- Canary @mindstone/mcp-server-canaryMindstone-internal release-pipeline test connector; not for use. Single ping tool; no auth.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.12 GitHub stars.
- MobiLoop @enessubass/mobiloop-mcpGuarded AI mobile Appium testing, security scanning, verification, and fix-retest MCP tools.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.12 GitHub stars.
- Bawbel Scanner @bawbel/scannerSecurity scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.12 GitHub stars.
- Assay MCP Server @rul1an/assay-mcp-serverPolicy-enforcing MCP proxy with portable evidence output.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.12 GitHub stars.
- Scherlok @rbmuller/scherlokZero-config data-quality monitoring: profile a warehouse, detect anomalies, gate CI.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.11 GitHub stars.
- Lumino MCP Server @geored/luminoAI-powered SRE observability for Kubernetes/OpenShift with 40+ Tekton debugging tools5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.11 GitHub stars.
- Ducklab @jrullan/ducklabMulti-LLM dev harness, MCP-operable: bugs, cycles, gates. Verdicts are exit codes, never opinions.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.9 GitHub stars.
- Migrationpilot @mickelsamuel/migrationpilot112 rules that catch dangerous PostgreSQL migrations, plus a pass/fail gate to call before any DDL.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.8 GitHub stars.
- Supply Chain Guard @homeofe/supply-chain-guardSupply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.7 GitHub stars.
- Draugr @draugr/draugrSecurity scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.7 GitHub stars.
- HefestoAI @artvepa80/hefestoaiPre-commit code quality guardian. Detects semantic drift in AI-generated code.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.7 GitHub stars.
- GitLab @vish288/mcp-gitlabGitLab MCP server for MCP 2026-07-28: projects, MRs, files, reviews, pipelines, CI/CD, issues5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.6 GitHub stars.
- Blacksmith @grahamnotgrant/blacksmithMCP server for Blacksmith CI - query runs, analyze test failures, detect flaky tests.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.6 GitHub stars.
- Vigilis @piyushpathakqa/vigilis-mcpGate AI-written tests: heal safe drift, refuse to hide real bugs, sign a verifiable receipt.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- Spinnaker @geiserx/spinnaker-mcpMCP server exposing Spinnaker CD platform via Gate API for pipeline and deployment management4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- SVG to Video @gehdoc/svg-to-videoConvert animated SVG code/files to video (MP4/WebM) or image (GIF/aPNG) with in-band delivery.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- Pkgtruth @hxckya/pkgtruthCatches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- YAML Workflow @orieg/yaml-workflowExpose declarative YAML-defined workflows as MCP tools over stdio4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Regula @kuzivaai/regulaOffline AI governance code indicators (EU AI Act, Korea, Colorado). Indication, not legal advice.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Tenant Isolation @subodhkc/mcp-tenant-isolationStatic analysis scanner for MCP server code and multi-tenant SaaS applications.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- anodizer @tj-smith47/anodizerRust release tooling — drop-in GoReleaser parity + Rust extras.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.4 GitHub stars.
- GitHub Actions @ofershap/github-actionsGitHub Actions MCP — view runs, read logs, re-run jobs, and manage CI/CD.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.4 GitHub stars.
- SAST MCP Server @skyrxin/sast-mcp-server11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Korext: AI Code Governance @korext/governanceGovernance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.4 GitHub stars.
