- AdversaryGate @sanflow10/adversary-gateFail-closed merge gate an agent calls before saying done: MERGE, BLOCK or INCONCLUSIVE.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.3 GitHub stars.
- RugSnare @paraphern/rugsnarePin MCP tool contracts by sha-256; catch silent drift, rug pulls and bait-and-switch in CI.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- Playrunner @playrunner/mcpDiscover Playwright workflows, start runs, and inspect results in Playrunner Cloud.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.3 GitHub stars.
- Gha Intel @barissozudogru/gha-intelWorkflow timing analysis, configuration audit and billing insight for GitHub Actions.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- ovecc @ovecc-labs/oveccArchitecture guardrails for AI-written code: dependency graph, impact, dead code, CI gate2% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- gha-doctor @linnea-bakshi/gha-doctorDiagnose GitHub Actions CI: lint, flaky tests, wasted minutes, health score. Read-only MCP tools.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.3 GitHub stars.
- Reelier @seldonframe/reelierSnapshot tests and CI for agent workflows: record a run, replay it at 0 tokens, diff for drift.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- UXLoom @uxloom-dev/uxloomAgent-native UI/UX design validation: journey completeness, state coverage, and WCAG checks.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- Release Gate @vamsisudhakaran1/release-gatePre-deploy security auditor for AI agent code — the risks generic SAST misses.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.3 GitHub stars.
- ActionsPulse @tsviz/actions-pulseReal-time GitHub Actions observability: DORA Metrics, Cost Analysis, CI/CD Health dashboards.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.3 GitHub stars.
- Bitbucket MCP Server @lawp09/bitbucket-mcpMCP server for Bitbucket API - manage repositories, pull requests, comments, pipelines and more6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.3 GitHub stars.
- MegaLinter @downatthebottomofthemolehole/megalinterMCP server for running Ox Security MegaLinter via mega-linter-runner4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- Smolanalytics @arjun0606/smolanalyticsEnd-to-end tests from one sentence: an agent drives a real browser, and passing runs replay free.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.3 GitHub stars.
- NativeKeel @alicanakyol/nativekeelReact Native and Expo health check: upgrade blockers, store rules, crash risks, security findings3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- eGovFrame Scaffold @ericseokgon/egovframe-scaffold-mcpeGovFrame (전자정부 표준프레임워크) projects: templates, components, CRUD, build, 5.x migration, dependencies4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- go-tokenless @continuous-actions/go-tokenlessMove npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- dbt-plan @presentjay/dbt-planPredicts the DDL a dbt change will execute, before you run it. Reads files, not the warehouse.2% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.2 GitHub stars.
- ResiliReplay @aliengineering-byte/resilireplayRun bounded, deterministic MCP reliability tests and generate executable regressions.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- LLM Preflight @feronovak/llm-preflightLocal, cross-provider preflight checks for LLM integration changes.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.2 GitHub stars.
- Dsh Verify @263311487-ux/dsh-verifyAgent-built web app quality gate. Real browser is the judge. PASS/FAIL with receipts.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- GLBForge @glbforge/glbforgeMake AI-generated 3D assets web-ready: budgets, SSIM-verified optimization, STL/USDZ export.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Evolith Architecture Governance @beyondnetcode/evolithExecutable architecture governance: an unevaluated rule is reported as a failure, never a pass.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- ellmos Blender Use @ellmos-ai/ellmos-blender-use-mcpHeadless Blender asset QA over MCP: background script runs and FBX reimport verification.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Tapp @aarwitz/tappTest iOS, Android, and web apps with agent exploration, replayable flows, and CI gates.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
