- Jsmon @jsmon/mcpDiscover exposed assets, leaked secrets, APIs & client-side vulns across your attack surface30% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- ShipSafe — Independent security verification @ship-safe/scannerIndependent security review for AI-built apps: exposed secrets, broken auth, unsafe data access.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- grim-mcp @abduljabbarbxr/grim-mcpSecurity audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- AgentGlass @agentglass/agentglassScan any public URL for hidden instructions aimed at AI agents (prompt injection). Free, no auth.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- LLM Red-Team Scanner @manhliemcn4euwlu/llm-red-team-scanner35-probe LLM/agent security red-team scan (injection, jailbreak, MCP abuse) with report.27% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Cloakcheck @cloakcheck-wheat/cloakcheckScan a page for hidden prompt-injection payloads targeting AI agents.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Malinois @malinois/scanCheck a live app you own for public databases, leaked keys and exposed files.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- StackShield @stackshield/stackshieldExternal security monitoring for Laravel apps: list domains, trigger scans, read issues and fixes.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- FlowSentry @vasilicasijarvis/flowsentrySecurity scanner for n8n workflows + live MCP Trust-Check. 18 rules, OWASP mapped. Paid x402 API.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Weakspot @weakspot/weakspotAudit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402.22% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Perimeter Watch @entradox/perimeter-watch-scannerPassive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Strix @strix/strixAI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Security Tools @rangercheck/security-toolsFree front-end security check for any website: a grade plus the secrets and keys it exposes.15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Hyperion @thetempleofdoom/hyperionHyperion — MCP tool marketplace for AI agents: web, OSINT, security, research via one key.26% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Kadent Scan @kadent/kadent-scanFree, read-only security scanner for remote MCP servers, before you connect them.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Execute bug-bounty-hunter-mcp @evozim/bug-bounty-hunter-mcpPremium agentic endpoint for bug-bounty-hunter-mcp.27% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Quiet Failures @quietfailures/quiet-failuresOpen weekly security base rates (CC BY 4.0), plus live DMARC, takeover and WHOIS checks.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Flare @flarehq/securityScan a running app or repo for leaked secrets, exposed routes and open RLS, and verify live keys8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Hares — MCP security scanner @alialrikabi313/haresMulti-layer security scanner for MCP servers and agent skills (injection, exfiltration)15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- ScanLabsAI Security Scanner @scanlabsai/scannerScan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes11% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Security Scanner @vpatser1/mcp-server-security-scannerScan MCP configs for 30+ CVEs, prompt injection, tool poisoning; validate OAuth configs6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- mcp-toolbelt @papacasper/mcp-toolbelt29 pay-per-call DNS, SEO, SSL, security, and dev tools for AI agents. x402, no API key.11% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- PentaTrail CTEM @pentatrail/ctemPentaTrail ASM/CTEM: attack surface discovery, asset inventory, findings by threat level10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Agents @hirosecure/agentsProgrammatic control of the Hiro security platform: scans, tasks, plans, and approvals.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
