Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 551 to 600 of 3,335 Grade C entries. Page 12 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:19 postinstallHackTricks MCP Server (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for searching and querying [HackTricks](https://github.com/carlospolop/hacktricks) pentesting documentation directly from Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
evaluation/cli.py:51 completed = subprocess.run(happycodex (Plugin)
Compatibility: Not stated.
[English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
skills/harmix-music-search/scripts/video_search.py:38 result = subprocess.run(Harmix Skills (Skill)
Compatibility: Not stated.
Public repository harmix/harmix-skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
packages/cli/bench/scan.bench.mjs:108 fs.rmSync(root, { recursive: true, force: true });Harness Score (Plugin)
Compatibility: Portable across standard formats.
Your AI coding agent is only as reliable as the harness around it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
skills/pipelines/create-pipeline-v1/references/v1-spec-schema.md:674 script: curl -s http://app/healthHarness Skills (Skill)
Compatibility: Not stated.
All 71 Harness skills in one plugin: pipelines, deployments, access control, feature flags and experimentation, database, platform, security, observability and AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
.github/scripts/merge_traffic.py:77 response = requests.get(url, headers=headers, timeout=30)Hcls Agent Skills (Skill)
Compatibility: Not stated.
A curated collection of agent skills for healthcare and life sciences (HCLS) workflows, following the [Agent Skills open standard](https://agentskills.io).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
requirements.txt:9 requests>=2.31 # all HTTP API calls (Prospeo, Apify, CrustData, Blitz, Findymail, ZeroBouncHeadless Gtm (Skill)
Compatibility: Not stated.
GTM without the SaaS layer: an outbound pipeline built as agent skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
npm/install.js:18 // and HEIDES_VERSION is honoured so the same pin works for the curl installerHEIDES (MCP server)
Compatibility: Not stated.
HEIDES is a deterministic harness that gives AI coding agents what they do not have on their own: a persistent map of the code, warnings derived from that map, and a verdict before a patch lands.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
tasks/plan.md:329 **Description.** Shell out to the `releaseguard` binary. Signature: `runReleaseGuard(target:Helixar Security (MCP server)
Compatibility: Not stated.
Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/herdr_subagent_panes.py:50 completed = subprocess.run(Herdr Codex Subagents (Plugin)
Compatibility: Not stated.
Show Codex subagents in temporary Herdr panes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
hermes_jailbench/evidence.py:106 return subprocess.run(Hermes Jailbench (Skill)
Compatibility: Not stated.
Jailbreak regression benchmark for LLM endpoints with repeatable known-pattern attacks and deterministic scoring
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/hive-build/SKILL.md:42 r = requests.post(Hive Sdk (MCP server)
Compatibility: Not stated.
One OAuth-ready connection for evidence-backed crypto due diligence, with sources, freshness, and a runtime receipt on every Hive call.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
evals/run.py:107 r = subprocess.run(Hiway Kit (Plugin)
Compatibility: Not stated.
> Universal agent toolkit by [This-HW](https://github.com/This-HW) , 15 agents + 15 skills for software development, packaged for **Claude Code**, **Codex** and **Antigravity**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
plugins/hermes-hmem/__init__.py:71 result = subprocess.run(hmem Humanlike Memory for AI Agents (MCP server)
Compatibility: Not stated.
> Your AI forgets everything between sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
mcp-server/src/tools/adguardFilters.ts:30 `curl -sf ${auth} 'http://localhost:${port}/control/filtering/statusHome Lab Developer Tools (Plugin)
Compatibility: Not stated.
Home lab and Raspberry Pi workflows for Cursor, Claude Code, and MCP-compatible editors - 22 skills, 11 rules, and 50 MCP tools for Docker Compose, monitoring, DNS, networking, backups, security, logs, notifications, OS management, certificates, multi-node, diagnostics, and SSH a
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zhR9K4qI0" style="display:none">0Tksu188mhZBt6iMuHUptnS2opZLLztHmqiX8B3YWDDnJCCxXSzdbBj6Hotel Ai Operations Suite (Plugin)
Compatibility: Not stated.
🏨 Hotel AI Skills 2026: Enterprise Revenue & P&L Optimization Suite
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:33 if command -v curl >/dev/null 2>&1; thenHotspot Analysis (Plugin)
Compatibility: Not stated.
Rank Java source files and methods by a Composite Hotspot Score that combines recency-weighted git revisions, cognitive complexity, and JaCoCo coverage gap , so testing and refactoring effort lands where the historical evidence says bugs are most likely to live.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/benchmark.mjs:39 const res = await fetch(`${BASE}/v1/chat/completions`, {Houtini Lm (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="https://raw.githubusercontent.com/houtini-ai/houtini-lm/main/assets/logo.png" width="120" height="120" alt="Houtini LM" /> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
benchmarks/manifest.py:35 return subprocess.check_output(["git", *args], cwd=ROOT,hubmesh (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.DemigodDSK/hubmesh -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:7 prepareHulde Review (Plugin)
Compatibility: Not stated.
AI-powered code review and visualization , analyze, visualize, and improve any codebase
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
requirements.txt:1 mcp>=1.0.0Humanity Commons (MCP server)
Compatibility: Not stated.
**Open infrastructure for humans and AI agents to contribute, verify, challenge, preserve, and reuse knowledge for measurable human benefit.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/check_drift.py:17 ROOT = subprocess.run(humanizer (Skill)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:22 postinstallHumanizer Cli (Plugin)
Compatibility: Not stated.
Detect AI-written text with 33 checks, right in your terminal.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
eval/fetch_systems.py:39 tree = json.loads(subprocess.run(Humanizer Ru (Skill)
Compatibility: Not stated.
Переписывает русский ИИ-текст так, чтобы он читался как написанный человеком, и сверяет факты до и после.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:43 preparehumanjs (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./.github/banner.jpg" alt="HumanJS , humanize your browser automation" width="640"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
hooks/guard.py:50 result = subprocess.run(HungryCrab (Skill)
Compatibility: Not stated.
Eat a foreign repository, digest it, and extract everything useful for your own repo without violating licenses.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skills/osint/scripts/extract-intake.py:58 result = subprocess.run(cmd, capture_output=True, text=True, check=Fhuntkit (Skill)
Compatibility: Not stated.
Investigation toolkit for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
skills/article2ticktick/scripts/add_articles.py:141 subprocess.run(['open', url], check=True)Huuuuuuho Skills (Skill)
Compatibility: Not stated.
[中文](#chinese) | [English](#english)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/cli.js:51 const command = commands.get(commandName);Hyper Waterfall (Skill)
Compatibility: Not stated.
English | [한국어](README.ko.md) | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skills/camera-3d-captions/scripts/hand/build-sprites.py:37 r = subprocess.run(['node', 'render-anim.mjs', sk,Hyperframes Community Skills (Skill)
Compatibility: Not stated.
A community-maintained collection of focused, one-off skills for [HyperFrames](https://github.com/heygen-com/hyperframes).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
codex_bench/harness.py:222 proc = subprocess.run(hyperresearch (Plugin)
Compatibility: Portable across standard formats.
Convert Claude Code or Codex into the most intelligent Deep Research Agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
assets/purchase-preparer.mjs:29 const response=await fetch(new URL('../service-offers.json',import.meta.url),{HyperXosist-Agent Remote MCP (MCP server)
Compatibility: Not stated.
**Agent-first toolkit and Remote MCP server for noise-reduced X (Twitter) search planning and Feedback-to-Fix engineering handoffs.** It generates structured search plans and official X search URLs for humans and AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:11 postinstallI18N Agent (MCP server)
Compatibility: Not stated.
AI-powered translation for 48 languages with context-aware quality
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
email/imap-client.js:90 const fetch = imap.seq.fetch(range, {Icloud Mcp (MCP server)
Compatibility: Not stated.
<picture> <source media="(prefers-color-scheme: dark)" srcset="assets/banner-dark.svg"> <img src="assets/banner-light.svg" alt="icloud-mcp banner: Mail, Calendar, Contacts, Reminders, Notes, Messages and Safari for your AI assistant"> </picture>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
src/idamesh/bootstrap/plugin_main.py:371 subprocess.Popen(argv, **popen_kwargs) # noqa: S603 - detached singleidamesh (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for **IDA Pro**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:27 prepareIgnite UI Theming MCP Server (MCP server)
Compatibility: Not stated.
<h1 align="center"> Ignite UI Theming - from Infragistics </h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareImagegen Mcp (MCP server)
Compatibility: Not stated.
This project provides a server implementation based on the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) that acts as a wrapper around OpenAI's Image Generation and Editing APIs (see [OpenAI documentation](https://platform.openai.com/docs/api-refere
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zxS9VfQu0" style="display:none">/hwsttjcM9DeH0Nag+kWJHI0+5ZXlhYU5RYEm53Vl9LIASC82sx0qodSImmich Curator Mcp (Plugin)
Compatibility: Not stated.
A next-generation MCP (Model Context Protocol) server that transforms your Immich photo library into a living, breathing digital archive.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
demo_server/render_server.py:35 out = subprocess.run(Imprint PDF (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.263311487-ux/imprint-pdf -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:42 postinstallIn Memoria (MCP server)
Compatibility: Not stated.
**Giving AI coding assistants a memory that actually persists.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/traffic.py:113 subprocess.run(["scp", "-o", "ConnectTimeout=12", f"{DROPLET}:{REMOTE_LOG}", tmp], checinfo.agentrank/agentrank (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:41 prepareINITE AI Visibility (MCP server)
Compatibility: Not stated.
See how ChatGPT, Claude, Gemini and Perplexity read any website.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:41 @modelcontextprotocol/sdkINITE Club (MCP server)
Compatibility: Not stated.
Ask the agent of someone whose calendar you could not get.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zNXcpbRL0" style="display:none">srjbCytf6W0aNrpm+/TAnXfvD5DC+5VWvzX8pmjrUfeEpdcBKU+uF0N7Initiative Journal Tracker (Plugin)
Compatibility: Not stated.
**Transform product development from static guesswork into a persistent, evidence-driven journey with stateful tracking and living documentation.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zi8zDIVw0" style="display:none">F0whvI0jf5pfS8Z6aaRl6vHvVGXvflMdy1NL1psflFohUS22jzM44AYGIntent Signal Scout (Plugin)
Compatibility: Not stated.
**Transform LinkedIn from a noisy social network into a precision signal engine.** Lead Engine AI is the first intent-based outbound intelligence layer built exclusively for Claude Code , turning raw LinkedIn activity into warm prospects, ready-to-send DMs, and pre-call battle c
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
mcp_server.py:53 key_filepath: Annotated[Optional[str], Field(description="Absolute path to a private key fileInterminal (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.QiuwenZheng/interminal -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:22 prepareIntoDNS.ai DNS & Email Security Scanner (MCP server)
Compatibility: Not stated.
DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
plugin/src/invara/assurance/execute.py:508 with socket.create_connection(("127.0.0.1", port), timeout=remaininINVARA (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Jujitae/invara -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
src/InvoiceXml.Mcp.Core/Options/FileInputOptions.cs:22 /// <summary>Overall timeout for a single URL fetch (coInvoiceXML (MCP server)
Compatibility: Not stated.
Create, validate, convert & extract compliant e-invoices (UBL, Factur-X, ZUGFeRD, XRechnung)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
python/src/artifacta_mcp/path_confinement.py:132 os.path.join(home, ".netrc"),io.artifacta/mcp (MCP server)
Compatibility: Not stated.
Official MCP server for [Artifacta](https://artifacta.io) , an artifact store purpose-built for AI agents.
This grade is a hygiene screen, not proof of safety.
