Search

Renfield — penetration testing for AI agents: finds and PROVES cross-server confused-deputy exfiltration chains in an MCP tool mesh, measures whether a real LLM falls for them, gates them at runtime, and runs as an MCP server any agent can call.

MCP gateway and Python guardrail that authorizes agent tool calls against a session policy. Stops prompt injection and aggregate attacks that per-call checks miss.

CTRL_ — security audit MCP server for AI-generated Next.js, Vite and Express apps. Finds exposed keys, unsafe queries and open row-level security, then walks your coding agent through fixing them. Extra depth on Supabase.

📇 ☁️ A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks.

Scan AI agent instruction files (CLAUDE.md, .cursorrules, AGENTS.md, mcp.json) for hidden or planted instructions.

Claude Code hook adapter for ClipCloak

querySelectorAll selector engine

☁️ - Beelzebub is a honeypot framework that lets you build honeypot tools using MCP. Its purpose is to detect prompt injection or malicious agent behavior. The underlying idea is to provide the agent with tools it would never use in its normal work.

https://github.com/theagentforge/forge-mcp

Scan a repo's local .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE and API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire the moment you clone and open an untrusted repository — and flag the exact

package-lock.json for MCP trust — scan MCP servers for tool poisoning, secret leaks, and silent tool rug-pulls, with a committed, reviewable lockfile.

Verify-before-act safety MCP for AI coding agents: check packages, lockfiles, skill/plugin manifests, and CI workflows before installing or merging.

VibeRaven MCP

Discover the MCP servers, skills and plugins your agents have installed, and pin them with Small Print.

DataNexus MCP — AI-Ready access to public data via 29 tools: US/UK nonprofits, OSS vulnerability intelligence, professional licence verification (NPI/FINRA/SAM.gov), domain & DNS intelligence, global patent data (EPO/USPTO), government contracting (USASpe

agent gateway

CCS Runtime Evidence MCP Server

See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.

Static analysis and drift detection for the surface an MCP server exposes to an agent.

[](https://glama.ai/mcp/servers/mopanc/depguard) 📇 🏠 🍎 🪟 🐧 - Pre-install guardian for npm packages with static code analysis, supply-chain attack detection, vulnerability audit (npm + GitHub Advisory Database), AI hallucination guard, and CycloneDX 1.6 SBOM generation with VEX. 12 MCP tools. Zero runtime dependencies — the SBOM serializer is implemented natively against the public CycloneDX schema.