Security scanner for AI agent skills and MCP servers
Security scanner for AI agent skills and MCP servers
Local security checks for AI agents before they trust third-party tools.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| scan_content | Scan text for security threats before acting on it. Works on agent skills, READMEs, tool definitions, MCP server descriptions, prompts, package manifest content (package.json), GitHub Actions workflow YAML when the filen |
| check_mcp_config | Check an MCP server configuration (JSON) for security issues before adding it to a client. Detects dangerous command shapes in command/args, credential exposure in env, unsafe argument injection, and tool-poisoning patte |
| list_rules | Browse the cataloged security rules. Returns 250 detections (193 YAML pattern rules + 57 analyzer-emitted rules from ci-trust, pkgmeta, jsrisk, pyrisk, rsbuild, npm-policy, pnpm-policy, agent-policy, NLP, toxic-flow, and |
| explain_rule | Get detailed information about a specific rule by ID. Resolves both YAML rules (returns patterns plus true/false-positive examples) and analyzer-emitted rule IDs from ci-trust, pkgmeta, jsrisk, pyrisk, rsbuild, npm-polic |
| discover_mcp | Discover MCP server configurations on the local machine by reading known MCP client config files (Claude Desktop, Cursor, VS Code, Windsurf, and others). Returns the server definitions including commands, arguments, and |
Read, search and edit files inside allowed directories with the Model Context Protocol reference Filesystem server.
Retrieve version-aware library documentation and code examples with Context7 MCP, using resolve-library-id and query-docs.
Build-only Hedera (Hashgraph) MCP — 51 tools across Account, HTS, HCS, EVM, File & Schedule.
Codebase analysis tools for AI agents: complexity, prop drilling, doc coverage, code smells.
A tool to manage Claude MCP servers configuration
Local semantic code search with Git history. Works offline, no API key needed.