Search

**Name**: operant-mcp **GitHub**: https://github.com/operantlabs/operant-mcp **npm**: https://www.npmjs.com/package/operant-mcp **Install**: `npx operant-mcp` **Category**: Security / Penetration Testing **License**: MIT

Reference MCP security lab: toxic tool metadata, multi-server mcp.json harness for static scan, localhost AAuth fixtures, YARA (OWASP Agentic ASI01–ASI10). Stress-test MCPShark and similar tools—not for production.

Smart contract security auditor for Claude Code — vuln detection, exploit PoCs, mainnet-fork simulation, audit cards, on-chain certificates. Solidity + Vyper · 38 commands · 19 agents · 33 skills · 9 MCP servers.

CLI security scanner for self-hosted multi-tenant AI-agent platforms. 16 fail-closed OPA/Rego rules catch tenant-isolation defects (sandbox scoping, SSRF, cross-tenant cron/auth). SARIF and MCP output for CI and AI agents.

Claude Code plugin: privacy-by-design + secure-by-design controls for products targeting NIST SSDF 1.1, ISO 27001:2022, and India DPDP Act 2023. Profiles your project, asks which regimes apply, then deploys dev-loop guardrails and product-code scaffolds.

AI agent security: scan skills for 25 attack classes + runtime monitoring (EDR for AI agents). Real-time scanning, behavioral anomaly detection, session monitoring, exfiltration alerts. 1,316+ findings from 450+ audits. OWASP Agentic AI Top 10 mapped.

Knostic — independent third-party profile of a public API surface, by API Evangelist. Knostic secures the AI agent supply chain inside the enterprise. Its platform discovers shadow AI, coding assistants, MCP servers and IDE extensions in use across an organization, then scans them for prompt injection, data exfiltration, secret and PII leakage, and

[](https://glama.ai/mcp/servers/epistemedeus/skillguard) 📇 🏠 - Static security scanner for Claude Code skills, plugins, and MCP servers — vet a dependency for malware (secret/env exfiltration, install-time hooks, prompt injection, committed binaries) **before** you install it. Static-only: it clones and reads files, never executes the scanned code. `npx -y github:epistemedeus/skillguard

The EDR for MCP servers — 100% local, read-only. Discover, fingerprint and monitor every MCP server your AI agents expose across 14 clients; catch rug-pulls, tool poisoning, typosquats and exfiltration combos. Rust.

Local-first TUI for auditing AI agent state, MCP config, and dotfiles backup safety

Find secrets, supply-chain risks and tool poisoning in MCP / AI-agent configs before your agent runs them.

Protect cryptocurrency investments by validating trades and scanning for potential rug pulls. Identify anomalous market behavior and high-risk trading pairs before executing transactions. Ensure safer trading through real-time risk assessments and liquidity analysis.

A guard-agnostic benchmark for MCP injection / exfil / tool-poisoning detection. Versioned cases + a language-agnostic runner that scores any guard through its own published CLI.

Checks ML model files (pickle, PyTorch, joblib, NumPy, GGUF, ONNX) for code that runs on load.

MCP server exposing PrimitiveHub verification + scanning to AI agents (Claude, Cursor, Aider, …). Pure transport over @primitivehub/verify + @primitivehub/phub — zero custom trust logic.

AI governance MCP server: trust scoring, guardrails, bias/hallucination detection, compliance.

Local activation-probe scanner for AI agent tools, MCP servers, and skills.

A Rust application for scanning and verifying the security of Model Context Protocol server configurations, prompts, resources, and tools.

Policy, decision, audit, and validation contracts for MCP Security Proxy.

Stdio proxy session and subprocess runtime for MCP Security Proxy.