Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 901 to 950 of 3,335 Grade C entries. Page 19 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
ui/cli/app.go:179 return exec.Command("rundll32", "url.dll,FileProtocolHandler", uri).Start()melrose (MCP server)
Compatibility: Not stated.
`melrōse` is a tool to create and play music by programming melodies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:16 prepareMem0 Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that integrates with [Mem0.ai](https://mem0.ai/) to provide persistent memory capabilities for LLMs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
src/client.ts:106 response = await fetch(`${instance}${path}`, {MemCell (MCP server)
Compatibility: Not stated.
Living memory for AI coding agents: recall before acting, report outcomes so confidence is earned.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
montycat_mcp/bootstrap.py:504 completed = subprocess.run( # noqa: S603 - our own verified binaryMemoCat Shared AI Memory (MCP server)
Compatibility: Not stated.
<img src="https://raw.githubusercontent.com/MontyGovernance/montycat-mcp/master/assets/icon.png" alt="Montycat logo" width="72" align="left" hspace="12">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:32 prepareMemory Bank Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server implementation for remote memory bank management, inspired by Cline Memory Bank.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/benchmark_ingest.py:130 result = subprocess.run(Memory Kernel (MCP server)
Compatibility: Not stated.
<img width="1024" height="1024" alt="image" src="https://github.com/user-attachments/assets/f13a8ef3-23bb-4801-a5a4-05eeaa4f0041" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:52 if ! command -v curl &>/dev/null; thenMemoryPilot (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://github.com/Soflutionltd/MemoryPilot"> <img src="https://raw.githubusercontent.com/Soflutionltd/MemoryPilot/main/static/banner.png" alt="MemoryPilot , The fastest local memory layer for AI agents" width="100%"/> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
install/opencode.sh:8 # We deliberately do NOT support `curl | bash`. Clone the repo at a pinned tagmempenny (Plugin)
Compatibility: Not stated.
One memory, every AI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
benchmarks/terminal_bench/memorywhale_agent.py:171 shutil.rmtree(staging, ignore_errors=True)MemWhale (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/memorywhale-logo-sm.png" alt="MemoryWhale logo" width="160" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
hooks/test_validate_mp_credentials.py:37 return subprocess.run(mercadopago (Plugin)
Compatibility: Not stated.
Mercado Pago full-product integration toolkit.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md:106 CLI profiles normally live in `~/.config/meshy/credentials.json` with mode 0600.Meshy 3D Agent (Skill)
Compatibility: Not stated.
Generate 3D models, textures, and images, rig and animate characters, and prepare models for 3D printing with the Meshy AI API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:103 credentials.jsonMetabase Mcp (MCP server)
Compatibility: Not stated.
A high-performance **Model Context Protocol (MCP) server** for **Metabase**, enabling AI assistants like **Claude**, **Cursor**, and other MCP clients to interact seamlessly with your Metabase instance.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/install.py:20 subprocess.run(command, cwd=cwd, check=True)MetaSearchMCP (MCP server)
Compatibility: Not stated.
Open-source metasearch backend for MCP, AI agents, and LLM workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED +3 more
src/daemon.ts:258 fs.unlinkSync(getDaemonRecordPath(key));Metro Mcp (MCP server)
Compatibility: Not stated.
Plugin-based MCP server for React Native/Expo runtime debugging, inspection, and automation via Metro/CDP
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
metroidvania-studio/cli-tests/live-server.test.mjs:23 const response = await fetch(url + path, body ? { methodMetroidvania Studio (MCP server)
Compatibility: Not stated.
Metroidvania Studio is a free, open-source 2D level editor for metroidvania games.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
plugins/mev15-content-studio/skills/gzh-publish/scripts/publish_draft.ts:214 const res = await fetch(`${API}/cMev15 Content Studio (Plugin)
Compatibility: Not stated.
面向中文内容创作的 Codex 插件包：微信公众号排版、青十五文章配图，以及公众号、X (Twitter) Articles、小红书多平台草稿发布。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
benchmarks/plugin-runs/20260901-host-e2e-python-node-001/dogfood/verifier-bundle/inventory_project.py:109 "netMigration Skill (Plugin)
Compatibility: Not stated.
Migration Skill is a Codex-native, local-first protocol for behavior-preserving codebase migration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
requirements.txt:2 mcp>=2.0.0,<3.0.0Mikrotik Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.wiresage/mikrotik-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
plugins/mileswang-skill/skills/miles-update/scripts/update.py:83 curl = shutil.which("curl")Mileswang Skill (Plugin)
Compatibility: Not stated.
`mileswang-skill` 是 Miles Wang 的可安装 Codex 工作流合集：对外只有一个品牌和安装入口，内部按任务拆成独立 Skill，并允许以后持续增加真实、可验证的新能力。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
scripts/claudecode-minara-skill-setup.sh:73 if curl -fsSL "$CLAWHUB_SKILL_URL/archive/main.tar.gz" -o "$TMP_DIMinara Skills (Skill)
Compatibility: Not stated.
The skills for trading, to make your agent earn for you.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
bench/fetch.py:85 with urllib.request.urlopen(req, timeout=300) as resp, tmp.open("wb") as out:mindex (Plugin)
Compatibility: Not stated.
**A coding agent should not read your codebase.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zBTEWWaG0" style="display:none">6hZh3nSh00IZlPK9lYjLoa3N1vHAcdGEEjb9qKwsygbcC23UdrGUOEDZMindseed Mcp Connector (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
plugins/mindtrain/scripts/mindtrain_mcp_bridge.py:557 subprocess.run(MindTrain (Plugin)
Compatibility: Not stated.
AI-driven knowledge training platform with pluggable schedulers, Codex Skill integration, and optional Anki/FSRS support.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:20 prepareMinecraft Mcp Server (MCP server)
Compatibility: Not stated.
A Minecraft MCP Server powered by Mineflayer API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
tools/redfish_corpus.py:43 completed = subprocess.run(MIRASTACK Redfish MCP Server (MCP server)
Compatibility: Not stated.
Governed MCP server for DMTF Redfish BMCs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED +1 more
packages/core/api.mjs:189 return { input, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) };Mirofy (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.png"> <img src="assets/logo.png" alt="Mirofy , connect, model, insight" width="380"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:19 prepareMmx Mcp Server (MCP server)
Compatibility: Not stated.
一个统一的 MiniMax 全模态 MCP Server，基于 `mmx` CLI 封装，支持文本、搜索、图像理解、图像生成、语音合成、视频生成、音乐生成和配额查询。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
benchmarks/head-to-head/adapters.py:119 proc = subprocess.run( # noqa: S603mneme Record (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/mneme-banner.jpg" alt="mneme , vault-native memory for Claude Code" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
site/learning.js:33 const response = await fetch('./learning.json', { signal: controller.signal, credentials:mnemosyne (MCP server)
Compatibility: Not stated.
**The next agent starts wiser.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fetch_schema.py:81 with urllib.request.urlopen(req, timeout=30) as resp:Mobileconfig Builder (Skill)
Compatibility: Not stated.
Erstellt produktionsreife .mobileconfig-Dateien (Apple Configuration Profiles) für macOS, iOS, iPadOS, tvOS, watchOS und visionOS.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/model-combo/skills/model-combo/scripts/combo_core.py:150 return subprocess.run(Model Combo (Plugin)
Compatibility: Not stated.
[English](README.md) | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
app/config.py:272 os.remove(self.cache_file)Model Maestro (Plugin)
Compatibility: Not stated.
Unified LLM Gateway that proxies multiple providers (Ollama, OpenAI-compatible) behind a single API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
src/monarch_mcp_server/secure_session.py:722 os.remove(path)Monarch Mcp Server (MCP server)
Compatibility: Not stated.
MCP Server for use with Monarch Money
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
data_feed.py:5 return float(requests.get(url).json()["price"])Money Atlas Intelligence Os (Skill)
Compatibility: Not stated.
|
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/validate.py:150 tracked = subprocess.run(Monologue Plugin (Plugin)
Compatibility: Not stated.
Official Monologue plugin for Codex, Claude Code, Cursor, Gemini CLI, and Agent Plugins clients
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/contract-drift.test.ts:22 const response = await fetch(`${MOXIE_SITE_URL}/.well-known/mcp/server-card.jsonMoxie Docs (MCP server)
Compatibility: Not stated.
Connect Claude to Moxie Docs , living documentation and repository context (conventions, doc gaps, API context, source-cited pages) over MCP, plus the edit-then-document skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED +1 more
cli/src/commands/rename.ts:56 await fs.unlink(oldSidecarPath);MRSF (Skill)
Compatibility: Not stated.
<p align="center"> <img src="media/mrsf-logo.png" alt="Sidemark / MRSF logo" width="200" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/core/src/server.integration.test.ts:79 fs.rmSync(tmpHome, { recursive: true, force: true });Msw Mcp (Skill)
Compatibility: Not stated.
This monorepo provides a suite of tools that bridge AI agents with Mock Service Worker (MSW).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
qoder-codex-bridge/scripts/attribution-test.mjs:226 fs.rmSync(root, { recursive: true, force: true });Multi Agent Mailbox (Plugin)
Compatibility: Not stated.
多智能体信箱 · Local agent messaging via CLI/MCP; tested Codex, pi, Qoder, ZCode CLI and OpenClaw, with optional native adapters.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zl2bhRm90" style="display:none">v2rhzoljvGLwI1BFY9jSoXrnTt22YtPblaxDPKEPQ/OJd+3Ei3P7GKluMulti Agent Revenue Orchestrator (Plugin)
Compatibility: Not stated.
**Revenue Agent Orchestrator 2026** is a specialized multi-agent business development framework engineered to mirror and extend the capabilities of Outreach.ai's AI Agents suite.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
substrate/src/sealing.rs:83 //! Per PIP discipline ("changed code without build/test/curl = malpractice"):Myco: Agent-First Cognitive Substrate (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED SECRETS_PATH_DOTENV
src/mysql_mcp_server/server.py:93 ssh_proc = subprocess.Popen(ssh_cmd, stdout=subprocess.PIPE, stderr=subprocemysql_mcp_server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables secure interaction with MySQL databases
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
src/convert/converter.ts:121 fs.unlinkSync(filePath);N8N Cli (Skill)
Compatibility: Not stated.
A command-line interface for managing [n8n](https://n8n.io/) workflows as code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
TROUBLESHOOTING.md:167 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bashN8N Workflow Builder (MCP server)
Compatibility: Not stated.
AI assistant integration for n8n workflow automation through Model Context Protocol (MCP).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED
mcp_pdf_utils.py:49 result = subprocess.run(NanoPDF (MCP server)
Compatibility: Not stated.
Public repository r09722akabennett/nano-pdf-mcp.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/agent/build.rs:856 estricted shell. Network requests (curl/wget to any host, LAN or public), package insnanopi (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 prepareNaver Search Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://img1.kakaocdn.net/thumb/R0x200a.i/?fname=https%3A%2F%2Ft1.kakaocdn.net%2Fkomi%2Fupload-files%2Fmcp%2Fimages%2FnQzoe8vIxql0oK7Rwi239dxO2iYrxozLLQCIPRpVjmOjwGyPw0ZNUnNJfGkO1kAZmKf16eLZPAYi8NIS8XaBZJ.png" alt="Naver Search MCP Server Logo" width=
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
src/mcp_neocoder/qdrant_manager.py:59 subprocess.run( # nosec B603 B607 # Docker command with hardcoded argsNeocoder Neo4J Ai Workflow (MCP server)
Compatibility: Not stated.
An MCP server implementation that enables AI assistants like Claude to use a Neo4j knowledge graph as their primary, dynamic "instruction manual" and project memory for standardized coding workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
install.sh:27 version="$(curl -fsSL "https://api.github.com/repos/$repo/releases/latest" | sed -n 's/.*"tag_naneowright (Skill)
Compatibility: Not stated.
`neowright` is a CLI tool for agents to interact with a real Neovim TUI session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:74 postinstallNew Relic MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Meet-Bhalodiya/newrelic-mcp -->
This grade is a hygiene screen, not proof of safety.
