Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 701 to 750 of 3,335 Grade C entries. Page 15 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:33 postinstallio.github.Morous-Dev/engram-cc (MCP server)
Compatibility: Not stated.
**Universal AI session memory substrate.** One install.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:31 prepareio.github.MUSE-CODE-SPACE/content-genie (MCP server)
Compatibility: Not stated.
> Korean-content-creator MCP that gives Claude live Naver/Daum/Google/YouTube/Zum trends, a 100+ Korean-holiday DB, and a viral-score predictor , so you stop tab-hopping between 5 trend dashboards before every post.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/cloud.ts:64 const r = await fetch(`${GEMINI}/${model}:generateContent?key=${encodeURIComponent(key)}`, {io.github.Narashiman-K/markdown-notes-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
publish.py:5 shutil.rmtree(sdk_dir)io.github.Neurobyteio/agentrisk (MCP server)
Compatibility: Not stated.
> **Pre-Trade Security Layer for Autonomous DeFi Agents on Base.** *Stop letting your autonomous trading bots get rekt by stealth honeypots, malicious taxes, and rugpulls.*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
mcp_server.py:241 resp = requests.post(io.github.New1Direction/korg-introspect-mcp (MCP server)
Compatibility: Not stated.
**A tamper-evident, SHA-256-chained ledger for AI agents.** *Every step your agent takes is recorded in a hash chain anyone can verify , edit one event and the chain names it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
src/ssh-manager.ts:328 try { fs.unlinkSync(listFile); } catch { /* ignore */ }io.github.NikolaNddTesla/sshmcp (MCP server)
Compatibility: Not stated.
**[中文文档](./README.zh-CN.md)**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/archive.ts:54 const DENY_BASENAMES = new Set(['.npmrc', '.netrc', '.pgpass', '.git-credentials', '.htpasswio.github.NORTHTEKDevs/lossless-context-mcp (MCP server)
Compatibility: Not stated.
**The flight recorder for your agent's context.** A persistent, hook-fed ledger of every file version your coding agent was shown , so a compaction can't destroy the working set, a subagent fleet doesn't pay for the same files N times, and you can *prove* afterward exactly what
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
package.json:15 prepareio.github.O-mega-Enterprise/founden-mcp (MCP server)
Compatibility: Not stated.
MCP server for [Founden](https://founden.ai).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:49 prepareio.github.ParkSangGwon/admob-mcp-server (MCP server)
Compatibility: Not stated.
**English** | [한국어](README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
scripts/inspector.py:42 result = subprocess.run(io.github.PCfVW/mcp-arangodb-async (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.PCfVW/mcp-arangodb-async -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
packages/cli/src/http.ts:71 res = await fetch(url, {io.github.PedramMadani/legalithm-mcp-server (MCP server)
Compatibility: Not stated.
EU AI Act risk classification, obligations and Article 50 disclosures, cited to Regulation (EU) 2024/1689.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:19 prepareio.github.PierreJanineh/tech-debt-mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="mcpb/icon.png" alt="Tech Debt MCP" width="160" height="160" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/auth.ts:47 fs.unlinkSync(CREDENTIALS_PATH);io.github.PrashantBtkl/spresh-mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" width="72" alt="SpreshApp logo" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:28 prepareio.github.PyModel/claude-agy-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
local_leads_mcp/fetch.py:76 def fetch(url: str, timeout: float = 20.0) -> tuple[httpx.Response, str]:io.github.Raffaele86/local-leads-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Raffaele86/local-leads-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:29 id_rsaio.github.Raffaele86/seo-stack-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Raffaele86/seo-stack-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:81 prepareio.github.Raistlin82/btp-sap-odata-to-mcp-server-optimized (MCP server)
Compatibility: Not stated.
This repository is an enterprise-ready MCP (Model Context Protocol) server that bridges SAP OData services with AI capabilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/instances/instance-registry.ts:61 fs.unlinkSync(this.filePath);io.github.Rheopyrin/db-access-mcp (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) stdio server that gives AI agents (Claude Code, Claude Desktop, any MCP client) access to configured databases:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:23 postinstallio.github.Ringer/warp (MCP server)
Compatibility: Not stated.
MCP server for the Ringer WARP platform , SIP trunking, numbers, porting, messaging, billing, and CDR analytics
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:48 prepareio.github.RobThePCGuy/rag-vault (MCP server)
Compatibility: Not stated.
**Your documents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 prepareio.github.RoleModel/optics-mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for the Optics Design System, enabling LLMs to understand and work with design tokens, components, and documentation from https://docs.optics.rolemodel.design.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:37 prepareio.github.RubenGlez/devicecloud (MCP server)
Compatibility: Not stated.
**Triage failing DeviceCloud runs so your agent can fix them, without opening the dashboard.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:35 prepareio.github.Saidiibrahim/search-papers (MCP server)
Compatibility: Not stated.
Empower your agents to search, analyse, and explore academic papers from arXiv autonomouly.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:12 prepareio.github.SamuelMoraesF/mcp-nfse-nacional (MCP server)
Compatibility: Not stated.
MCP Server para consulta de Notas Fiscais de Serviço Eletrônicas (NFSe) no portal nacional ([nfse.gov.br](https://www.nfse.gov.br)).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
app/api/bank/banks/route.ts:12 const lambdaResponse = await fetch(`${API_GATEWAY_URL}/bank/banks`, {io.github.Sean-Bravo/taxformatter (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
scripts/postinstall.js:70 fs.unlinkSync(tmpFile);io.github.SecurityRonin/alaya-mcp (MCP server)
Compatibility: Not stated.
The only memory engine with neuroscience-grounded memory dynamics , Bjork dual-strength forgetting, retrieval-induced suppression, and Hebbian co-activation , in a zero-dependency embeddable Rust library.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/verify-provenance.mjs:59 const res = await fetch(url, {io.github.SPAZIO-GENESI/attest-mcp (MCP server)
Compatibility: Not stated.
Listed on the [official MCP Registry](https://registry.modelcontextprotocol.io/) as `io.github.SPAZIO-GENESI/attest-mcp`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:9 postinstallio.github.UnityNodes/canton-ccpedia (MCP server)
Compatibility: Not stated.
**The Canton Network knowledge platform.** Open source, no auth, one MCP endpoint.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/quarry/local.py:515 with urllib.request.urlopen(io.github.Wangggym/quarry (MCP server)
Compatibility: Not stated.
> **The database workbench built for the AI era** , one kernel, many faces (CLI / GUI / MCP / agent skill).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
deck/rendering/thumbnail.py:142 result = subprocess.run(io.github.Whatsonyourmind/modelforge (MCP server)
Compatibility: Not stated.
Public repository whatsonyourmind/modelforge.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/mcp/src/index.ts:119 await fetch(`${BASE_URL}/api/telemetry/mcp-install`, {io.github.World-999-Labs/proof-layer (MCP server)
Compatibility: Not stated.
**Cryptographic governance receipts for AI agents.** Issued *before* the agent acts.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareio.github.Writbase/writbase (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:15 prepareio.github.XCP/mcp-server (MCP server)
Compatibility: Not stated.
Give AI agents the ability to interact with [Counterparty](https://counterparty.io) , the token protocol built on Bitcoin.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/services/bundlephobia.ts:24 const response = await fetch(url, {io.github.YashviGupta15/npm-advisor-mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that acts as an intelligent npm package advisor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/verify-tarball.mjs:25 /(^|\/)\.npmrc$/i,io.github.Yummybait-fin/uniswap-tx-builder-mcp (MCP server)
Compatibility: Not stated.
Skill for driving the uniswap-tx-builder MCP: build unsigned Uniswap v3 liquidity-position transactions (collect, close/burn, mint, increase, plan), simulate them, and sign with your own wallet.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
.planning/milestones/v2-phases/phase-15/15-01-PLAN.md:158 Use `vi.stubGlobal('fetch', ...)` pattern from clienio.github.Yuuqq/jules-dispatch (MCP server)
Compatibility: Not stated.
> **Batch-dispatch tasks to [Google Jules](https://jules.google.com/) in parallel , and use it as an MCP tool inside [Claude Code](https://docs.anthropic.com/en/docs/claude-code) or [OpenAI Codex CLI](https://github.com/openai/codex).**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
examples/02-openai-migration/index.ts:5 * 1. Raw fetch (same payload shape as OpenAI)io.github.Z333Q/p402 (MCP server)
Compatibility: Not stated.
**AI payment router.** Route across 300+ models, settle per request in USDC on Base or USDC.e on Tempo.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/test-packed-install.mjs:86 await fs.rm(tarballPath, { force: true });io.github.Zk-nd3r/zcash-mcp (MCP server)
Compatibility: Not stated.
ZAP1 receipts for Zcash agents: verify workflows without trusting the server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
install.py:111 shutil.rmtree(p)It Department Skills (Skill)
Compatibility: Not stated.
Battle-tested global rules, portable skills, and a token-efficient skill-discovery system for AI coding agents (Claude Code, Cursor, Codex, Copilot , anything with a shell).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:24 prepareiwork_mcp (MCP server)
Compatibility: Not stated.
Create and edit Numbers, Pages, and Keynote documents through MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/secrets.ts:167 resp = await fetch(url, {JanuScope (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./januscope.png" alt="JanuScope logo" width="500" height="500" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED OBFUSCATION_MINIFIED_PAYLOAD
scripts/browser_login.py:84 shutil.rmtree(folder, ignore_errors=True)Javbus Formu Hotposts (Skill)
Compatibility: Not stated.
Collect authenticated JavBus forum posts and create private local popularity and preference reports.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/jdatamunch_mcp/storage/data_store.py:521 shutil.rmtree(dir_)Jdatamunch Mcp (MCP server)
Compatibility: Not stated.
Token-efficient MCP server for tabular data retrieval via CSV/Excel/Parquet/JSONL indexing
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/llm/src/index.ts:1504 const response = await this.#fetch(anthropicMessagesUrl(this.#baseURL), {Jixu (Skill)
Compatibility: Not stated.
<p align="center"> <img src="./assets/jixu-readme-hero-wide.png" alt="Jixu , Your Agent picks up where you left off." width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareJj Mcp Server (MCP server)
Compatibility: Not stated.
`jj-mcp-server` is a Model Context Protocol (MCP) server that exposes Jujutsu (`jj`) version-control operations as programmable tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
packages/jmri-mcp/codex/jmri_mcpctl.py:96 return subprocess.run(JMRI MCP (MCP server)
Compatibility: Not stated.
*[Version française](README.fr.md)*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
plugins/job-agent/job_agent/linkedin.py:120 subprocess.Popen(command, stdout=subprocess.DEVNULL, stderr=subproJob Agent (Plugin)
Compatibility: Not stated.
Job Agent is a local-first Codex plugin that helps a job seeker analyze opportunities, prepare strong applications, and keep track of every decision.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:13 prepareJobkeepr (MCP server)
Compatibility: Not stated.
Connect [Jobkeepr](https://jobkeepr.com) to Claude, ChatGPT, or any other MCP client, so an AI assistant can read and manage your field service business: jobs, customers, scheduling, estimates, invoices and payments.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:56 prepareJobScout MCP (MCP server)
Compatibility: Not stated.
A privacy-first, bring-your-own-connections MCP server for multi-source job discovery.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/check_release.py:226 out = subprocess.run(jobxhunter (Plugin)
Compatibility: Not stated.
Searches live UK and Canada jobs, fits an ATS-safe CV to each role from your real experience, and recommends the gaps to close.
This grade is a hygiene screen, not proof of safety.
