MCP servers and skills: search, filter by where they run, and compare.
Automated security scanner for Model Context Protocol servers that detects RCE, path traversal, prompt injection, and protocol vulnerabilities.
SkillMIT★ 31No key
Reclaim DRAM by disabling unused subsystems across MB1 BCT, MB2 BCT, kernel reserved-memory, and SWIOTLB. Use for headless or no-camera Jetson deployments; not for CPU/GPU frequency tuning.
OfficialSkillApache-2.0★ 3.6k in collectionNo key
Offensive MCP server auditor: detects tool poisoning, credential leaks, RCE vectors, SSRF, session hijacking, and supply chain vulnerabilities across stdio, HTTP, and SSE transports.
Node.jsMIT★ 24No key
Defense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256).
Node.jsMITFew starsNo key
An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI
PythonMIT★ 27No key
Deliberately vulnerable MCP server (aka MCP Goat) for security training — 26 challenges across 4 difficulty levels (incl. a secure reference), a victim-agent harness, and one-command Docker deploy. Pr
SkillMIT★ 11No key
🕵️ Scans MCP servers for injection with 30+ canonical detection rules across 5 severity levels (April 2026 MCP RCE class). MIT.
PythonMITFew starsNo key
SkillSync MCP — security-gated skill management for Claude Code, OpenClaw, Cursor & Windsurf. 60+ threat pattern scanner.
SkillMIT★ 4Few starsNo key
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE
Node.jsMITFew starsNo key
Security scanner for MCP servers and AI agents — detects credential leaks, RCE, SSRF and missing auth against OWASP AISVS 1.0; also scans published JS bundles/npm packages.
Node.jsMITFew starsNo key
Open-source zero-trust proxy for MCP servers — adds OAuth 2.1, tool-level RBAC, audit logging, and rate limiting to any MCP server. One Docker command, zero code changes.
GoMIT★ 4Few starsNo key
Scan, Score, Install MCP Servers with confidence. The missing toolkit for the MCP ecosystem.
PythonMIT★ 1Few starsNo key
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-s
Node.jsMITFew starsNo key
A collection of public writeups on attacks against AI agents: prompt injection, tool abuse, memory poisoning, and data exfiltration.
SkillCC0-1.0★ 41No key
MCP server that gives AI assistants (Claude, Codex, Cursor, Opencode) SSH access to run commands, transfer files, and manage server fleets
PythonMPL-2.0★ 4Few starsNo key
AgentGate — scan, lock, and gate your MCP servers. npm-audit + lockfile + CI drift gate for the MCP era.
SkillApache-2.0Few starsNo key
Who stands behind it
