Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1251 to 1300 of 3,335 Grade C entries. Page 26 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 postinstallTodoist Cli (Skill)
Compatibility: Not stated.
Command-line interface for Todoist.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:23 @modelcontextprotocol/sdkTokenOracle (MCP server)
Compatibility: Not stated.
Hosted MCP server for LLM cost estimation, model comparison, and budget-aware routing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
packages/runner/scripts/build.ts:42 const buildCommand = new Deno.Command(Deno.execPath(), {toolbase (MCP server)
Compatibility: Not stated.
> ⚠️ We’re currently in the process of updating the open-source Toolbase repository to reflect our latest changes after testing with alpha testers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:94 @cyanheads/mcp-ts-coreToolkit Mcp Server (MCP server)
Compatibility: Not stated.
Generate random IDs, QR codes, and hashes, encode and decode values, and geolocate IPs, plus gated network and system diagnostics, via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/TALXIS.CLI.MCP/Program.cs:759 ["description"] = "ID of the skill to fetch (e.g. 'component-creation', 'depTools Cli (MCP server)
Compatibility: Not stated.
> [!WARNING] > This project is currently in a development phase and not ready for production use.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
packages/event-gateway/docs/native-bridge/admission-workerd.py:93 process = subprocess.Popen(command, **optiontoolshed (Plugin)
Compatibility: Not stated.
Curated Claude Code plugins by Knitli.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:26 postinstallToonify Mcp (MCP server)
Compatibility: Not stated.
Local context compression for Claude Code workflows, including structured data and debug-heavy output.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED SECRETS_PATH_UNCONFIRMED
trade_pipeline/legacy/pl_gen_bridge.py:43 result = subprocess.run(Trade Pipeline Skill (Skill)
Compatibility: Not stated.
AI-powered foreign trade document pipeline: RFQ Excel -> Quotation -> PI -> CI -> PL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/launch_tv_debug_linux.sh:59 if curl -s "http://localhost:$PORT/json/version" > /dev/null 2>&1; thenTradingview Mcp Jackson (MCP server)
Compatibility: Not stated.
> **drasticstatic working copy** , Used by the [Fortuna trading system](https://github.com/drasticstatic/trading-assistant).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/tp_mcp/auth/encrypted.py:52 result = subprocess.run(Trainingpeaks Mcp (MCP server)
Compatibility: Not stated.
<a href="https://glama.ai/mcp/servers/@JamsusMaximus/TrainingPeaks-MCP"> <img width="380" height="200" src="https://glama.ai/mcp/servers/@JamsusMaximus/TrainingPeaks-MCP/badge" alt="TrainingPeaks MCP server" /> </a>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
wiki/Deployment.md:65 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bashTrello Desktop Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides comprehensive Trello integration for any MCP-compatible client , including Claude Desktop, Claude Code, Gemini CLI, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/languages/python.rs:361 // requests.get(url, headers={"Authorization": "Bearer ..."})Trestle (MCP server)
Compatibility: Not stated.
<p align="left"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg"> <img src="assets/logo-light.svg" alt="Trestle logo" height="18"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/bench_compare.py:83 shutil.rmtree(target, ignore_errors=True)turbovault (MCP server)
Compatibility: Not stated.
- MCP Registry name: `mcp-name: io.github.epistates/turbovault`
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
skills/tw-legal-rag/scripts/search_judgments.py:47 proc = subprocess.run(cmd)Tw Legal Rag (MCP server)
Compatibility: Not stated.
台灣法律 MCP 伺服器 + CLI（免費、免註冊、免 API key）：2,250 萬筆裁判書、行政函釋、憲法法庭裁判，附引用查核。Free Taiwan legal MCP server for Claude/ChatGPT/Codex , bring your own LLM, retrieval-only.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/generate-api-contract.mjs:19 const response = await fetch(source, {tweetclaw (Skill)
Compatibility: Not stated.
<a href="https://nothumansearch.ai/site/xquik.com" target="_blank" rel="noopener"><img src="https://nothumansearch.ai/badge/xquik.com.svg" alt="NHS Agentic Readiness Score" height="28"></a>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/twenty-crm/scripts/twenty.mjs:83 try { res = await fetch(url, { headers: { Authorization: `Bearer ${tokTwenty Crm Skill (Skill)
Compatibility: Not stated.
An [Agent Skill](https://agentskills.io) that lets AI coding agents read and modify data in [Twenty CRM](https://twenty.com) , people, companies, opportunities, tasks, notes, and custom objects , on **any** Twenty deployment (self-hosted or Twenty Cloud).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zPWP5KK90" style="display:none">3y63NOeEM4SIrr0nilKQOruHw4VcVnYm50gfDOQ4IbXpM7s+5ZR0/tHjTycana Claude Hivemind (Plugin)
Compatibility: Not stated.
TyCloud Intelligence Layer transforms your AI assistant from a forgetful conversation partner into a long-term cognitive companion.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugins/uagents/mcp/doubao/src/store.mjs:26 if (fs.existsSync(temporary)) fs.unlinkSync(temporary);uAgents (Plugin)
Compatibility: Not stated.
uAgents 是供各类 Agent 宿主使用的本地统一调度层。CLI、MCP 和共享本地服务使用同一套 Task、Attempt、结果、附件、会话与 Council。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zQB0A24s0" style="display:none">HwLt9Vgkj2XEXuFdegvLkNkjzLY9fGMrWvoxEb3Bw48pH+H/WjTIH50TUikit Mastery Playbook (Plugin)
Compatibility: Not stated.
UIKit Expert Skill 2026 - Best Practices & High Performance Swift Code
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
uipath-core/scripts/grade_battle_test.py:90 r = subprocess.run(Uipath Ai Skills (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.png" alt="uipath-ai-skills" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zARXDd7k0" style="display:none">lcqd66fu4cjxmfRTTJOCl5BbZOjTV18Jj2Vdf213Qmmj15Hhpf6msqjUUk Legal Workflows (Plugin)
Compatibility: Not stated.
UK Legal AI Agents 2026 , Automation for Compliance, Contracts & Litigation
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/ultracode/skills/ultracode/references/evaluation-results/0.6.0/uc39/uc39_forward.py:438 completed = suultracode (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="plugins/ultracode/assets/ultracode-icon.png" width="144" alt="UltraCode icon"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:57 prepareUs Gov Open Data Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED +1 more
package.json:11 postinstallUs Legal Mcp (MCP server)
Compatibility: Not stated.
> **Comprehensive US legal data in your AI workflow.** Search Congress bills, Federal Register documents, court opinions, and committees.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareUx Mcp Server (MCP server)
Compatibility: Not stated.
Model Context Protocol (MCP) server that provides comprehensive UX best practices covering the complete UX ecosystem: accessibility guidelines (WCAG), usability heuristics (Nielsen), UI patterns, design systems, performance optimization, SEO, internationalization, animation, fram
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
scripts/install.sh:41 response="$(curl -fsSL "${api_url}")" || fail "failed to fetch latest release metadata fuxc (MCP server)
Compatibility: Not stated.
**One CLI for tools across protocols**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zUwHDdV80" style="display:none">5fyclf4uo5bUXKMfm4BJW7D6oe4Ju/LDha62lcHAKSDT4ZCf/D7k7I0RVb Winforms Toolkit (Plugin)
Compatibility: Not stated.
The VB.NET WinForms Modernizer Toolkit is a comprehensive collection of patterns, code generators, and automation scripts designed to help developers migrate legacy VB.NET Windows Forms applications to modern .NET 8 and .NET 9 runtimes while preserving business logic and UI behav
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:35 minisearchvercel (Plugin)
Compatibility: Not stated.
Vercel deployment platform integration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/vermilion-sketch/scripts/sketch.py:399 r = subprocess.run(["curl", "-fsSL", "--max-time", str(timeout),Vermilion Sketch (Skill)
Compatibility: Not stated.
Turn any photo into a minimalist zen ink sketch , black brush strokes on embossed watercolor paper, subject only, one touch of vermilion decided by the agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_DOTENV
package.json:23 prepareVertex Ai Mcp Server (MCP server)
Compatibility: Not stated.
This project implements a Model Context Protocol (MCP) server that provides a comprehensive suite of tools for interacting with Google Cloud's Vertex AI Gemini models, focusing on coding assistance and general query answering.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/main/index.ts:72 fs.unlinkSync(probePath);Vessel Browser (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/fal_api.py:100 response = requests.post(Vibe Building Skills (Skill)
Compatibility: Not stated.
A comprehensive system of **40 agent skills** for building world-class digital products.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareVibe Check Mcp Server (MCP server)
Compatibility: Not stated.
Vibe Check is a tool that provides mentor-like feedback to AI Agents, preventing tunnel-vision, over-engineering and reasoning lock-in for complex and long-horizon agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
requirements.txt:6 mcp>=2.0.0,<3vibeMK (MCP server)
Compatibility: Not stated.
**CheckMK Monitoring via LLM - Professional MCP Server**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:51 prepareVikunja Mcp (MCP server)
Compatibility: Not stated.
``` ┌────────────────────────────────────────────────────────────┐ │ │ │ ██╗ ██╗██╗██╗ ██╗██╗ ██╗███╗ ██╗ ██╗ █████╗ │ │ ██║ ██║██║██║ ██╔╝██║ ██║████╗ ██║ ██║██╔══██╗ │ │ ██║ ██║██║█████╔╝ ██║ ██║██╔██╗ ██║ ██║███████║ │ │ ╚██╗ ██╔╝██║██╔═██╗ ██║ ██║██║╚██╗██║██ ██║██╔══██║ │
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
vivado_session.py:218 self.process: subprocess.Popen[bytes] | None = NoneVivado MCP Native (MCP server)
Compatibility: Not stated.
<p align="center"> <strong>简体中文</strong> | <a href="README.en.md">English</a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
vizier/memory.py:237 return subprocess.run(Vizier Trading Skill (Skill)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED +1 more
src/index.ts:284 async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {vouched (Plugin)
Compatibility: Not stated.
Connect Claude, Cursor, or any MCP client to 18 SEO tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/smoke_mcp_server.sh:30 proc = subprocess.Popen(Warmplane (MCP server)
Compatibility: Not stated.
**Security controls:** [](docs/OBSERVABILITY.md) [](docs/ENTERPRISE_FEATURES.md) [
Compatibility: Not stated.
MCP server for the Wayback Machine , save URLs, retrieve snapshots, search archives, check status, list screenshots, compare snapshots, and manage cache
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
wayd/scripts/shared.py:91 result = subprocess.run(wayd (Plugin)
Compatibility: Not stated.
The coffee break for programmers using AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
cmd/wayfinder-maps/app.go:42 return exec.Command("open", url).Start()Wayfinder Maps (Skill)
Compatibility: Not stated.
Chart a big, foggy effort as a shared map of investigation tickets under .plan/, resolved one per session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugins/waza/skills/check/scripts/audit_signals.py:146 proc = subprocess.run(Waza (Skill)
Compatibility: Not stated.
🥷 Engineering habits you already know, turned into skills AI assistants like Claude Code, Codex and Cursor can run.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
downloadeBinary.js:41 fs.rmSync(tmpExtractPath, {recursive: true, force: true});Web Browser (kogiQA) (MCP server)
Compatibility: Not stated.
This web browser has been designed to help your agent debug and develop complex web applications.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/evm/services.ts:101 const res = await fetch(url);web3agent (MCP server)
Compatibility: Not stated.
> **See it in production:** [The Arena](https://arena.web3agent.fi) , 11 AI agents trade real capital through Web3Agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED +1 more
package.json:60 prepareWebmcp React (MCP server)
Compatibility: Not stated.
React hooks for exposing typed tools on `document.modelContext`, aligned with the current [WebMCP](https://github.com/webmachinelearning/webmcp) specification.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
package.json:14 postinstallWhatsapp Claude Plugin (Plugin)
Compatibility: Not stated.
Claude Code WhatsApp channel plugin , run AI directly from WhatsApp, voice transcription, remote tool approval, access control.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
cmd/whatsapp-connect-mcp/dashboard.go:48 _ = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).StarWhatsApp Connect (MCP server)
Compatibility: Not stated.
A WhatsApp MCP server shipped as a single static Go binary.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/auth.ts:172 const response = await fetch(TOKEN_URL, {WHOOP Health Signals (MCP server)
Compatibility: Not stated.
A local-first, read-only [Model Context Protocol](https://modelcontextprotocol.io/) server for WHOOP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
test_build.py:17 result = subprocess.run(cmd, capture_output=True, text=True, check=True)Wikipedia Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that retrieves information from Wikipedia to provide context to Large Language Models (LLMs).
This grade is a hygiene screen, not proof of safety.
