Search

JavaScript attack-surface recon for authorized security testing: endpoints, secrets, dangerous sinks, CORS/JWT issues, CVEs, and GraphQL — with JSON/HTML/SARIF reports. Use as a CLI, a GitHub Action, or an MCP server.

An MCP server that gives AI coding agents (Claude Code, Codex, Cline) safe, structured network & security reconnaissance tools — DNS, WHOIS, TLS, HTTP headers, and port scanning. For authorized testing and education only.

MCP server for secure coding and compliance — full MITRE CWE corpus, ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF, ISO 27017 — with official cross-framework mappings and enforcement hooks

MCP security gateway: an inline proxy that scans tools/list for poisoned tools, enforces a tool allow/deny policy, blocks injected tool results, and logs every call. The runtime-enforcement leg of the bastion family.

🐍 🏠 - All-in-one security testing toolbox that brings together popular open source tools through a single MCP interface. Connected to an AI agent, it enables tasks like pentesting, bug bounty hunting, threat hunting, and more.

Agent Identity Protocol MCP server providing cryptographic identity verification, trust chain management, and secure messaging for AI agents via 8 tools including DID creation, challenge-response verification, vouching, and artifact signing.

Offensive-security tools, skills, and MCP servers for local AI agents — privacy-first, small-model-driven. Authorized pentest/red-team companion: 6 MCP servers (27 tools), all irreversible classes human-gated.

Static security scanner for self-rolled OAuth/auth failure classes in MCP servers, gateways, and OAuth clients. Rules seeded from live-reproduced, chain-of-custody-anchored VATA findings. SARIF output for GitHub code scanning.

Find the security holes your AI coding assistant just shipped. MCP server + CLI for vibe-coded web & mobile apps: leaked keys, missing Supabase RLS, open Firebase rules, unauthenticated routes, hallucinated packages.

Enterprise-grade MCP (Model Context Protocol) server for Perforce P4 integration with AI assistants. Features 37+ Perforce operations including merge resolution, shelving, advanced search, blame annotations, and comprehensive security with audit logging,

AI-Supervised Cybersecurity Tool Orchestration Platform. A pipeline that connects any AI client to security tools (via MCP or PTY terminal automation) and supervises the worker AI in real time. Core is Python, supported by TypeScript, C, and Assembly, wit

Privacy-first AWS security in your AI. Trace attack paths from the internet to your sensitive data, check CIS/SOC2, and prove fixes before applying - Emfirge clones your infra graph, mutates it, and re-runs every rule. Resource IDs are tokenized locally,

SaaStacular is a single- and multi-tenant security foundation for building AI operating systems. Built with Next.js, Go, Python and PostgreSQL, with WorkOS authentication, tenant isolation, MCP connections, audit logging, Docker-based validation and on-demand GCP deployments.

Correctover CCS MCP Server — local-first MCP/Agent security tooling: receipt verification, batch audit, field-level tamper localization, and 14-rule MCP config checkup. Zero network egress, zero third-party dependencies.

Security audit for AI agent skills & MCP configs (reverse shells, exfiltration, dangerous MCP servers, hardcoded secrets) → SARIF/code-scanning; plus cross-agent skill governance for Claude Code, Cursor, Gemini CLI, Windsurf, Zed.

Baidu code security MCP server

MCP Server for AWS security scanning

Nemesis Shield — Edge SDK for Deno / Cloudflare Workers / Vercel Edge / Supabase Edge Functions. Positive-security: learns your app's normal behavior and blocks off-baseline requests (auth bypass, path traversal, scanners) in enforce mode. Web-standard (R

Webhook security audit CLI — finds signature-verification bugs in JavaScript, TypeScript, and Python codebases. Local, deterministic, zero-network. Ships rules for Stripe, GitHub, Shopify, Slack, Twilio, and Square; JSON / SARIF 2.1.0 output for CI and Gi

Cybersecurity for AI founders and vibe coders. A pre-push security gate for apps built with Claude Code, Cursor, Codex, Lovable and Bolt: 12 offline checks for leaked keys, Supabase RLS, cross-account (IDOR) access, injection, Stripe webhooks, known CVEs