- Scherlok @rbmuller/scherlokZero-config data-quality monitoring: profile a warehouse, detect anomalies, gate CI.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.11 GitHub stars.
- Lumino MCP Server @geored/luminoAI-powered SRE observability for Kubernetes/OpenShift with 40+ Tekton debugging tools5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.11 GitHub stars.
- Ducklab @jrullan/ducklabMulti-LLM dev harness, MCP-operable: bugs, cycles, gates. Verdicts are exit codes, never opinions.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.9 GitHub stars.
- Migrationpilot @mickelsamuel/migrationpilot112 rules that catch dangerous PostgreSQL migrations, plus a pass/fail gate to call before any DDL.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.8 GitHub stars.
- Supply Chain Guard @homeofe/supply-chain-guardSupply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.7 GitHub stars.
- Draugr @draugr/draugrSecurity scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.7 GitHub stars.
- GitLab @vish288/mcp-gitlabGitLab MCP server for MCP 2026-07-28: projects, MRs, files, reviews, pipelines, CI/CD, issues5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.6 GitHub stars.
- Blacksmith @grahamnotgrant/blacksmithMCP server for Blacksmith CI - query runs, analyze test failures, detect flaky tests.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.6 GitHub stars.
- Vigilis @piyushpathakqa/vigilis-mcpGate AI-written tests: heal safe drift, refuse to hide real bugs, sign a verifiable receipt.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- Spinnaker @geiserx/spinnaker-mcpMCP server exposing Spinnaker CD platform via Gate API for pipeline and deployment management4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- SVG to Video @gehdoc/svg-to-videoConvert animated SVG code/files to video (MP4/WebM) or image (GIF/aPNG) with in-band delivery.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- Pkgtruth @hxckya/pkgtruthCatches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- YAML Workflow @orieg/yaml-workflowExpose declarative YAML-defined workflows as MCP tools over stdio4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Regula @kuzivaai/regulaOffline AI governance code indicators (EU AI Act, Korea, Colorado). Indication, not legal advice.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Tenant Isolation @subodhkc/mcp-tenant-isolationStatic analysis scanner for MCP server code and multi-tenant SaaS applications.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- anodizer @tj-smith47/anodizerRust release tooling — drop-in GoReleaser parity + Rust extras.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.4 GitHub stars.
- GitHub Actions @ofershap/github-actionsGitHub Actions MCP — view runs, read logs, re-run jobs, and manage CI/CD.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- SAST MCP Server @skyrxin/sast-mcp-server11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- AdversaryGate @sanflow10/adversary-gateFail-closed merge gate an agent calls before saying done: MERGE, BLOCK or INCONCLUSIVE.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.3 GitHub stars.
- RugSnare @paraphern/rugsnarePin MCP tool contracts by sha-256; catch silent drift, rug pulls and bait-and-switch in CI.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- Gha Intel @barissozudogru/gha-intelWorkflow timing analysis, configuration audit and billing insight for GitHub Actions.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- ovecc @ovecc-labs/oveccArchitecture guardrails for AI-written code: dependency graph, impact, dead code, CI gate2% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- gha-doctor @linnea-bakshi/gha-doctorDiagnose GitHub Actions CI: lint, flaky tests, wasted minutes, health score. Read-only MCP tools.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.3 GitHub stars.
- Reelier @seldonframe/reelierSnapshot tests and CI for agent workflows: record a run, replay it at 0 tokens, diff for drift.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
