Explore
MCP servers and skills: search, filter by where they run, and compare.
mcp-implementation-security-reviewgithub
Local
MCP servers and skills: search, filter by where they run, and compare.
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, input-schema validation
OfficialSkillMIT★ 40k in collectionNo key
Automated security scanner for Model Context Protocol servers that detects RCE, path traversal, prompt injection, and protocol vulnerabilities.
SkillMIT★ 31No key
Reclaim DRAM by disabling unused subsystems across MB1 BCT, MB2 BCT, kernel reserved-memory, and SWIOTLB. Use for headless or no-camera Jetson deployments; not for CPU/GPU frequency tuning.
OfficialSkillApache-2.0★ 3.6k in collectionNo key
AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust
PythonAGPL-3.0★ 1.0kNo key
AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️
Node.jsMIT★ 1.3kNo key
Turn any LLM into an autonomous pentester. You define the scope, the agent does the work, you review the findings.
SkillAGPL-3.0★ 497No key
Offensive MCP server auditor: detects tool poisoning, credential leaks, RCE vectors, SSRF, session hijacking, and supply chain vulnerabilities across stdio, HTTP, and SSE transports.
Node.jsMIT★ 24No key
Trust nothing. Ship safely. — Skeptical-reading and prompt-injection defense skill for AI agents. Provenance tagging, red-flag patterns, refusal templates, and a read-only injection auditor. MIT.
SkillMIT★ 42No key
Defense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256).
Node.jsMITFew starsNo key
An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI
PythonMIT★ 27No key
Deliberately vulnerable MCP server (aka MCP Goat) for security training — 26 challenges across 4 difficulty levels (incl. a secure reference), a victim-agent harness, and one-command Docker deploy. Pr
SkillMIT★ 11No key
🕵️ Scans MCP servers for injection with 30+ canonical detection rules across 5 severity levels (April 2026 MCP RCE class). MIT.
PythonMITFew starsNo key
A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licens
SkillCC-BY-4.0★ 42No key
SkillSync MCP — security-gated skill management for Claude Code, OpenClaw, Cursor & Windsurf. 60+ threat pattern scanner.
SkillMIT★ 4Few starsNo key
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE
Node.jsMITFew starsNo key
Multi-registry skill discovery and installation for AI coding agents — search 9 sources, score, paginate, and install agent skills with security labels
SkillMIT★ 30No key
Real-Time Military-Grade Line-by-Line Code Sanitizer & Security Shield for AI Agents
Node.jsApache-2.0Few starsNo key
Security scanner for MCP servers and AI agents — detects credential leaks, RCE, SSRF and missing auth against OWASP AISVS 1.0; also scans published JS bundles/npm packages.
Node.jsMITFew starsNo key
Open-source zero-trust proxy for MCP servers — adds OAuth 2.1, tool-level RBAC, audit logging, and rate limiting to any MCP server. One Docker command, zero code changes.
GoMIT★ 4Few starsNo key
Node.jsMITFew starsNo key
Scan, Score, Install MCP Servers with confidence. The missing toolkit for the MCP ecosystem.
PythonMIT★ 1Few starsNo key
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-s
Node.jsMITFew starsNo key
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security work
SkillMIT★ 788No key
Who stands behind it
