Search

Library for Ed25519-signed MCP tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Layer-2 mitigation for marketplace-poisoning, CVE-2025-69256, CVE-2025-61591.

MCP Gateway — one in-path proxy that scores a downstream MCP server and governs every tool call with capability leases. Fuses @gatewarden/score and @gatewarden/govern.

Protect your AI agents and IDEs from malicious open-source packages.

Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them

Model Context Protocol Server for Rebase — exposes schema, DB, document, and user management tools to AI assistants.

MCP tool for scanning Maven project dependency vulnerabilities

Ed25519-signed MCP tool manifests + spawn attestation. Layer-2 supply-chain hardening.

Lean & Secure Bot

[](https://glama.ai/mcp/servers/elang2/mcp-audit-gateway) 📇 🏠 🍎 🪟 🐧 - Tamper-proof audit trail for AI agent tool calls. Transparent stdio proxy with cryptographic attestation (Ed25519 signing), hash-chained records, YAML policy enforcement (allow/deny/transform), and OpenTelemetry export. Zero server modification required. `npm i @mcp-audit-gateway/core`

Tooling for MCP. Coming soon.

Identity-scoped schema selection for text-to-SQL. Returns only the tables the caller may read.

Audit the MCP servers installed in your agent: injection, credentials, pinning, and post-install drift.

MSW (Mock Service Worker) Plugin for ObjectStack Runtime

MCP server + cross-harness skills for building and operating AI agents safely

A watchtower for AI agents — scan MCP servers and AI-agent tool manifests for poisoned descriptions, data exfiltration, secrets and supply-chain risk. Zero-dependency, CLI + CI.

npm install, reimagined for AI agents: an MCP server that vets npm releases against the package's own history before an agent installs them

Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked

Local first MCP checks for Unicode confusables, mixed scripts, invisible controls, and suspicious identifiers

👻 Detects ghost imports — npm packages that don't exist, hallucinated by AI coding tools like Cursor, Copilot, and Claude

Local MCP broker: agents call credentials through a daemon without seeing secrets.