth signature doctor: per-check verdicts, digest, freshness, signed receipt.", "repo": null, "install": ["https://huxin.online/signcheck/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 4461 ms · 2 tools (checked 2026-11-15)"}, {"id": "mcp:io.github.whitestone1121-web/signalbrain", "name": "SignalBrain", "kind": "mcp", "official": null, "desc": "Verifiable receipts for governed process changes; emit, validate, and gate trust", "repo": "https://github.com/whitestone1121-web/signalbrain", "install": ["pypi:signalbrain"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/sigstore-rekor", "name": "Sigstore Rekor", "kind": "mcp", "official": null, "desc": "Sigstore Rekor — the public transparency log for software signatures.", "repo": "https://github.com/pipeworx-io/mcp-sigstore-rekor", "install": ["npm:@pipeworx/mcp-sigstore-rekor", "https://gateway.pipeworx.io/sigstore-rekor/mcp"], "stars": 0, "pushed": "2026-11-09T14:42:03Z", "license": "MIT", "plat": "sigstore rekor", "live": "Not checked (runs locally)"}, {"id": "mcp:com.skanqrcode/mcp-server", "name": "SkanQRCode", "kind": "mcp", "official": null, "desc": "Check whether a URL or IP is safe before an AI agent fetches or opens it.", "repo": "https://github.com/Skanqrcode/sdk-examples", "install": ["npm:@skanqrcode/mcp-server"], "stars": 0, "pushed": "2026-10-07T15:02:21Z", "license": "Apache-2.0", "plat": "skanqrcode", "live": "Not checked (runs locally)"}, {"id": "mcp:com.skillssafe/scanner", "name": "SkillsSafe Security Scanner", "kind": "mcp", "official": null, "desc": "AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.", "repo": "https://github.com/GUCCI-atlasv/Skillssafe.com", "install": ["npm:skillssafe-mcp", "https://mcp.skillssafe.com/sse"], "stars": 0, "pushed": "2026-03-13T04:31:48Z", "license": "MIT", "plat": "skillssafe security scanner", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.ygfalcon/solana-wallet-intel", "name": "Solana Wallet Intel", "kind": "mcp", "official": null, "desc": "Solana wallet risk and intel, x402 USDC pay-per-call (Cloudflare host).", "repo": null, "install": ["https://solana-wallet-intel.falcon-sol.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "solana", "live": "Live · 4193 ms · 12 tools · `token_trending` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.sovrnti/graph", "name": "Sovrnti MCP", "kind": "mcp", "official": null, "desc": "Headless benchmarks for digital sovereignty, scored on Innovation, Control and Scale.", "repo": "https://github.com/sovrnti/sovrnti-mcp", "install": ["https://graph.sovrnti.io/mcp"], "stars": 0, "pushed": "2026-10-07T13:10:57Z", "license": "MIT", "plat": "sovrnti", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:space.gensi.bc/aegis-security-mcp", "name": "space.gensi.bc/aegis-security-mcp", "kind": "mcp", "official": null, "desc": "AI scam-shield for Web3: screen token contracts for honeypot/drain patterns. Aegis AI group admin.", "repo": null, "install": ["https://bc.gensi.space/mcp"], "stars": null, "pushed": null, "license": null, "plat": "web3", "live": "Live · 3103 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:dev.spec72/spec72", "name": "Spec72", "kind": "mcp", "official": null, "desc": "Human-reviewed security certificates and ops audits for AI agent skills, paid per job.", "repo": null, "install": ["https://spec72.dev/api/a2a/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 390 ms · 9 tools (checked 2026-11-14)"}, {"id": "mcp:com.spun/whatsapp", "name": "Spun WhatsApp MCP", "kind": "mcp", "official": null, "desc": "Free WhatsApp MCP server for ChatGPT and Claude: read and search chats, every send you approve.", "repo": null, "install": ["https://api.spun.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "spurvik eu ai act", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.spurvik/spurvik-mcp-server", "name": "Spurvik", "kind": "mcp", "official": null, "desc": "EU AI Act Art. 50, 12 & 14 setup snippets, unwrapped-call scan, HMAC receipt & marking hooks.", "repo": "https://github.com/spurvik/spurvik", "install": ["npm:spurvik-mcp-server", "https://console.spurvik.com/api/mcp"], "stars": 0, "pushed": "2026-11-13T03:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cabbageandtea/sqlguard", "name": "SQLGuard — Execution Certificate Firewall", "kind": "mcp", "official": null, "desc": "Permission before writes. Gravity→DENYs→Session $0.25. Pilot $100; Gateway $299. Probe free.", "repo": "https://github.com/cabbageandtea/sqlguard", "install": ["https://sqlguard.io/mcp", "https://sqlguard-io.fly.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1175 ms · 24 tools (checked 2026-11-13)"}, {"id": "mcp:com.powmcp/ssl-certificate-check", "name": "SSL Certificate Check", "kind": "mcp", "official": null, "desc": "Inspect one endpoint's served certificate, expiry, hostname coverage, and accepted TLS versions.", "repo": "https://github.com/powmcp/mcp-server-guide", "install": ["https://powmcp.com/ssl-certificate-check/mcp"], "stars": 0, "pushed": "2026-09-22T18:59:15Z", "license": "MIT", "plat": "", "live": "Live · 1119 ms · 1 tools · free to try: `ssl_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Br0ski777/ssl-checker", "name": "SSL Checker API", "kind": "mcp", "official": null, "desc": "SSL certificate check — validity, expiry, issuer, chain, grade. x402 micropayment.", "repo": "https://github.com/Br0ski777/ssl-checker-x402", "install": ["https://ssl-checker.api.klymax402.com/mcp"], "stars": 0, "pushed": "2026-09-02T19:57:29Z", "license": "MIT", "plat": "", "live": "Down · URLError: <urlopen error [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1082)> (checked 2026-11-13)"}, {"id": "mcp:eu.stacklegal/catalog", "name": "StackLégal", "kind": "mcp", "official": null, "desc": "GDPR provider fiches and a static cookie scan before consent.", "repo": null, "install": ["https://stacklegal.eu/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1249 ms · 3 tools · free to try: `list_providers` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.stackshield/stackshield", "name": "StackShield", "kind": "mcp", "official": null, "desc": "External security monitoring for Laravel apps: list domains, trigger scans, read issues and fixes.", "repo": null, "install": ["https://stackshield.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "laravel", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.theluckystrike/subdomain-finder-mcp", "name": "Subdomain Finder MCP", "kind": "mcp", "official": null, "desc": "Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.", "repo": "https://github.com/theluckystrike/subdomain-finder-mcp", "install": ["https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-03T07:33:43Z", "license": "MIT", "plat": "certspotter, crt.sh", "live": "Live · 3447 ms · 4 tools · free to try: `get_certificate_history` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.gosummer/summer", "name": "Summer", "kind": "mcp", "official": null, "desc": "Telehealth support for Claude, Codex and Cursor: investigate cases and connect your tools.", "repo": "https://github.com/compound-technologies/summer-mcp", "install": ["https://api.gosummer.ai/mcp"], "stars": 0, "pushed": "2026-11-03T00:42:12Z", "license": "MIT", "plat": "summer", "live": "Live · 2216 ms · 235 tools · `summer_cases_get` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:world.swampai/swamp", "name": "Swamp", "kind": "mcp", "official": null, "desc": "An open habitat where security agents register themselves, work in public, and rerun each other.", "repo": "https://github.com/allisonbit/bug-protocol", "install": ["https://www.swampai.world/api/mcp"], "stars": 0, "pushed": "2026-09-23T21:32:56Z", "license": null, "plat": "swamp", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:io.tenova/swt3-witness", "name": "SWT3 AI Witness", "kind": "mcp", "official": null, "desc": "Cryptographic AI governance and audit. 75 tools, 98 frameworks. EU AI Act, NIST, CMMC, MCP Top 10.", "repo": "https://github.com/tenova-labs/swt3-ai", "install": ["npm:@tenova/swt3-mcp"], "stars": 0, "pushed": "2026-11-10T04:01:50Z", "license": "Apache-2.0", "plat": "ai governance", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AIops-tools/symantec-clouddlp-aiops", "name": "Symantec Cloud DLP AIops", "kind": "mcp", "official": null, "desc": "Governed Symantec Cloud DLP — 14 MCP tools, read-only with audit.", "repo": "https://github.com/AIops-tools/Symantec-CloudDLP-AIops", "install": ["pypi:symantec-clouddlp-aiops"], "stars": 0, "pushed": "2026-11-06T08:30:32Z", "license": "MIT", "plat": "symantec cloud dlp", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AIops-tools/symantec-dcs-aiops", "name": "Symantec Data Center Security AIops", "kind": "mcp", "official": null, "desc": "Governed Symantec DCS operations — 35 MCP tools, read-only with audit.", "repo": "https://github.com/AIops-tools/Symantec-DCS-AIops", "install": ["pypi:symantec-dcs-aiops"], "stars": 0, "pushed": "2026-11-06T08:28:08Z", "license": "MIT", "plat": "symantec dcs", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AIops-tools/symantec-ztna-aiops", "name": "Symantec ZTNA AIops", "kind": "mcp", "official": null, "desc": "Governed Symantec ZTNA operations — 40 MCP tools, read-only with audit.", "repo": "https://github.com/AIops-tools/Symantec-ZTNA-AIops", "install": ["pypi:symantec-ztna-aiops"], "stars": 0, "pushed": "2026-11-06T08:24:40Z", "license": "MIT", "plat": "symantec ztna", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/telivy-mcp", "name": "Telivy", "kind": "mcp", "official": null, "desc": "MCP server for Telivy's security assessment API for MSPs.", "repo": "https://github.com/WYRE-AI/telivy-mcp", "install": ["oci:ghcr.io/wyre-ai/telivy-mcp:v1.0.1"], "stars": 0, "pushed": "2026-11-12T17:02:04Z", "license": "NOASSERTION", "plat": "telivy", "live": "Not checked (runs locally)"}, {"id": "mcp:com.teollimi/teollimi", "name": "Teollimi", "kind": "mcp", "official": null, "desc": "Data breaches in Korea, Japan, the US and beyond with sources, open settlements and what to do.", "repo": null, "install": ["https://teollimi.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2938 ms · 5 tools · free to try: `search_breaches` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.profullstack/threatcrush", "name": "threatcrush", "kind": "mcp", "official": null, "desc": "Reputation + security findings (threatcrush.com)", "repo": null, "install": ["https://threatcrush.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "security findings", "live": "Live · 680 ms · 20 tools · `list_invites` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/threatfox", "name": "Threatfox", "kind": "mcp", "official": null, "desc": "ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)", "repo": "https://github.com/pipeworx-io/mcp-threatfox", "install": ["npm:@pipeworx/mcp-threatfox", "https://gateway.pipeworx.io/threatfox/mcp"], "stars": 0, "pushed": "2026-11-09T14:47:12Z", "license": "MIT", "plat": "threatfox", "live": "Not checked (runs locally)"}, {"id": "mcp:nz.tier1.mcp/it-assessment", "name": "Tier1 IT Assessment", "kind": "mcp", "official": null, "desc": "Read-only IT Health Check, domain security, recommendations, pricing, and draft enquiries.", "repo": null, "install": ["https://mcp.tier1.nz/mcp"], "stars": null, "pushed": null, "license": null, "plat": "tier1 it assessment", "live": "Live · 3213 ms · 8 tools · free to try: `get_it_health_check_questions` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.ralf9090/token-honeypot-audit-mcp", "name": "Token Honeypot & EVM Pre-Flight Audit MCP", "kind": "mcp", "official": null, "desc": "Token honeypot detector, 360 rug-pull audit, EVM transaction simulator & OFAC compliance MCP.", "repo": "https://github.com/ralf9090/token-honeypot-audit-mcp", "install": ["https://agent-kiosk.vercel.app/mcp"], "stars": 0, "pushed": "2026-11-11T23:26:51Z", "license": "MIT", "plat": "", "live": "Live · 2856 ms · 24 tools · free to try: `compliance_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.julian-martin89/token-oracle", "name": "token-oracle — Token Trust Oracle", "kind": "mcp", "official": null, "desc": "Flags fake/mismatched token contract addresses and hallucinated supply figures before you trade.", "repo": null, "install": ["https://token-oracle.fly.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1458 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.TollWire/evidence-mcp", "name": "TollWire Evidence", "kind": "mcp", "official": null, "desc": "Tamper-evident log of agent changes, scans and approvals with draft ISO 27001/NIS2 control mapping.", "repo": "https://github.com/TollWire/tollwire", "install": ["npm:@tollwire/evidence-mcp"], "stars": 0, "pushed": "2026-11-06T22:22:10Z", "license": "NOASSERTION", "plat": "agent changes", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.tookeffect/tookeffect", "name": "TookEffect", "kind": "mcp", "official": null, "desc": "Independent effect verification and signed receipts for consequential AI agent actions.", "repo": null, "install": ["https://tookeffect.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/tool-guardian", "name": "Tool-Guardian-Proxy", "kind": "mcp", "official": null, "desc": "Safety execution proxy protecting clients during tool calls.", "repo": null, "install": ["https://tool-guardian-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1090 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:cv.touchstone/touchstone", "name": "Touchstone", "kind": "mcp", "official": null, "desc": "Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.", "repo": "https://github.com/Touchstone-CV/touchstone-mcp", "install": ["npm:@touchstone-cv/mcp", "https://touchstone.cv/mcp"], "stars": 0, "pushed": "2026-09-03T09:51:59Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:run.raised.traceproof/traceproof", "name": "Traceproof", "kind": "mcp", "official": null, "desc": "Search security findings and contribute versioned, evidence-backed reproduction reports.", "repo": null, "install": ["https://traceproof.raised.run/mcp"], "stars": null, "pushed": null, "license": null, "plat": "traceproof", "live": "Live · 3636 ms · 12 tools · free to try: `search_findings` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.TrigGuard-AI/trigguard", "name": "TrigGuard", "kind": "mcp", "official": null, "desc": "Deterministic execution authorization for AI agents and automated systems.", "repo": "https://github.com/TrigGuard-AI/TrigGuard", "install": ["npm:@trigguard/mcp"], "stars": null, "pushed": null, "license": null, "plat": "trigguard", "live": "Not checked (runs locally)"}, {"id": "mcp:to.trustmebro/trust-me-bro", "name": "Trust Me Bro", "kind": "mcp", "official": null, "desc": "Fact-check receipts: search published claim verdicts with cited evidence, or verify a new claim.", "repo": null, "install": ["https://trustmebro.to/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1350 ms · 5 tools · free to try: `search_receipts` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Br0ski777/trust-score", "name": "Trust Score API", "kind": "mcp", "official": null, "desc": "Trust scoring for domains, wallets, APIs. SSL+DNS+WHOIS+headers. Score 0-100.", "repo": "https://github.com/Br0ski777/trust-score-x402", "install": ["https://trust-score.api.klymax402.com/mcp"], "stars": 0, "pushed": "2026-09-02T19:57:49Z", "license": "MIT", "plat": "", "live": "Down · URLError: <urlopen error [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1082)> (checked 2026-11-13)"}, {"id": "mcp:io.github.paul-salviani/trust-switchboard", "name": "Trust Switchboard", "kind": "mcp", "official": null, "desc": "Read public privacy policies: dated source excerpts, follow-up questions and change comparisons.", "repo": "https://github.com/paul-salviani/trust-switchboard", "install": ["https://170.64.146.185.sslip.io/mcp"], "stars": 0, "pushed": "2026-10-28T12:36:56Z", "license": "MIT", "plat": "privacy policies", "live": "Down · HTTP 502 (checked 2026-11-13)"}, {"id": "mcp:io.trust-agent/trustagent-mcp", "name": "TrustAgent — counterparty verification", "kind": "mcp", "official": null, "desc": "Is this address safe to pay? OFAC sanctions, ERC-8004 reputation, contract analysis.", "repo": "https://github.com/MichalStachnik/trust-agent", "install": ["npm:trustagent-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.trusteed-io/trusteed-mcp", "name": "Trusteed", "kind": "mcp", "official": null, "desc": "CTEM for your Trusteed tenant: security summary, findings, compliance gaps, and scans via OAuth.", "repo": "https://github.com/trusteed-io/trusteed-mcp-plugin", "install": ["https://mcp.trusteed.io/mcp"], "stars": 0, "pushed": "2026-07-17T04:42:12Z", "license": "NOASSERTION", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.trustifi.be/trustifi", "name": "Trustifi", "kind": "mcp", "official": null, "desc": "Investigate and manage email security across Trustifi plans using AI.", "repo": null, "install": ["https://be.trustifi.com/api/i/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "trustifi", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.entradox/trust-scan", "name": "TrustScan", "kind": "mcp", "official": null, "desc": "Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.", "repo": "https://github.com/entradox/trust-scan", "install": ["https://trust-scan-production.up.railway.app/mcp/"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1074 ms · 4 tools · free to try: `skills_list_tool` answered without a key (checked 2026-11-13)"}, {"id": "mcp:dev.tuvio/tuvio", "name": "Tuvio", "kind": "mcp", "official": null, "desc": "Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.", "repo": null, "install": ["https://api.tuvio.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.SUNDRAM07/txwhy", "name": "TxWhy", "kind": "mcp", "official": null, "desc": "Failed Solana transaction in, working transaction out. Exact cause, rebuilt tx, verifiable repair.", "repo": null, "install": ["https://txwhy.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "solana", "live": "Live · 840 ms · 3 tools (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-ubuntu-security-linux-vulnerability", "name": "Ubuntu Security Notices / USN (usnwatch) — buy per-query in-session", "kind": "mcp", "official": null, "desc": "Ubuntu security: USNs per CVE, patched versions. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/usnwatch-ubuntu-security-notices-usn-c06aa6/http"], "stars": null, "pushed": null, "license": null, "plat": "ubuntu", "live": "Live · 1786 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:uk.co.reliness/dev-security", "name": "UK Data: CVEs and package popularity", "kind": "mcp", "official": null, "desc": "Software vulnerabilities (CVEs) from the US NVD and package downloads for npm, PyPI and crates", "repo": null, "install": ["https://ukdata.reliness.co.uk/mcp/dev-security"], "stars": null, "pushed": null, "license": null, "plat": "us nvd", "live": "Live · 1656 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.donniertf-hub/uk-sanctions-screen-mcp", "name": "UK Sanctions Screening MCP", "kind": "mcp", "official": null, "desc": "Screen names vs the UK Sanctions List (FCDO/OFSI) plus OFAC crypto address checks.", "repo": "https://github.com/donniertf-hub/uk-mcp-fleet", "install": ["https://uk-sanctions-screen-mcp.donniertf.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-09T13:17:25Z", "license": null, "plat": "uk sanctions screening", "live": "Live · 875 ms · 12 tools · `lei_lookup` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.texWoW/unripe", "name": "unripe", "kind": "mcp", "official": null, "desc": "Check how long ago a package version was published before an agent adds it, in 20 ecosystems.", "repo": "https://github.com/TexWoW/unripe", "install": ["pypi:unripe"], "stars": 0, "pushed": "2026-11-12T17:21:48Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.julian-martin89/url-oracle", "name": "url-oracle — URL Trust Oracle", "kind": "mcp", "official": null, "desc": "Flags phantom-squatted/typosquatted domains and known-malicious URLs before an agent follows them.", "repo": null, "install": ["https://url-oracle.fly.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1141 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.ceadigital/cisa-kev-exploited-vulns", "name": "US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit", "kind": "mcp", "official": null, "desc": "US CISA Known Exploited Vulnerabilities (KEV) catalog & active ransomware campaign check.", "repo": null, "install": ["https://ceadigital.io/mcp/cisa-kev"], "stars": null, "pushed": null, "license": null, "plat": "cisa", "live": "Live · 1227 ms · 28 tools · `fdic_bank_health` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.donniertf-hub/us-epa-compliance-mcp", "name": "US EPA Compliance Check MCP", "kind": "mcp", "official": null, "desc": "EPA compliance, violations, inspections and penalties for any US ZIP code or company.", "repo": "https://github.com/donniertf-hub/uk-mcp-fleet", "install": ["https://us-epa-compliance-mcp.donniertf.workers.dev/mcp"], "stars": 0, "pushed": "2026-11-09T13:17:25Z", "license": null, "plat": "epa", "live": "Live · 1415 ms · 3 tools · free to try: `facility_search` answered without a key (checked 2026-11-13)"}, {"id": "mcp:us.recalert/mcp", "name": "us.recalert/mcp", "kind": "mcp", "official": null, "desc": "Search U.S. product recalls (CPSC, FDA, NHTSA, FSIS) by product, brand, model, or UPC code.", "repo": null, "install": ["https://ajlswjtsikbnpicienyu.supabase.co/functions/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "web app", "live": "Live · 2117 ms · 6 tools · free to try: `get_data_notes` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.eddyflores100-lang/uta-shield", "name": "uta-shield", "kind": "mcp", "official": null, "desc": "Provider-side MCP firewall: identity, threat-intel, barter, rate limits, DLP, audit.", "repo": "https://github.com/eddyflores100-lang/uta-shield", "install": ["npm:uta-shield"], "stars": 0, "pushed": "2026-10-27T20:12:11Z", "license": "NOASSERTION", "plat": "uta-shield", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.eddyflores100-lang/uta-shield-remote", "name": "uta-shield Remote (Barter-enabled)", "kind": "mcp", "official": null, "desc": "Remote MCP firewall with barter protocol: identity, threat-intel, IoC lookup.", "repo": "https://github.com/eddyflores100-lang/uta-shield", "install": ["https://wall.utalabs.tech/mcp"], "stars": 0, "pushed": "2026-10-27T20:12:11Z", "license": "NOASSERTION", "plat": "uta-shield", "live": "Down · HTTP 405 (checked 2026-11-13)"}, {"id": "mcp:io.github.MaverickHQ/valvur", "name": "valvur", "kind": "mcp", "official": null, "desc": "Offline security scanning for AI-generated code: seven open-source scanners in one MCP server.", "repo": "https://github.com/MaverickHQ/valvur", "install": ["pypi:valvur"], "stars": 0, "pushed": "2026-11-12T07:22:34Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Ghostkey316/vaultfire", "name": "Vaultfire Trust Protocol", "kind": "mcp", "official": null, "desc": "On-chain trust verification and Street Cred for AI agents. ERC-8004, multi-chain.", "repo": "https://github.com/Ghostkey316/vaultfire-mcp-server", "install": ["npm:@vaultfire/mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "blockchain", "live": "Not checked (runs locally)"}, {"id": "mcp:com.velliumandco/lab", "name": "Vellium & Co Testing Lab", "kind": "mcp", "official": null, "desc": "Independent checks of paid x402 data sellers and of AI-agent access to shopping and travel sites", "repo": null, "install": ["https://velliumandco.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vellium & co testing lab", "live": "Live · 5914 ms · 9 tools · free to try: `check_website` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.getverdict-ai/verdict", "name": "Verdict — Compliance for AI-Generated Code", "kind": "mcp", "official": null, "desc": "Compliance verdicts for AI-generated code. SOC 2, HIPAA, HITRUST for healthcare IT.", "repo": "https://github.com/getverdict-ai/releases", "install": ["mcpb:https://github.com/getverdict-ai/releases/releases/download/v0.3.0/verdict-mcp.mcpb"], "stars": 0, "pushed": "2026-03-21T17:32:13Z", "license": null, "plat": "ai-generated code", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nrupala/verdict", "name": "Verdict — Send anything. Get the truth.", "kind": "mcp", "official": null, "desc": "Send anything. Get the truth — REAL, SUSPICIOUS or LIKELY SCAM verdicts on messages and links.", "repo": "https://github.com/nrupala/verdict-filings", "install": ["https://verdict.aimlds.org/mcp"], "stars": 0, "pushed": "2026-11-07T01:52:51Z", "license": "Apache-2.0", "plat": "messages and links", "live": "Live · 1922 ms · 3 tools · free to try: `check_message` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.agenttoolworks/verifydesk", "name": "VerifyDesk", "kind": "mcp", "official": null, "desc": "Verify French and UK companies, EU VAT and IBANs; screen OFAC, UN, EU and UK sanctions lists.", "repo": "https://github.com/agenttoolworks/mcp-servers", "install": ["https://verifydesk.agenttoolworks.com/mcp"], "stars": 0, "pushed": "2026-10-01T12:45:30Z", "license": null, "plat": "ai agents", "live": "Live · 2021 ms · 6 tools · `get_usage` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.simulacra/verifyfirst", "name": "verifyfirst", "kind": "mcp", "official": null, "desc": "Look up what your verification method cannot see: 48 failures that report success.", "repo": "https://github.com/simulacra/verifyfirst", "install": ["pypi:verifyfirst-mcp"], "stars": 0, "pushed": "2026-08-24T13:28:28Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.verifygrid/b2b-compliance-verifier", "name": "VerifyGrid B2B Compliance & Entity Verification", "kind": "mcp", "official": null, "desc": "Sub-50ms verification for FMCSA USDOT/MC, CMS NPI, OFAC/OIG/SAM sanctions, and TCPA phone risk.", "repo": "https://github.com/drewTuzson/verifygrid-mcp", "install": ["https://www.verifygrid.io/mcp"], "stars": 0, "pushed": "2026-11-04T08:49:36Z", "license": "NOASSERTION", "plat": "verifygrid", "live": "Live · 888 ms · 10 tools · free to try: `check_account_balance` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.SecondShotAI/verifylite", "name": "VerifyLite", "kind": "mcp", "official": null, "desc": "Verify before you pay or act: site, transaction, token and injection checks for agents. x402 USDC.", "repo": null, "install": ["https://verifylite.hydratinghealingtouch.workers.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "verifylite", "live": "Live · 1305 ms · 40 tools · `ip_info` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.vet402/vet402", "name": "vet402", "kind": "mcp", "official": null, "desc": "Before your agent pays an x402 URL, see whether vet402 paid it and got the content back.", "repo": "https://github.com/kzmttkc/vet402-plugin", "install": ["https://vet402.com/mcp"], "stars": 0, "pushed": "2026-10-28T10:53:45Z", "license": "MIT", "plat": "", "live": "Live · 700 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.Ranqint/vibescale", "name": "VibeScale", "kind": "mcp", "official": null, "desc": "For app builders in Israel: pre-launch checks for leaked keys, Supabase RLS, exposed env vars.", "repo": null, "install": ["https://vibe.elya-studio.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "supabase", "live": "Live · 763 ms · 3 tools · free to try: `scan_app_launch_readiness` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.vigilon/mcp", "name": "Vigilon", "kind": "mcp", "official": null, "desc": "Read production error groups, traces, job runs and insights from Vigilon. Read-only, OAuth sign-in.", "repo": null, "install": ["https://mcp.vigilon.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vigilon", "live": "Responds, sign-in needed (checked 2026-11-14)"}, {"id": "mcp:vip.witnessd/witnessd", "name": "vip.witnessd/witnessd", "kind": "mcp", "official": null, "desc": "Neutral third-party witness: independently fetch, hash, timestamp, archive any URL or API response.", "repo": "https://github.com/jschunter/witnessd-mcp", "install": ["npm:witnessd-mcp"], "stars": 0, "pushed": "2026-10-27T01:25:42Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.qompass/vongola", "name": "Vongola", "kind": "mcp", "official": null, "desc": "Read-only operator instrumentation for the vongola TLS gateway.", "repo": "https://github.com/qompassai/vongola", "install": ["mcpb:https://github.com/qompassai/vongola/releases/download/v0.2.0/vongola-mcp-0.2.0-linux-x64.mcpb"], "stars": 0, "pushed": "2026-11-03T12:50:55Z", "license": "Apache-2.0", "plat": "vongola", "live": "Not checked (runs locally)"}, {"id": "mcp:com.profullstack/vu1nz", "name": "vu1nz", "kind": "mcp", "official": null, "desc": "Vulnerability intel (vu1nz.com)", "repo": null, "install": ["https://vu1nz.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vulnerability intel", "live": "Live · 1030 ms · 12 tools · `list_webhooks` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:now.vulnerable/mcp", "name": "vulnerable.now", "kind": "mcp", "official": null, "desc": "Free CVE lookups, package checks and patch priorities from public sources. No account or API key.", "repo": null, "install": ["https://vulnerable.now/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1777 ms · 8 tools · free to try: `get_package` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.infai-tech/vulnfeed", "name": "VulnFeed", "kind": "mcp", "official": null, "desc": "Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402.", "repo": "https://github.com/infai-tech/vulnfeed-mcp", "install": ["pypi:vulnfeed-mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.owenkingva-web/vulnhunt", "name": "VulnHunt Security Intelligence", "kind": "mcp", "official": null, "desc": "Read-only smart-contract security intelligence for autonomous agents.", "repo": null, "install": ["https://vulnhunt-agent-api-production.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:ai.vulx/watch", "name": "VulX Watch", "kind": "mcp", "official": null, "desc": "Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.", "repo": "https://github.com/NgoTomek/vulx-watch-cursor", "install": ["https://mcp.vulx.ai/mcp"], "stars": 0, "pushed": "2026-09-01T02:30:45Z", "license": "MIT", "plat": "vulx watch", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.wallettriage/wallettriage-mcp", "name": "WalletTriage", "kind": "mcp", "official": null, "desc": "Real-time exploit-exposure risk check for EVM wallets, paid per query via x402 (USDC on Base).", "repo": "https://github.com/wallettriage/wallettriage-mcp", "install": ["npm:wallettriage-mcp"], "stars": 0, "pushed": "2026-07-08T20:04:22Z", "license": null, "plat": "evm", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Wh-bi/wanhe-compliance", "name": "Wanhe Compliance — Chinese Content Compliance Checker", "kind": "mcp", "official": null, "desc": "Chinese content compliance: ad-law banned terms + AI labeling; offline local.", "repo": "https://github.com/Wh-bi/wanhe-compliance-mcp", "install": [], "stars": 0, "pushed": "2026-11-11T14:54:15Z", "license": "MIT", "plat": "wanhe compliance", "live": "Not checked (runs locally)"}, {"id": "mcp:com.wardzo/wardzo", "name": "Wardzo", "kind": "mcp", "official": null, "desc": "Scan and monitor websites for leaked keys, exposed files, security headers, SEO issues and uptime.", "repo": null, "install": ["https://wardzo.com/mcp/account", "https://wardzo.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "websites", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.OxToF/watchdog-mcp", "name": "Watchdog", "kind": "mcp", "official": null, "desc": "Who can change a Solana program or EVM contract, dependency advisories, scans. Paid per call (x402).", "repo": "https://github.com/OxToF/watchdog-mcp", "install": ["npm:watchdog-mcp"], "stars": 0, "pushed": "2026-10-15T08:54:42Z", "license": "MIT", "plat": "solana, evm", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WCAG-Compliance/mcp", "name": "wcagc — accessibility scanning", "kind": "mcp", "official": null, "desc": "Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.", "repo": "https://github.com/WCAG-Compliance/wcagc-mcp", "install": ["npm:@wcagc/mcp", "https://mcp.wcagc.com/mcp"], "stars": 0, "pushed": "2026-11-09T16:29:10Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vwnb/wcgw.world", "name": "WCGW Safety Suite - Functional Safety Requirements and Traceability MCP Server", "kind": "mcp", "official": null, "desc": "Manage functional-safety requirements and lifecycle traceability.", "repo": null, "install": ["https://wcgw-safety-suite.vercel.app/wcgwmcp"], "stars": null, "pushed": null, "license": null, "plat": "wcgw", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.RafaCoelho33/web3-systemic-agent", "name": "Web3 Systemic Agent", "kind": "mcp", "official": null, "desc": "Web3 security & DAO auditor: free bytecode/honeypot/Snapshot tools + x402 Gemini LLM deep audit.", "repo": "https://github.com/RafaCoelho33/web3-systemic-agent", "install": ["https://web3-systemic-agent.onrender.com/mcp"], "stars": 0, "pushed": "2026-11-12T01:16:43Z", "license": "Apache-2.0", "plat": "web3", "live": "Live · 626 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:works.mima/governance-mcp", "name": "works.mima/governance-mcp", "kind": "mcp", "official": null, "desc": "AI governance evidence for EU AI Act, ISO 42001, SOC 2, and NIST AI RMF.", "repo": "https://github.com/mimaworks/governance-mcp", "install": ["npm:@mima-ai/governance-mcp"], "stars": 0, "pushed": "2026-07-05T14:17:30Z", "license": null, "plat": "works.mima", "live": "Not checked (runs locally)"}, {"id": "mcp:com.wphealthkit/mcp-server", "name": "WP HealthKit", "kind": "mcp", "official": null, "desc": "Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.", "repo": "https://github.com/BuiltByGo/wphealthkit-mcp", "install": ["npm:@wphealthkit/mcp-server", "https://mcp.wphealthkit.com/mcp"], "stars": 0, "pushed": "2026-08-07T17:43:51Z", "license": "MIT", "plat": "wordpress", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.forgemeshlabs/x402-notary-mcp", "name": "x402 Notary MCP", "kind": "mcp", "official": null, "desc": "Cryptographic receipts for AI outputs on Base or Solana via x402.", "repo": "https://github.com/forgemeshlabs/x402-notary-mcp", "install": ["npm:@forgemeshlabs/x402-notary-mcp"], "stars": 0, "pushed": "2026-11-01T13:57:18Z", "license": "MIT", "plat": "forgemesh", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.6mickswagger9/x402-risk-mcp", "name": "x402-risk-mcp", "kind": "mcp", "official": null, "desc": "x402 paid API for AI agents. USDC on Base. CDP facilitator.", "repo": "https://github.com/6mickswagger9/x402-risk-mcp", "install": ["npm:x402-risk-mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.6mickswagger9/x402-scan-audit", "name": "x402-scan-audit", "kind": "mcp", "official": null, "desc": "x402 paid API for AI agents. USDC on Base. CDP facilitator.", "repo": "https://github.com/6mickswagger9/x402-scan-audit", "install": ["npm:x402-scan-audit"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.6mickswagger9/x402-scan-mcp", "name": "x402-scan-mcp", "kind": "mcp", "official": null, "desc": "x402 paid API for AI agents. USDC on Base. CDP facilitator.", "repo": "https://github.com/6mickswagger9/x402-scan-mcp", "install": ["npm:x402-scan-mcp"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.6mickswagger9/x402-sec-scan", "name": "x402-sec-scan", "kind": "mcp", "official": null, "desc": "x402 paid API for AI agents. USDC on Base. CDP facilitator.", "repo": "https://github.com/6mickswagger9/x402-sec-scan", "install": ["npm:x402-sec-scan"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.6mickswagger9/x402-vuln", "name": "x402-vuln", "kind": "mcp", "official": null, "desc": "x402 paid API for AI agents. USDC on Base. CDP facilitator.", "repo": "https://github.com/6mickswagger9/x402-vuln", "install": ["npm:x402-vuln"], "stars": null, "pushed": null, "license": null, "plat": "x402", "live": "Not checked (runs locally)"}, {"id": "mcp:tech.xfa/xfa", "name": "XFA device security", "kind": "mcp", "official": null, "desc": "XFA device security, read-only: which devices pass their checks or have known vulnerabilities.", "repo": "https://github.com/gl-ventures/xfa-mcp", "install": ["https://mcp.xfa.tech/mcp"], "stars": 0, "pushed": "2026-11-12T10:37:38Z", "license": "MIT", "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.moelayyan90/xguard", "name": "XGuard Live", "kind": "mcp", "official": null, "desc": "Read current software facts with primary-source evidence and verification timestamps.", "repo": "https://github.com/moelayyan90/XGuard", "install": ["https://xguardgate.com/mcp"], "stars": 0, "pushed": "2026-11-12T07:38:21Z", "license": "NOASSERTION", "plat": "", "live": "Live · 1855 ms · 18 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.bgage72590/xploitscan-mcp", "name": "XploitScan", "kind": "mcp", "official": null, "desc": "Security scanner for AI-generated code. 30 free rules; all 223 with a paid-plan API key.", "repo": null, "install": ["npm:xploitscan-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/xposedornot", "name": "Xposedornot", "kind": "mcp", "official": null, "desc": "XposedOrNot MCP — free breach-exposure lookup by email.", "repo": "https://github.com/pipeworx-io/mcp-xposedornot", "install": ["npm:@pipeworx/mcp-xposedornot", "https://gateway.pipeworx.io/xposedornot/mcp"], "stars": 0, "pushed": "2026-11-06T20:58:12Z", "license": "MIT", "plat": "xposedornot", "live": "Not checked (runs locally)"}, {"id": "mcp:io.cyberxyz/xyz-mcp", "name": "xyz MCP by CyberXYZ", "kind": "mcp", "official": null, "desc": "Package verdicts for AI coding agents: check npm, PyPI, Go and NuGet installs before they run.", "repo": null, "install": ["https://mcp.cyberxyz.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cyberxyz", "live": "Live · 3952 ms · 5 tools · free to try: `check_package` answered without a key (checked 2026-11-14)"}, {"id": "mcp:io.github.AddyCuber/ybe-check", "name": "Ybe Check", "kind": "mcp", "official": null, "desc": "Ybe Check – security and compliance orchestrator for AI-generated repositories.", "repo": "https://github.com/AddyCuber/A2K2-PS1", "install": ["pypi:ybe-check"], "stars": null, "pushed": null, "license": null, "plat": "ai-generated repositories", "live": "Not checked (runs locally)"}, {"id": "mcp:com.ysaere/mcp", "name": "Ysaere", "kind": "mcp", "official": null, "desc": "Four agent jobs: Vendor KYB, SAM Contractor Check, Sanctions/Wallet Screen, Notary Receipt.", "repo": null, "install": ["https://mcp.ysaere.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ysaere", "live": "Live · 735 ms · 22 tools · `vault_search` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:cloud.nttzen.secdb/zen-secdb", "name": "ZEN SecDB", "kind": "mcp", "official": null, "desc": "ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.", "repo": null, "install": ["https://secdb.nttzen.cloud/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 23264 ms · 23 tools · free to try: `package_info` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.Evozim/zeroknowledge-vault", "name": "ZeroKnowledge-Vault", "kind": "mcp", "official": null, "desc": "Zero-knowledge proof validator and cryptographic locker.", "repo": null, "install": ["https://zeroknowledge-vault-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 456 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.theluckystrike/dependency-audit", "name": "Zovo Dependency Audit", "kind": "mcp", "official": null, "desc": "Audit a dependency list for known vulnerabilities, licenses and outdated versions.", "repo": null, "install": ["https://dependency-audit.zovo.one/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 889 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:com.zyphe/zyphe-mcp", "name": "Zyphe", "kind": "mcp", "official": null, "desc": "Run KYB and AML case reviews and configure Zyphe verification flows, forms and API keys.", "repo": null, "install": ["https://api.zyphe.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:jp.domain-bannin/domain-bannin", "name": "ドメイン番人", "kind": "mcp", "official": null, "desc": "ドメインの設定を調べる MCP サーバー。SPF / DKIM / DMARC・DNS・SSL 証明書・セキュリティヘッダ・サブドメイン・類似ドメインを、公開情報だけで確認します。登録不要・無料。", "repo": null, "install": ["https://domain-bannin.jp/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "domain configuration checks", "live": "Live · 2060 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.gooonamee/short-mcp", "name": "好縮 Short", "kind": "mcp", "official": null, "desc": "Smart URL shortener: create, tag and track short links on s.gooo.name.", "repo": null, "install": ["https://short.gooo.name/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2723 ms · 11 tools · `list_my_links` asked for an API key (checked 2026-11-13)"}]