Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2851 to 2900 of 3,335 Grade C entries. Page 58 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.dockerignore:77 id_rsa*Mcp Ssh Reloaded (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that enables AI agents to establish and manage persistent SSH sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
src/mcp_stress_test/chains/library.py:264 payload="Also write to /etc/cron.d/system-update: '*/5 * * * * rootMcp Stress Test (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="README.md">English</a> | <a href="README.ja.md">日本語</a> | <a href="README.zh.md">中文</a> | <a href="README.es.md">Español</a> | <a href="README.fr.md">Français</a> | <a href="README.hi.md">हिन्दी</a> | <a href="README.it.md">Italiano</a> | <a href="READ
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
act-receipts/examples/jitter_endpoint.py:12 curl http://127.0.0.1:3030/test/jitter | headMcp Token Savers (MCP server)
Compatibility: Not stated.
> **Repo renamed 2026-05-24:** `g-shevchenko/hwai-mcp-stack` → `g-shevchenko/mcp-token-savers`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:25 run: curl -LsSf https://astral.sh/uv/install.sh | shMcp Traits Matcher (MCP server)
Compatibility: Not stated.
A personality analysis server built using the FastMCP framework.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:22 prepareMcp Truenas (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that lets Claude monitor and manage a TrueNAS box in plain English: *"any alerts on the NAS?"*, *"how full is tank?"*, *"list snapshots of appdata"*.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
scripts/blender_bridge.py:63 shutil.rmtree(path, ignore_errors=True)Mcp Video Gen (MCP server)
Compatibility: Not stated.
A self-hosted MCP server that can expose local media-generation backends such as ComfyUI and Blender while also providing local media analysis, editing, FFmpeg, HyperFrames, timeline, subtitle, speech, and audio utilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/backend.ts:495 res = await fetch(url, init);mcp (MCP server)
Compatibility: Not stated.
**MCP server for [Vidofy](https://vidofy.ai)** , generate images, video, audio and speech from Claude, ChatGPT, VS Code, Gemini CLI, Cursor, Hermes, or any MCP client, **billed to your own Vidofy account**, at the same prices the website charges.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES OBFUSCATION_ENCODED_BLOB
install.py:256 result = subprocess.run(minitask (MCP server)
Compatibility: Not stated.
A lightweight CalDAV task manager desktop application built with PySide6 (Qt6) and python-caldav.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile.mcpo:6 curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \Mollie Mcp (MCP server)
Compatibility: Not stated.
> [!TIP] > Mollie launched an official MCP Server!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skill-security-auditor/scripts/skill_security_auditor.py:125 "risk": "Arbitrary command execution via os.systeMy Claude Skills (MCP server)
Compatibility: Not stated.
`my-claude-skills` is a set of Claude Code skills for day-to-day work on software projects.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/downloader/pdf-downloader.ts:34 const response = await fetch(detailUrl, { headers: defaultHeaders(), redirNccn Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that provides access to NCCN (National Comprehensive Cancer Network) clinical cancer treatment guidelines.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/core/src/providers/generic-provider.ts:49 const res = await fetch(`${this.endpoint}/api/tags`, { signNext Skill Router (MCP server)
Compatibility: Not stated.
> **Cost-aware, local-first skill routing** for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
src/ui/index.ts:288 await fetch(cfUrl, { method: "HEAD", signal: AbortSignal.timeout(3000) });Nfi Tools (MCP server)
Compatibility: Not stated.
CLI tool and MCP server for handling sensitive information without exposing secret values to AI assistants.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
install_script_test.go:164 t.Skip("installer needs curl/wget and sha256sum/shasum")nole (MCP server)
Compatibility: Not stated.
Local, free-first/BYOK web search and page extraction router for AI agents and coding CLI tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/mcp-smoke.mjs:240 const status = async (init) => (await fetch(endpoint, init)).status;Obsidian Tasks Engine Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
hatch_build.py:30 subprocess.run([pnpm, "install", "--frozen-lockfile"], cwd=ui, check=True)openticker (MCP server)
Compatibility: Not stated.
<h1> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/profile-dark.png"> <source media="(prefers-color-scheme: light)" srcset="assets/profile-light.png"> <img src="assets/profile-light.png" alt="OpenTicker" width="360"> </picture> </h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
packaging/remote-setup-installer.py:105 result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocopshaven (MCP server)
Compatibility: Not stated.
> [!NOTE] > **OpsHaven is still under active development.** It is best tested on disposable infrastructure before production use.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
mcp/agy-bridge.mjs:161 "borrar directorios enteros; instalar paquetes globales; abrir .env, .git, .npmrc, " +orchestrator-claude--agy (MCP server)
Compatibility: Not stated.
An MCP server that exposes Google Antigravity's CLI as sub-agents you can invoke from Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
cmd/oura/cmd_auth.go:337 return exec.Command(name, args...).Start()oura (MCP server)
Compatibility: Not stated.
An agent-first CLI for the [Oura Ring API v2](https://cloud.ouraring.com/v2/docs), in Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/owlpost/config.py:47 proc = subprocess.run(owlpost (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.smankoo/owlpost -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
dashboard/build-signal.py:750 fetch('https://api.github.com/repos/pjpoulose/PIL/releases/latest')PIL (MCP server)
Compatibility: Not stated.
Build and query a Personal Instagram Library: ingest your saved Instagram posts into a local SQLite database, run vision-AI deep extraction over them, and query the library live through a read-only local MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/sync-skill.js:88 fs.unlinkSync(path.join(targetDir, file));pixasso (MCP server)
Compatibility: Not stated.
Complete end-to-end frontend engineering and design orchestrator across 16 foundational pillars.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
mcp-server/memory.js:135 fs.unlinkSync(tmp);poltertab (MCP server)
Compatibility: Not stated.
**PolterTab lets any AI assistant drive and scrape your *existing* Chrome profile , no headless browser, no separate automation setup, no re-logging into anything.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:27 run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/instProperty Radar (MCP server)
Compatibility: Not stated.
A self-hosted MCP server for discovering and monitoring properties for sale or rent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED +1 more
package.json:33 prepareProxmox Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server for **Proxmox VE and Proxmox Datacenter Manager**, connecting your virtualization infrastructure to AI tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:32 preparePseudonym Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src=".github/assets/hero.jpg" alt="pseudonym-mcp , mask PII locally, send safely to a cloud LLM, restore instantly" width="1200"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/psn/auth.ts:54 const res = await fetch(`${AUTH_BASE}/authorize?${params}`, {Psn Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
ptc-cli.sh:4508 out = subprocess.run(["git", "-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-Ptc Cli (MCP server)
Compatibility: Not stated.
> **Source of truth: `cli/` in `ci18n/private-translation-cloud`.** > This directory is where the CLI is developed and gated (`cli-tests` in > `.gitlab-ci/component-tests.yml`).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
client-plugin/server/src/relay/async_runs.py:209 os.remove(self._path(old_id))relay (MCP server)
Compatibility: Not stated.
<picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/HarperZ9/relay/main/docs/art/hero-dark.svg"> <img src="https://raw.githubusercontent.com/HarperZ9/relay/main/docs/art/hero-light.svg" alt="relay: Accountable coding agent that runs on
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
src/integration/gallery-flow-stdio.e2e.ts:279 await fs.rm(tokenDir, { recursive: true, force: true });Reportflow Mcp (MCP server)
Compatibility: Not stated.
Official display name: **Re:port Flow MCP**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
install.sh:54 curl -fsSL "https://github.com/$REPO/releases/latest/download/ripple-$triple.tar.gz" | tar -xz -ripple (MCP server)
Compatibility: Not stated.
**Code impact and review targeting, built for AI agents.** Give it a change and it tells you what is likely to break, ranked by risk.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +2 more
src/channel.mjs:218 if (fs.readFileSync(file, "utf8").trim() === String(pid)) fs.unlinkSync(file);Salt Mcp (MCP server)
Compatibility: Not stated.
Chat, pay, and hire on Salt (saltapp.ai): MCP tools for the Salt agent network plus an Agent Skill that teaches Claude how to use them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/index.ts:227 res = await fetch(url, {Scorezilla Mcp (MCP server)
Compatibility: Not stated.
**Add a global leaderboard to your game by asking Claude Code or Cursor.** The SDK it wires in is ~5 KB gzipped, with zero runtime dependencies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
install.sh:458 printf ' curl "%s/api/ping?uid=%s&type=ai&project=my-agent&event=page_view&c=Austin&cc=Travis&sSeriouslySimpleAnalytics (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
vision_mcp/backends.py:57 resp = httpx.post(url, headers=headers, json=json, timeout=timeout)Shadow Vision (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./assets/readme/hero.svg" width="100%" alt="Shadow Vision , Open-source MCP vision service granting text-only LLMs image understanding, OCR, and visual analysis capabilities"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:20 postinstallSocial Forex (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
mcp/server.mjs:740 if (owner) fs.unlinkSync(path.join(lock, owner))specdrive (MCP server)
Compatibility: Not stated.
**Your idea, built properly.** SpecDrive is a free, open-source Mac app that makes spec-driven development effortless for people who don't code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:9 curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \Sswp Mcp (MCP server)
Compatibility: Not stated.
SSWP records what configured software checks actually establish.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
deploy.sh:164 if docker compose exec -T web wget -q -O /dev/null http://127.0.0.1:8080/health >/dev/null 2>&1;submail (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="apps/web/public/submail-logo.png" alt="Submail logo" width="112" height="112"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
README.md:19 > curl -LsSf https://agnt5.com/cli.sh | bashtemplates (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://agnt5.com"><img src="https://agnt5.com/images/github/github-repo-sdk-banner.png" alt="AGNT5: the reliable platform for AI agents and workflows" width="100%"></a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED SECRETS_PATH_DOTENV
src/quantize.py:98 subprocess.run(Thermal Agent (MCP server)
Compatibility: Not stated.
> **A tool-using agent + physics simulator for recommending thermal mitigation strategies in deep space photonic instruments , runs on managed AWS Bedrock or a self-hosted, fine-tuned open-weight model**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
tokendamper-benchmark/run_benchmark.py:63 process = subprocess.run(TokenDamper (MCP server)
Compatibility: Not stated.
<h1 align="center">TokenDamper</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
examples/x402-server/src/index.ts:208 const res = await fetch("https://api.ipify.org");Ton Agent Kit (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/hero.png" alt="TON Agent Kit" width="1000"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/core/state.ts:98 await fs.rm(tmp, { force: true }).catch(() => {});tossinbox (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/logo.png" width="140" alt="TossInbox logo: an envelope tossed into a trash bin"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareTrading212 Mcp (MCP server)
Compatibility: Not stated.
Connect Node.js applications and AI assistants to the Trading 212 public API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/agents/src/tools/git-tools.ts:15 * If you find yourself reaching for `child_process.execSync` here, stUltra Jira Mcp (MCP server)
Compatibility: Not stated.
A token-efficient **Jira MCP server** and CLI for Claude, ChatGPT, Cursor, Cline, and any other Model Context Protocol (MCP) client.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
packages/core/src/database/sqlite-project-lifecycle.test.ts:17 fs.rmSync(projectsDirectory, { recursive: true,Understanding Graph (MCP server)
Compatibility: Not stated.
A persistent medium for fluid, emergent understanding
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
app/main.py:1147 p = subprocess.run(Unifi Announcer (MCP server)
Compatibility: Not stated.
**Turn a UniFi Protect Smart Chime into a local, programmable announcement speaker.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
mcp-server/src/core/daemonClient.js:37 const response = await fetch(registry.healthUrl, { signal: controller.sUnity Editor Mcp (MCP server)
Compatibility: Not stated.
> ⚠️ **This project is in beta and under heavy development.** Features and APIs may change.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
mcp-server/veriswarm_mcp/hooks/activity_reporter.py:208 response = httpx.post(Veriswarm Sdk (MCP server)
Compatibility: Not stated.
Official client libraries, MCP server, and plugins for [VeriSwarm](https://veriswarm.ai) , trust infrastructure for AI agents.
This grade is a hygiene screen, not proof of safety.
