MCP servers and skills: search, filter by where they run, and compare.
Defense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256).
Node.jsMITFew starsNo key
Deliberately vulnerable MCP server (aka MCP Goat) for security training — 26 challenges across 4 difficulty levels (incl. a secure reference), a victim-agent harness, and one-command Docker deploy. Pr
SkillMIT★ 11No key
🕵️ Scans MCP servers for injection with 30+ canonical detection rules across 5 severity levels (April 2026 MCP RCE class). MIT.
PythonMITFew starsNo key
SkillSync MCP — security-gated skill management for Claude Code, OpenClaw, Cursor & Windsurf. 60+ threat pattern scanner.
SkillMIT★ 4Few starsNo key
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE
Node.jsMITFew starsNo key
Security scanner for MCP servers and AI agents — detects credential leaks, RCE, SSRF and missing auth against OWASP AISVS 1.0; also scans published JS bundles/npm packages.
Node.jsMITFew starsNo key
Open-source zero-trust proxy for MCP servers — adds OAuth 2.1, tool-level RBAC, audit logging, and rate limiting to any MCP server. One Docker command, zero code changes.
GoMIT★ 4Few starsNo key
Scan, Score, Install MCP Servers with confidence. The missing toolkit for the MCP ecosystem.
PythonMIT★ 1Few starsNo key
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-s
Node.jsMITFew starsNo key
MCP server that gives AI assistants (Claude, Codex, Cursor, Opencode) SSH access to run commands, transfer files, and manage server fleets
PythonMPL-2.0★ 4Few starsNo key
AgentGate — scan, lock, and gate your MCP servers. npm-audit + lockfile + CI drift gate for the MCP era.
SkillApache-2.0Few starsNo key
Who stands behind it
