- Package risk @makosddavid/package-riskPackage risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Checkmarx @checkmarx/checkmarxOfficial Checkmarx MCP Server3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
- Truesignal @rudrendupaul/truesignalWraps the truesignal CLI as a single generic MCP tool for threat/connector status checks.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- Agent Toolkit @white-hat-lab/agent-toolkitPay-per-call developer utilities and npm supply-chain security tools for coding agents, over x402.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Package Intel @adam121393/package-intelnpm, PyPI & crates.io health, vulns and dependency graphs. Runs locally, no API key.13% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- WP HealthKit @wphealthkit/mcp-serverSecurity audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- LineBreak Gate & Spec Bridge @linebreakapp/linebreak-gateApproved acceptance criteria served over MCP to Claude Code, Cursor, or Codex. Git-only, sealed.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- PostgreSQL CVE & Release Intelligence @meob/pg-cve-mcpPostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- CyberShield @tooloracle/cybershieldCyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- FabTally Guard @zvmzaretsky/fabtally-guardVerify before you act: deps-check, x402-preflight, json-repair & url-read for agents.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Devstack @isaiahdupree/devstack-mcpDev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- The Bot Wire @araspasha/botwire-mcp301 real-time data wires. Paid per call via x402, no API key, no free tier.13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- endoflife.ai — Software Lifecycle Intelligence @endoflife-ai/endoflife-mcpEOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 500+ products.2% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- FTP SSH @chris221/ftp-ssh-mcpWork with a remote host over FTP/FTPS/SFTP, SSH, and MySQL.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Security Intel MCP @datakoot/cve-vulnerability-lookupCVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Voyager Agent @dir-ai/voyager-agentOne universal Voyager: name a goal; it activates senses (repo, net) and runs a live mission.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Voyager @dir-ai/voyagerCited, OSV-gated, injection-hardened web briefs for coding agents. Verified, never raw web.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- VDB @ai/vdbCheck packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Intelthreadlinqs @threadlinqs/intelthreadlinqs-mcpThreadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Trusteed @trusteed-io/trusteed-mcpCTEM for your Trusteed tenant: security summary, findings, compliance gaps, and scans via OAuth.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Agent Toolbox @solhammer/agent-toolbox26 deterministic, offline pre-action safety gates for AI agents, each with a signed verdict.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- 4da @4da-systems/4da-mcp-serverUpgrade intelligence for AI agents: what an upgrade changes, where it touches your code, CVE scans.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Lazaretto @jamesdfinance-dev/lazarettoFree lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Scout Security @varpost/scoutDeterministic, zero-token security scanner your AI agent calls to find and re-verify issues.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
