Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2101 to 2150 of 3,335 Grade C entries. Page 43 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/agentlefs/scripts/memory_hooks.py:225 shutil.rmtree(directory)plugins (Plugin)
Compatibility: Not stated.
Plugins that connect AI coding agents to [agentleFS](https://agentlefs.com), a permissioned org-context store.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/pushpush/http.py:218 with urllib.request.urlopen(request, timeout=timeout) as response:pushpush (Plugin)
Compatibility: Not stated.
**English** | [한국어](README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
scripts/skillport-auto-refresh.ps1:227 $PathPattern = '(?im)(^|/)(\.env($|\.)|\.npmrc$|\.yarnrc(\.yml)?$|\.netSkillPort (Plugin)
Compatibility: Not stated.
SkillPort packages agent skills for distribution across machines, repos, Codex, and Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
lib/headless-fallback-provider.cjs:176 // so that module-level code never touches fetch (FR-010).Spec Flow (Plugin)
Compatibility: Not stated.
Approve one design doc; the agent builds it, tests it for real and opens the PR.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
scripts/dev_deploy.py:215 return subprocess.check_output(Subagent Governance (Plugin)
Compatibility: Not stated.
[English](README.md) · [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/security/SKILL.md:43 - `.aws/credentials`SystemSmith (Plugin)
Compatibility: Not stated.
SystemSmith turns recurring engineering judgment into reusable agent skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
packages/core/drivers/chromium-web-driver.mjs:141 const socket = new WebSocket(endpoint);Ui Distiller (Plugin)
Compatibility: Not stated.
**Turn authorized UI evidence into inspectable, adaptable design assets , locally.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/validate-distribution.py:169 result = subprocess.run(Vidiq Mcp (Plugin)
Compatibility: Not stated.
Official vidIQ plugin for YouTube creators.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
remote-mcp/build_guides.py:6 css='''*{box-sizing:border-box}html{color-scheme:dark}body{margin:0;background:#0Vnish Global Operator (Plugin)
Compatibility: Not stated.
Read-only VNISH firmware routing, compatibility verification, staged rollout planning, rollback lineage checks, and assumption-led ROI calculation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
plugins/workflow-manager/scripts/orchestrator_hook.py:1 #!/usr/bin/env python3Workflow Manager (Plugin)
Compatibility: Not stated.
面向 Codex 的质量优先、上下文高效工作流管理插件：只减少冗余和噪声，不削弱解决问题所需的推理、证据、纠错与验收验证。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
lib/zcodex_memory/extraction.py:163 runner: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,Zcodex Memory (Plugin)
Compatibility: Not stated.
[中文](README.zh-CN.md) | English
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
plugin/scripts/zeyu_plugin_client/tunnel.py:105 with socket.create_connection(("127.0.0.1", port), timeout=minZeyu Windows Gpu (Plugin)
Compatibility: Not stated.
> Mac 上写代码和使用 Codex，Windows 笔记本安静地提供 NVIDIA GPU。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
afterpaths/cli.py:1712 result = subprocess.run(Afterpaths (MCP server)
Compatibility: Not stated.
**Smarter with every session, automatically.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
arnes/llm/ollama.py:302 "Install with: curl -fsSL https://ollama.com/install.sh | sh && ollama pull llama3.2"Agentic Harness (MCP server)
Compatibility: Not stated.
<!-- Social preview metadata.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
core/console.py:14 with urllib.request.urlopen(req,timeout=20) as response: return json.load(response)Agentic Team Mcp (MCP server)
Compatibility: Not stated.
*Live interactive Web Studio floor visualization showing Root Watchdog supervision, hierarchical reporting trees, and dynamic agent collaboration links.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_HOST_FROM_INPUT +2 more
agentline/static/agentline_relay.py:115 subprocess.run(_runtime_command(config, "gateway", "install", "--forceAgentLine (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="agentline-logo-200.png" alt="AgentLine Logo" width="120" /> <h1>AgentLine , Phone API for AI Voice Agents</h1> <p><strong>Open-source AI phone agent platform , real phone numbers, outbound & inbound voice calls, SMS, MCP, and IVR</strong></p> <p>G
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
README.md:110 curl -fsSL https://bun.sh/install | bashAha.io (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides seamless integration with Aha.io's product management platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
packages/cm360-mcp/scripts/generate-types.ts:328 await fs.unlink(SPEC_PATH);Amazon DSP MCP Server (MCP server)
Compatibility: Not stated.
Self-hostable MCP connectors for major advertising platforms.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
agent/scripts/dash.mjs:50 const res = await fetch(new URL(apiPath, OP.url), {Amh Cloudflare Ops Mcp By Wt (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/wt-walrus.png" width="360" alt="WT walrus standing in side profile with large tusks and a WT circuit badge"> <br><sub>The WT walrus, the Walrus Tusk mascot.</sub> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
anansi/__main__.py:71 result = await fetcher.fetch(args.url, proxy=args.proxy)anansi (MCP server)
Compatibility: Not stated.
<img src="https://repository-images.githubusercontent.com/1238896536/d711cc76-8358-4a4a-9160-341131498877">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/check-mcp-sdk-version.sh:40 CENTRAL_VERSION=$(curl -s --max-time 10 "$CENTRAL_URL" \api2mcp4j (MCP server)
Compatibility: Not stated.
**Turn your existing Spring Boot REST controllers into MCP (Model Context Protocol) tools , no rewrites, no `@Tool` everywhere.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.sh:3 # Usage: curl -sL https://gitee.com/apocdata/ApocData-skill/raw/main/scripts/install.sh |Apocdata Skill (MCP server)
Compatibility: Not stated.
A-share data service with structured announcement parsing: every announcement carries an AI summary, category, importance level and sentiment, fully traceable to source.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/generate-pet-banner.py:19 subprocess.run(args, check=True)Awesome Codex Cli (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/codex-pet-banner.gif" alt="The eight built-in Codex Pets animated together , Awesome Codex CLI" width="960"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
details/mc-server-wrapper.md:19 subprocess.run(["java", "-jar", "server.jar", "nogui"])Awesome Mcp Servers (MCP server)
Compatibility: Not stated.
Public repository ever-works/awesome-mcp-servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 prepareBPE (Bitcoin Pricing Engine) (MCP server)
Compatibility: Not stated.
Cross-venue Bitcoin market intelligence , consolidated pricing, ML signals, funding-rate skew, sentiment, and natural-language briefings across 36 exchanges.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/auth/auth-cooldown.ts:66 await fs.unlink(this.file).catch(() => {});Brightspace Mcp Server (MCP server)
Compatibility: Not stated.
> **By [Rohan Muppa](https://github.com/rohanmuppa), ECE @ Purdue**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:17 prepareCaldav Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:38 prepareCalypso Multimodal RAG MCP (MCP server)
Compatibility: Not stated.
**Hosted multimodal RAG for Claude Desktop, Cursor, and agent workflows , in one `npx` command.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:14 prepareChamber (MCP server)
Compatibility: Not stated.
**Chamber MCP** , seal / open JSON.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
internal/cli/command/ssh.go:31 flags.Var(&identities, "identity", "private key; repeat to try in order (defaulChannelTerm (MCP server)
Compatibility: Not stated.
[English](README.md) | [Deutsch](README.de.md) | [Español](README.es.md) | [Français](README.fr.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Русский](README.ru.md) | [简体中文](README.zh-CN.md) | [繁體中文](README.zh-TW.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:7 (unset OS; unset SHELL; curl -fsSL https://bun.sh/install | bash)Cloudinary Asset Management (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.cloudinary/asset-management-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
bin/crbro.mjs:565 else { try { fs.rmSync(ep.stateFile(root, st.build), { force: true }); } catch { /* stale fiCrbro Memory (MCP server)
Compatibility: Not stated.
**CRBRO** is a local MCP (Model Context Protocol) server that gives your AI assistant **persistent long-term memory** across sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:29 credentials.jsonDakera Mcp (MCP server)
Compatibility: Not stated.
MCP server for Dakera AI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
cmd/doc-scraper/docs_drift_test.go:86 out, err := exec.Command(bin, append(args, "-h")...).CombinedOutput()Doc Scraper (MCP server)
Compatibility: Not stated.
> A configurable, concurrent, and resumable web crawler written in Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
docker_mcp/tools/_cli.py:219 # before subprocess.run(timeout=timeout) below, so without this an unreachable orDocker Mcp (MCP server)
Compatibility: Not stated.
<img src="https://raw.githubusercontent.com/L337-org/docker-mcp/main/assets/icon.png" align="left" width="72" height="72" alt="">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
internal/web/handlers_automation.go:59 // a browser form always sends this; curl and scripts don't unless tolderaser (MCP server)
Compatibility: Not stated.
**Take back your privacy.** Eraser sends data removal requests to 700+ data brokers on your behalf , for free.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:94 @cyanheads/mcp-ts-coreEur Lex Mcp Server (MCP server)
Compatibility: Not stated.
Search EU legislation, CJEU case law, and treaties; traverse the CELLAR relationship graph; resolve EuroVoc concepts via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:43 @angular/commonGalaxy UI MCP Server (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
Packages/AppCore/Sources/AppCore/HostSession.swift:798 if let value = await fetch({ try await client.listContagantry (MCP server)
Compatibility: Not stated.
**Native Docker management for your Mac.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:100 prepareGerman Legal Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
demo/web/app.js:11 const result = await WebAssembly.instantiateStreaming(fetch("qr.wasm"), go.importObject);Go Qr (MCP server)
Compatibility: Not stated.
<h1 align="center">go-qr</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
evals/scripts/cursor.sh:48 echo "Error: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/io.github.buildkite/buildkite-mcp-server (MCP server)
Compatibility: Not stated.
> **[Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server exposing Buildkite data (pipelines, builds, jobs, tests) to AI tooling and editors.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
kicad_mcp_server/tools/operations.py:177 result = subprocess.run(io.github.bunnyf/kicad-mcp-server (MCP server)
Compatibility: Not stated.
The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/video_editor_mcp/server.py:1598 subprocess.Popen(io.github.burningion/video-editing-mcp (MCP server)
Compatibility: Not stated.
See a demo here: [https://www.youtube.com/watch?v=KG6TMLD8GmA](https://www.youtube.com/watch?v=KG6TMLD8GmA)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
debug/test-e2e-policy.js:103 fs.unlinkSync(AUDIT_PATH);io.github.bvisible/mcp-ssh-manager (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables **Claude Code** and **OpenAI Codex** to manage multiple SSH connections.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/memory/providers/dokoro-provider.ts:182 await fs.unlink(filePath);io.github.byPawel/tachibot-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL +1 more
sync/github_sync.ts:301 await fs.unlink(filepath);io.github.bytewizard42i/soulsketch (MCP server)
Compatibility: Not stated.
[GitHub repository](https://github.com/bytewizard42i/soulSketch) · [npm: `@soulsketch/mcp-server`](https://www.npmjs.com/package/@soulsketch/mcp-server)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
hub/cli.mjs:1064 fs.unlinkSync(freezeFile());io.github.bzdOS/hubd (MCP server)
Compatibility: Not stated.
**The project tracker for teams of humans and AI agents , in plain files.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/api/client.ts:26 return await fetch(url, {io.github.cadlens-co/cadlens-mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server that wraps the [Cadlens CAD parsing API](https://cadlens.co) so MCP-aware LLM clients (Claude Desktop, Claude Code, Cursor, Zed, Windsurf) can parse CAD files (`.dwg`, `.dxf`, `.dwf`, `.dwfx`, `.dgn` V7, `.pdf`, m
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
benchmarks/harvest.mjs:21 objects = (await (await fetch(url)).json()).objects ?? [];io.github.caglarbozkurt/heimdall (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
